Best Practices for Building an Information Sharing Community

Define Your Success Criteria

When getting started, it is important to define success criteria for your community and outline what it means to be successful in the first 90, 180, 270,365 days. This is done in order to drive both engagements with your Members and the adoption of key technologies. Cyware solutions give you the options to drive both human engagement and machine-to-machine sharing. With that, it is important to understand as much as possible about the overall capabilities of your membership and what levels of interaction to expect. Using this knowledge, coupled with the understanding of the overall goals for your community, you can actively plan how to best drive the adoption of your new community engagement tools.

For example, initial engagement may include a large portion of your Members as they dive into new technology offerings. However, most sharing communities, without consistent and effective activity from the community moderators to maintain interactions, will likely see their Members limit their overall daily interactions. Communities with a solid and persistent engagement strategy and focus on driving consumption of key content directly from the platform will see a higher level of long-term adoption in their communities.

With this in mind, it is important to define what success means to your community. A few key items to consider include the following:

Daily active users compared to total registered users.
Consumption of information by Members, are they utilizing what the community is producing? (Many Members may focus exclusively on the consumption of information only.)
Member creation of useful information.
Total number of Members actively consuming information in an automated manner.
Total number of Members sharing information in an automated manner, as well as the quality of the data.
Depending on your community’s goals and your Members’ overall capabilities, it is important to remember that every community is different, and some values may be more indicative of success than others. Some communities can effectively drive the adoption of a portal with heavy human interactions, while some might be more focused on producing key content for consumption by their communities.

CSAP allows you to track all metrics related to the above-listed items from a user-friendly dashboard. Community organizers can perform quick analysis and generate reports to make the overall information sharing process as effective as possible.

Define Your Governance

One of the important steps to perform for starting any information sharing community is to define the vision, mission, and purpose in order to keep information-sharing efforts in the right direction and enable member organizations to derive the best possible outcomes. In addition, information sharing communities must have well-defined objectives regarding the information they want to share with Members, as well as ensure that the information shared with the member is consistent and relevant.

To solve these challenges, CSAP allows member organizations to be categorized into different Recipient Groups that are useful while sharing information. Custom Recipient Groups for Threat Intel Teams, Executives, CISOs, Crisis Response Teams, and others can also be created based on niche requirements. Additionally, Members can be categorized based on organizations, locations, and sectors.
CSAP provides alerts categories that enable information sharing community analysts to include relevant information in every threat alert shared with Members.

Real-Time Alerting

Analysts must share processed information, without duplicates, and information that enables decision makers to respond to an incident. This may require real-time telemetry of exploited vulnerabilities, active threats, and attacks. It may also contain information about the targets of attacks.

CSAP allows sharing of real-time situational awareness alerts on the latest incidents, breaches, malware, vulnerabilities, and threat methods to Members. Alerts can be scheduled to be published at a particular time to ensure timely information sharing. CSAP allows ISACs to create an enhanced security parameter by creating trusted sharing communities with Members, vendors, clients, suppliers, distributors, and other third-party organizations. They can then share daily cyber threat briefs, notifications about new threats, phishing attacks, and incidents in real time over the web, email, and mobile.

The ISAC security analyst team can alert all Members, or a limited group of members in a state or a country, by sending targeted emergency alerts using the Crisis Notifications feature during cyber or physical emergencies. This also helps gauge the magnitude of the crisis based on the Members' responses.
CSAP Analyst Portal users with an Analyst role can use Threat Levels to indicate the level of ongoing malicious cyber activity, along with the requisite preparedness measures that must be undertaken against them. Security teams can modify or update Threat Levels based on parameters that they consider to be essential, such as likely damage due to threat, preventive measures in place, risk level, and criticality of the threat.
Threat Assessments are used to quickly get a pulse of how many Members are impacted by a vulnerability, malware, or threat. CSAP allows Analysts to include Threat Assessment questions in alerts that are shared with Members. Security teams can also view the consolidated responses provided by Members to assess the company or sector-wide impact, providing quick and timely feedback to the originator of the alert.

Organize the Information You Want to Share

Information being shared can relate to cyber threats, vulnerabilities, incidents, physical threats, mitigation measures, situational awareness, strategic analyses, best practices, and more.

CSAP can be used to disseminate all kinds of security alerts, based on a defined set of categories. These categories can be created by an organization to meet its requirements. Some example categories include Intel Alert, Incident Alert, Informational, and Vulnerability Advisory. This aids the organized distribution of useful information to appropriate Members.
Members can also choose specific categories in the CSAP Member Portal to receive alerts they consider more relevant to their operations.
Additionally, Analysts can maintain consistency in shared information by automatically enabling fields to be included for a particular Category. This allows organizations to set up a sharing rule or policy for the information shared with the community and help standardize overall inputs for ease of use and startup.

Empower Members to Share Information

The success of every information sharing community is ultimately gauged by its threat intelligence sharing participation rate, which essentially means the number and frequency of information shared back by its Members. Enabling Members to easily and precisely share information helps improve the threat intelligence sharing participation rate. Additionally, providing mechanisms for feedback to the creators of the information enables a feedback loop that helps Members create more valuable inputs. If recipients perceive the received information as useful and are able to provide feedback, they will take a greater interest in sharing more information with the community. Guaranteeing member anonymity, as part of the flow, allows Members to share information without pause.

CSAP allows Members to adopt a threat intel-driven approach to submitting reports on intel, incidents, breaches, and security threats to ensure that the information sharing community is always aware of the threats targeting their organization.
CSAP also allows Members to share threat intel with indicators, such as IPs, URLs, Domains, and Hashes with the ISAC security team, and further share with relevant Members after validation. This facilitates the development of a potent defensive mechanism against threats targeting network organizations.
Members have the choice to anonymously share threat intel reports.
Sharing communities and Members thrive on the feedback provided regarding the shared information. Lack of feedback can result in two different scenarios: Members can either perceive it as a waste of time and stop sharing useful information or consistently share non-valuable information that keeps cluttering up overall information flows. With the help of CSAP, member organizations can provide consistent feedback on the relevancy and quality of the information shared.
CSAP also allows member organizations to designate some Members as Intel Approvers to review and publish actionable intelligence submitted by other Members. The ISAC security team can also review preferences and choose to validate the threat intel before sharing it with other Members.

Collaboration is the Key

The key focus of the sharing community is on strengthening collaboration by ensuring the correct way of exchanging information and fostering feedback. However, since every community has different needs, different capabilities, a community must have the ability to effectively pivot across collaboration assets while maintaining a central repository of all information.

CSAP fosters collaboration between Members in the following ways:

Members can directly share threat intel reports with other Members in the information sharing community to enable better collaboration and defense against relevant threats.
Work groups can be easily created, allowing for quick and focused responses to key events and concerns by leveraging Recipient Groups.
CSAP enables multiple methods for Members to provide feedback on content being shared, including relevancy and value of the content provided.
Threat Assessment enables security teams to quickly get a pulse of how many Members are impacted by a vulnerability, malware, or threat activity. CSAP allows all Members to share the outline of threat or intelligence by allowing them to collaborate by providing the required details easily from the alert content.
Requests for Information (RFI) can be generated by Members from the CSAP Member Portal and submitted to the information sharing community for various purposes, such as gathering information about subjects and staying informed about the assessment and steps taken by the security team to support and improve the overall security posture. RFIs also allows users to communicate with analysts using their standalone collaboration features.
CSAP allows security analysts to manage the information sharing community to classify information, before securely sharing with the Members, using Traffic Light Protocol (TLP) or customized alert classification methods.
Threat Levels allow communities to indicate the current level of malicious cyber activity. Security teams can determine and update threat levels based on various parameters, such as likely damage due to the threat, preventive measures that are in place, and other crucial data such as risk level and criticality of the threat.

Knowledge Sharing

The ability to capture and leverage the vast knowledge shared by information sharing community Members is one of the many reasons new organizations look to join collaborative environments. Document sharing and knowledge repositories pave the way for the continued success of sharing communities. Furthermore, Members tend to miss out on the vast knowledge that is already collected and shared by the community and current Members. The key information required for Members to react against crisis situations gets lost due to the lack of a proper mechanism for sharing, availing, and storing the documents and knowledge repositories. CSAP enables this historical and collaborative knowledge sharing through two major features:

The Knowledge Base allows the ISAC to upload an extensive set of documents such as policies, guidelines, and handbooks, and allows Members to access them easily from the web and mobile platforms.
The Doc Library allows the ISAC, as well as individual Members, to store important files where users can find and download them from the web and mobile platforms.

Follow the TLP Rule for Information Sharing

Trust building is one of the key aspects of an information sharing community, and Traffic Light Protocol (TLP) is the best way to encourage greater sharing of information with the right recipients. TLP provides a simple and intuitive schema for indicating when and how sensitive information can be shared, facilitating frequent and effective collaboration. This, in turn, facilitates the greater sharing of actionable information without delay and empowers Members to better defend networks and mitigate threats

CSAP allows Analysts to share information automatically with the right recipients based on TLP grouping. Analysts can also choose to show or hide information to the recipients based on the TLP selected for the information.
CSAP enables Members to share threat intelligence with other Members who have shared TLP clearance.
CSAP allows the addition of TLP to Knowledge Base documents to ensure that they are shared with the right recipients.
Analysts can also choose to limit the sharing of files and folders in the Document Library based on Recipient Groups and TLP.

General Documents

Search results