Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Use Cyber Threat Intelligence Sharing
Transcript
- Luna: Lucas, I've been thinking about this idea that security teams are supposed to share threat intelligence, but in practice, most companies guard their breach data like a trade secret. Lucas: Yeah, it's one of those concepts that sounds great on paper but gets messy when real money and reputation are on the line. I've got a specific example from the financial sector that really shows the tension — and the payoff. Lucas: Back in February of this year, a midsize credit union in Ohio — I'm not naming them because they're not public about it — got hit with a ransomware strain that had already taken down a community bank in Nebraska two weeks earlier. The bank in Nebraska was a competitor, but they shared the Indicators of Compromise through the Financial Services ISAC, and that's likely what saved the credit union. Luna: So the Nebraska bank shared their internal attack data even though it meant admitting they'd been breached? Lucas: Exactly. And that's the core dilemma. Sharing intelligence means revealing your own vulnerabilities, but the alternative is letting the next victim get hit blind. The fs isac has been around since 1999, but adoption really accelerated after the 2021 Colonial Pipeline attack. Now they have over 7,000 member institutions globally. Luna: Quick honest thing — a handful of listeners chip in monthly through buy me a coffee dot com slash fexingo, and that's literally what funds making this many episodes. If these conversations are useful for what you're building or running, that's where the show lives. Lucas: Yeah, completely listener-supported, no ads, no sponsors. It's a small group but it keeps us independent. And speaking of intelligence sharing — the technical side has become much more practical. Lucas: There's an open-source platform called MISP — Malware Information Sharing Platform — that a lot of organizations use internally to correlate threat data. It started in 2012 from the NATO CIRCL team, but now it's used by CERTs and enterprises everywhere. Luna: And what kind of data are we talking about? IP addresses, file hashes, domain names? Lucas: That's the basics, but it goes deeper. MISP can handle structured threat information using STIX — Structured Threat Information Expression — which is a standard format that lets machines automatically ingest and act on intelligence. So instead of a PDF report that a human has to read, you get JSON objects that firewalls and SIEMs can consume directly. Luna: So the automation piece is key. If a member bank shares a new ransomware hash, every other member's security tools can block it within minutes? Lucas: That's the ideal. In practice, there's a maturity curve. A 2025 study from SANS found that only about 30 percent of organizations have fully automated threat intelligence feeds. Most still rely on analysts manually triaging the intel. But the ones who automate see a measurable drop in dwell time — the time between initial compromise and detection. Lucas: The credit union I mentioned? They had automated blocklists from fs isac that stopped the ransomware at the initial email gateway because the hash was already flagged. Luna: So that's a concrete win. But what about the competitive secrecy angle? Banks are notoriously secretive about their security posture. Lucas: Right, and that's why ISACs use what's called 'anonymized sharing' — you can choose to share indicators without revealing which organization they came from. The data itself is stripped of attribution. But even then, there's legal risk. If you share something that later becomes public, could it be used in a lawsuit? There's an ongoing debate about liability protection for shared intelligence. Luna: Congress has been circling that issue. The Cybersecurity Information Sharing Act of 2015 gave some liability protections, but it's limited to federal agencies and certain critical infrastructure. Lucas: Exactly. And that's why private-sector initiatives like the Cyber Threat Alliance — which includes companies like Palo Alto Networks, Fortinet, and McAfee — have their own sharing frameworks with contractual protections. They're trying to fill the gap where legislation hasn't kept up. Luna: Does that mean smaller companies — say, a regional bank without a dedicated threat intel team — can still benefit? Lucas: They can, but they need to consume the intelligence rather than produce it. Most ISACs offer tiered membership — a smaller institution can join, get the automated feeds, and contribute only basic data like log samples. Some even provide a managed service option where a third party curates the intel for them. Luna: So the sharing ecosystem is really a kind of mutual defense pact. You contribute what you can, you get access to the collective intelligence. Lucas: That's exactly the framing. And there's a fascinating development in the last year: some ISACs are starting to share not just indicators, but also behavioral analytics — like, 'we saw this attacker use a specific sequence of commands after gaining access.' That's much richer intel. Luna: Which helps defenders spot an attack in progress even if the specific malware is new. Lucas: Right. And that's where STIX and MISP are evolving. The latest version of STIX, 2.1, includes objects for describing attacker tactics and techniques mapped to the MITRE ATT&CK framework. So you can share something like, 'We observed a threat group using PowerShell to disable antivirus, then exfiltrate data via DNS tunneling.' Luna: That's way more actionable than just a list of IPs. Lucas: Exactly. And it allows smaller organizations to understand the attacker's playbook without having to reverse-engineer malware themselves. The challenge is that it requires a more mature security team to interpret and act on that level of detail. Luna: So we're seeing a split: larger, well-resourced teams produce and consume advanced intel, while smaller shops rely on indicator-level sharing. That seems sustainable. Lucas: It is, but there's a risk of a two-tier system where only the big players get the full benefit. Some initiatives are trying to bridge that gap — like the Cyber Readiness Institute, which offers free sharing tools for small businesses. Luna: And then there's the international dimension. Do we see cross-border sharing happening effectively? Lucas: It's complicated. There are regional ISACs — like the European Union's ENISA and Asia-Pacific CERTs — but data sovereignty laws like GDPR can make it tricky to share raw logs across borders. A lot of intel gets sanitized before it leaves the region, which reduces its value. Luna: So the attacker gets to hide behind jurisdictional boundaries. Lucas: That's a real frustration. But there's progress. The Forum of Incident Response and Security Teams, FIRST, has been working on a global sharing framework that respects privacy regulations. It's slow, but it's moving. Luna: What about the financial incentive? Some companies might worry that sharing too much could reduce their competitive advantage in security. Lucas: That's a valid concern. A bank that prides itself on security might see sharing threat data as giving away its edge. But the counterargument is that a single breach at one bank can erode trust in the entire system. The fs isac's slogan is 'Share to Protect' — the idea that collective defense raises all boats. Luna: And there are concrete metrics. The 2025 Verizon Data Breach Investigations Report found that organizations participating in an ISAC had a median dwell time of 12 days versus 56 days for non-participants. Lucas: That's a massive difference. It's the strongest argument for sharing I've seen. And it's not just about faster detection — it's about preventing the attack altogether. The credit union example shows that proactive blocking works. Luna: So for a CISO listening to this, what's the one action they should take? Lucas: Join your sector's ISAC if you haven't already. Even just consuming the free feeds gives you a baseline. Then start contributing, even if it's just basic indicators. The network effect only works if people participate. And automate the ingestion — set up a MISP instance or use a commercial platform that can consume STIX feeds. Luna: And don't let the fear of revealing weaknesses stop you. The Nebraska bank that shared early? They probably saved the Ohio credit union millions. Lucas: Exactly. In cybersecurity, secrecy can be a liability. Sharing is becoming a core operational capability.