Threat intelligence sharing offers a promising discipline to bolster knowledge and situational awareness amidst the rapid emergence of new cyber threats. Numerous platforms in the security solutions market enable effective and targeted sharing of threat intelligence among organizations. However, there is limited knowledge of the diffusion and use of threat intelligence platforms within companies, public authorities, and universities worldwide. To meet this challenge, we conducted an exploratory global survey of 118 security experts from companies, public authorities, and universities. Our findings show that threat intelligence sharing platforms are becoming more mature, evidenced by an increase in their prevalence and the utilization of their functionalities within the threat intelligence life cycle.

Threat intelligence sharing is a promising solution to enhance knowledge and situational awareness of the rapidly growing number of emerging cyber threats. Accordingly, there are a variety of platforms on the security solutions market that enable the efficient and targeted exchange of threat intelligence across organisations. Unfortunately, very little is known so far about the dissemination and use of these platforms from the end-user perspective. To address this issue, we conducted an exploratory study on the use of threat intelligence sharing platforms in Germany, Austria and Switzerland. For this purpose, we surveyed 69 security and IT experts from large companies, federal authorities and public universities in autumn 2022. Our findings show, among other things, a growing interest in threat intelligence sharing platforms and their value to information security processes.

In the last couple of years, organizations have demonstrated an increasing willingness to share data, information and intelligence regarding emerging threats to collectively protect against today’s sophisticated cyber attacks. Accordingly, several vendors started to implement software solutions that facilitate this exchange and appear under the name cyber threat intelligence sharing platforms. However, recent investigations have shown that these platforms differ significantly in their functional scope and often only provide threat data instead of the promised actionable intelligence. Moreover, it is unclear to what extent the platforms implement the expected intelligence cycle processes. In order to close this gap, we investigate the state-of-the-art in scientific literature and analyze the functional scope of nine threat intelligence sharing platforms with respect to the intelligence cycle. Our study provides a comprehensive list of software functions that should be implemented by cyber threat intelligence sharing platforms in order to support the intelligence cycle to generate actionable threat intelligence.

Cyber security management requires fast and cost efficient responses to threat alerts. Automation of cyber threat sensing and responding is one way to achieve immediate reactions to imminent threats. There are already tools for an extensive automation of threat sensing, e.g. threat intelligence sharing platforms. Methods, techniques and tools for reacting to menacing states and events, e.g. security-policy-controlled systems, have also been explored and published for some time. What is still missing, however, is the integration of these two approaches. This paper describes first steps towards an integration of threat intelligence sharing platforms and security-policy-controlled systems. We present a conceptual design for threat reaction strategies, security architectures and mechanisms and information representation requirements. We use two exemplary threat scenarios to demonstrate our proposals.