Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Security Teams Are Using Cyber Threat Intelligence Sharing
Transcript
- Lucas: Luna, I want to talk about something that sounds bureaucratic on the surface but is actually one of the most practical shifts in enterprise defense right now: structured threat intelligence sharing. Luna: You mean when organizations actually share data about what they're seeing — attacks, indicators, vulnerabilities — with each other? Lucas: Exactly. And it's not just a nice to do anymore. In the first quarter of this year, the health isac — that's the Information Sharing and Analysis Center for healthcare — coordinated a response to a critical vulnerability in a widely used medical device platform. Within 48 hours of the vulnerability being disclosed, member organizations had patches deployed or mitigations in place. Luna: Forty-eight hours is fast. Without that sharing structure, you'd be looking at weeks, maybe months, for every hospital to figure it out on their own. Lucas: Right. And that's the core argument. Threat intelligence sharing lets you benefit from what other organizations have already seen and analyzed. It turns one defender's incident into actionable intelligence for hundreds. Luna: But historically, companies have been reluctant to share. There's fear of exposing weaknesses, of giving competitors any kind of edge. How are teams getting past that? Lucas: A few things have changed. First, the legal framework. The Cybersecurity Information Sharing Act — CISA — provides liability protections when sharing cyber threat indicators with the government or through approved entities. That took away a lot of the legal risk. Luna: So you can share without worrying about getting sued for revealing something you shouldn't? Lucas: Basically. Second, the technical standards have matured. STIX and TAXII — Structured Threat Information Expression and Trusted Automated Exchange of Indicator Information — give everyone a common language and transport mechanism. You don't have to build custom integrations to share data with a dozen different partners. Luna: And there are platforms like MISP — the Malware Information Sharing Platform — that many organizations use internally and then connect to broader sharing communities. Lucas: MISP is huge in the open-source community. It's free, it's widely used, and it supports automated sharing. A security operations center can ingest a feed of indicators from an ISAC, cross-reference it with their own logs, and block threats without a human writing a single rule. Luna: That level of automation is where it really pays off. But I imagine there's still a trust issue — you're sharing with competitors, potentially. How do you handle anonymity? Lucas: Most sharing platforms allow pseudonymized or anonymized contributions. You can share the technical indicator — the IP address, the hash, the domain — without saying who you are or what was hit. The community benefits from the signal without the attribution. Luna: So it's not about sharing your incident report; it's about sharing the atomic pieces that let others defend. Lucas: Precisely. And some sectors have really embraced this. The financial services ISAC — fs isac — has been operating for over twenty years. They have a model where member banks share phishing URLs, malware samples, even attack patterns in near real time. During the 2025 distributed denial of service campaigns against several major US banks, fs isac members were able to update their filtering rules within minutes of the first attack. Luna: That's the kind of collective defense that a single organization can't achieve alone. And it's not just for the big players anymore, right? I've seen more regional ISACs popping up for mid-size companies. Lucas: Absolutely. There's a Retail and Hospitality ISAC, an Aviation ISAC, an Election Infrastructure ISAC. They're sector-specific, so the intelligence is relevant. Even a company with ten people in security can join, share, and consume intelligence tailored to their industry. Luna: And the benefit is cumulative. The more participants, the richer the data set. It's a network effect. Lucas: Yeah, and that's the argument for joining early. The quality of the intelligence improves as the community grows. Plus, many ISACs offer analysis and context — not just raw indicators. They'll tell you, 'This IP is associated with a ransomware group that targets healthcare, and here's the kill chain.' Luna: That context is what makes it actionable for a SOC analyst who might otherwise ignore an alert. Lucas: Look, this is exactly why we do these shows — to get into the practical stuff that actually moves the needle for defenders. And because we believe that kind of practical knowledge should be freely available, we keep the podcast ad-free. If you find value in these conversations and want to support that choice, you can at buy me a coffee dot com slash fexingo. It's a small way to keep the show focused on what works, not on selling something. Luna: Totally. And it keeps us independent, so we can dig into these topics without worrying about sponsors. Lucas: So back to threat intelligence sharing — one of the challenges I see is that teams sometimes think sharing means revealing everything. But it doesn't. You can start small: subscribe to an ISAC feed, set up MISP, and just consume. Then, as you build confidence, you start contributing indicators. Luna: Is there a risk of intelligence overload? If you're consuming feeds from multiple sources, you might get too much noise. Lucas: It's a real problem. That's why many organizations use a threat intelligence platform — TIP — to aggregate, deduplicate, and score the feeds. They apply a risk score based on relevance, freshness, and source reputation. Then only high-confidence indicators get pushed to the firewall or SIEM. Luna: So the human still needs to make decisions about what to share and what to trust. The platform helps with the volume. Lucas: Exactly. And the best sharing communities also have a feedback loop. If you share an indicator and another member confirms it's malicious, that confidence score goes up. If it turns out to be a false positive, the community can mark it and everyone benefits. Luna: That collective validation is powerful. It's like a distributed fact-check for threat data. Lucas: Yeah. And it's become essential as attacks get more targeted. Ransomware groups often use unique infrastructure for each victim, so traditional signature-based detection doesn't work. But if one organization sees a new technique — say, a novel way to deploy Cobalt Strike — and shares that behavioral indicator, others can detect it before they get hit. Luna: So it's less about sharing specific hashes and more about sharing tactics, techniques, and procedures — the TTPs. Lucas: Right. And that's where frameworks like MITRE ATT&CK come in. They provide a common taxonomy. Instead of saying 'they used PowerShell to download a payload,' you say 'T1059.001 — Command and Scripting Interpreter: PowerShell.' Everyone knows exactly what you mean. Luna: That consistency makes the intelligence machine-readable and automatable. You can write detection rules that map directly to MITRE techniques. Lucas: And that's what we're seeing in mature SOCs. They're not just collecting alerts — they're mapping every detection to the MITRE framework, and then correlating that with shared intelligence to identify patterns across their sector. Luna: It's a shift from reactive defense to proactive intelligence-driven security. I think that's the direction the industry is heading. Lucas: Absolutely. And for organizations that haven't started yet, the first step is simple: identify the ISAC for your industry, or if there isn't one, look into joining a cross-sector sharing group. Start by consuming, then contribute one indicator a week. You'll be surprised how quickly the value compounds. Luna: And in the meantime, the attackers are sharing information on dark web forums — so defenders need to collaborate just as effectively. Lucas: That's the reality. The good news is the infrastructure is there. It's just a matter of participating.