APPLICATION OF THE THREAT INTELLIGENCE PLATFORM TO INCREASE THE SECURITY OF GOVERNMENT INFORMATION RESOURCES
With the development of information technology, the need to solve the problem of information security has increased, as it has become the most important strategic resource. At the same time, the vulnerability of the modern information society to unreliable information, untimely receipt of information, industrial espionage, computer crime, etc. is increasing. In this case, the speed of threat detection, in the context of obtaining systemic information about attackers and possible techniques and tools for cyberattacks in order to describe them and respond to them quickly is one of the urgent tasks. In particular, there is a challenge in the application of new systems for collecting information about cyberevents, responding to them, storing and exchanging this information, as well as on its basis methods and means of finding attackers using integrated systems or platforms. To solve this type of problem, the promising direction of Threat Intelligence as a new mechanism for acquiring knowledge about cyberattacks is studied. Threat Intelligence in cybersecurity tasks is defined. The analysis of cyberattack indicators and tools for obtaining them is carried out. The standards of description of compromise indicators and platforms of their processing are compared. The technique of Threat Intelligence in tasks of operative detection and blocking of cyberthreats to the state information resources is developed. This technique makes it possible to improve the productivity of cybersecurity analysts and increase the security of resources and information systems.
threat intelligence; cybersecurity; cyberdefense
Hutchins E. M. et al.: Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. Lockheed Martin Corporation, 2010.
Palacín V.: Practical Threat Intelligence and Data-Driven Threat Hunting. Packt Publishing Ltd., 2021.
Potiy O. et al.: Conceptual principles of implementation of organizational and technical model of cyber defense of Ukraine. Information protection 23(1), 2021.
Rid T. et al.: Attributing Cyber Attacks. The Journal of Strategic Studies 38(1-2), 2015, 4–37. DOI: https://doi.org/10.1080/01402390.2014.977382
Shackleford D.: Who's Using Cyberthreat Intelligence and How? SANS Institute 2015.
Zhylin M. et al.: Functional model of cybersecurity situation center. Information Technology and Security 6(2), 2018, 51–67 [http://doi.org/10.20535/2411-031.2018.6.2.153490]. DOI: https://doi.org/10.20535/2411-1031.2018.6.2.153490
Exploring the opportunities and limitations of current Threat Intelligence Platforms. Public version 1.0, ENISA, December 2017.
Standards and tools for exchange and processing of actionable information. European Union Agency for Network and Information Security, 2017.
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.