Threat intelligence platform for the energy sector. (29th May 2019)

• Record Type: Journal Article
• Authors: Leszczyna, Rafał; Wróbel, Michał R.
• Is Part Of: Software, practice & experience. Volume 49:Number 8(2019)
• Page Start: 1225
• Page End: 1254
• Publication Date: 2019-05-29
• Subjects: critical infrastructures -- cybersecurity -- information sharing -- ISAC -- power systems -- situation awareness -- testing -- threat intelligence; Computer software -- Periodicals; Computer programming -- Periodicals; Computer programs -- Periodicals; 005.3
• DOI: 10.1002/spe.2705
• Languages: English
• ISSNs: 0038-0644

Abstract

Summary: In recent years, critical infrastructures and power systems in particular have been subjected to sophisticated cyberthreats, including targeted attacks and advanced persistent threats. A promising response to this challenging situation is building up enhanced threat intelligence (TI) that interlinks information sharing and fine‐grained situation awareness. In this paper, a framework that integrates all levels of TI, ie, strategic, tactical, operational, and technical, is presented. The platform implements the centralized model of information exchange with peer‐to‐peer interactions between partners as an option. Several supportive solutions were introduced, including anonymity mechanisms or data processing and correlation algorithms. A data model that enables communication of cyberincident information, both in natural language and machine‐readable formats, was defined. Similarly, security requirements for critical components were devised. A pilot implementation of the platform was developed and deployed in the operational environment, which enabled practical evaluation of the design. Also, the security of the anonymity architecture was analyzed.