3 ms·

Secrecy mostly because it's live intel -- these aren't your run of the mill hackers, they'll adapt. If you publish your intel each month publicly, they'll just

Secrecy mostly because it's live intel -- these aren't your run of the mill hackers, they'll adapt. If you publish your intel each month publicly, they'll just make sure to run your intel against their latest malware and make sure you can't detect them. Indemnity I'm not fully versed on (I'm just a dev, and this is more of a law area), but I get the idea that they want to be able to say, "Block these domains, and watch out for these email addresses -- they're spear phishing addresses" without getting in trouble for sharing those email addresses in the first place. After all, if we're hunting for hackers, and the hackers end up being users of your website, do the hackers suddenly get immunity from being detected? If I see "l33th4x0r12345" as a user on my system, and I know that user just tried a bunch of XSS on my support staff, I'm going to want to let other groups know that "l33th4x0r12345" is a bad actor.

unethical_ban 12y ago
But this is already being done. Look at FS-ISAC - a private email list that shares IOC and spam data between banks and financial institutions. What needs to change in the law that isn't currently allowed?
- diminoten 12y ago
  This is a valid question, and honestly I'm not sure. Once you're asking this question though, you've gotten past the point I think a lot of folks are hung up on, and that's the content of the intel. I'd just like to get folks to a point where they're understanding that their mother's maiden name isn't getting blasted through the cybersecurity world.
- snowwrestler 12y ago
  How many businesses have access to that list or even know it exists? Every single business in the U.S. needs to get smarter about online security, and a big part of that is getting useful information about modern lines of attack. A few private arrangements are not going to do the job.

unethical_ban 12y ago

But this is already being done. Look at FS-ISAC - a private email list that shares IOC and spam data between banks and financial institutions. What needs to change in the law that isn't currently allowed?

diminoten 12y ago
This is a valid question, and honestly I'm not sure. Once you're asking this question though, you've gotten past the point I think a lot of folks are hung up on, and that's the content of the intel. I'd just like to get folks to a point where they're understanding that their mother's maiden name isn't getting blasted through the cybersecurity world.
snowwrestler 12y ago
How many businesses have access to that list or even know it exists? Every single business in the U.S. needs to get smarter about online security, and a big part of that is getting useful information about modern lines of attack. A few private arrangements are not going to do the job.