user studies; user experience; usability; cyber threat intelligence; information sharing; sharing platforms
Résumé :
[en] The ever-increasing scale and complexity of cyber attacks and cyber-criminal activities necessitate secure and effective sharing of cyber threat intelligence (CTI) among a diverse set of stakeholders and communities. CTI sharing platforms are becoming indispensable tools for cooperative and collaborative cybersecurity. Nevertheless, despite the growing research in this area, the emphasis is often placed on the technical aspects, incentives, or implications associated with CTI sharing, as opposed to investigating challenges encountered by users of such platforms. To date, user experience (UX) aspects remain largely unexplored.
This paper offers a unique contribution towards understanding the constraining and enabling factors of security information sharing within one of the leading platforms. MISP is an open source CTI sharing platform used by more than 6,000 organizations worldwide. As a technically-advanced CTI sharing platform it aims to cater for a diverse set of security information workers with distinct needs and objectives. In this respect, MISP has to pay an equal amount of attention to the UX in order to maximize and optimize the quantity and quality of threat information that is contributed and consumed.
Using mixed methods we shed light on the strengths and weaknesses of MISP from an end-users’ perspective and discuss the role UX could play in effective CTI sharing. We conclude with an outline of future work and open challenges worth further exploring in this nascent, yet highly important socio-technical context.
Centre de recherche :
- Interdisciplinary Centre for Security, Reliability and Trust (SnT) > Other
Disciplines :
Sciences informatiques
Auteur, co-auteur :
STOJKOVSKI, Borce ; University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > IRiSC
LENZINI, Gabriele ; University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > IRiSC
KOENIG, Vincent ; University of Luxembourg > Faculty of Humanities, Education and Social Sciences (FHSE) > Department of Behavioural and Cognitive Sciences (DBCS)
RIVAS, Salvador ; University of Luxembourg > Faculty of Humanities, Education and Social Sciences (FHSE) > LUCET
Co-auteurs externes :
no
Langue du document :
Anglais
Titre :
What's in a Cyber Threat Intelligence sharing platform?: A mixed-methods user experience investigation of MISP
2021. Executive Order No. 14,028 of May 12, 2021, 86 FR 26633., 26633-26647 pages. https://www.federalregister.gov/executive-order/14028
Mark S. Ackerman. 2000. The Intellectual Challenge of CSCW: The Gap between Social Requirements and Technical Feasibility. Hum.-Comput. Interact. 15, 2 (Sept. 2000), 179-203. https://doi.org/10.1207/S15327051HCI1523_5
Alessandro Acquisti, Idris Adjerid, Rebecca Balebako, Laura Brandimarte, Lorrie Faith Cranor, Saranga Komanduri, Pedro Giovanni Leon, Norman Sadeh, Florian Schaub, Manya Sleeper, Yang Wang, and Shomir Wilson. 2017. Nudges for Privacy and Security: Understanding and Assisting Users' Choices Online. ACM Comput. Surv. 50, 3, Article 44 (Aug. 2017), 41 pages. https://doi.org/10.1145/3054926
Enoch Agyepong, Yulia Cherdantseva, Philipp Reinecke, and Pete Burnap. 2020. Challenges and performance metrics for security operations center analysts: a systematic review. Journal of Cyber Security Technology 4, 3 (July 2020), 125-152. https://doi.org/10.1080/23742917.2019.1698178
Jan M. Ahrend, Marina Jirotka, and Kevin Jones. 2016. On the collaborative practices of cyber threat intelligence analysts to develop and utilize tacit Threat and Defence Knowledge. 2016 International Conference on Cyber Situational Awareness, Data Analytics and Assessment, CyberSA 2016 (2016). https://doi.org/10.1109/CyberSA.2016.7503279
Sean Barnum. 2012. Standardizing cyber threat intelligence information with the structured threat information expression (stix). Mitre Corporation 11 (2012), 1-22.
Sara Bauer, Daniel Fischer, Clemens Sauerwein, Simon Latzel, Dirk Stelzer, and Ruth Breu. 2020. Towards an Evaluation Framework for Threat Intelligence Sharing Platforms. In 53rd Hawaii International Conference on System Sciences, HICSS 2020, Maui, Hawaii, USA, January 7-10, 2020. ScholarSpace, 1-10. http://hdl.handle.net/10125/63978
Jaspreet Bhatia, Travis D. Breaux, Liora Friedberg, Hanan Hibshi, and Daniel Smullen. 2016. Privacy risk in cybersecurity data sharing. WISCS 2016 - Proceedings of the 2016 ACM Workshop on Information Sharing and Collaborative Security, co-located with CCS 2016 (2016), 57-64. https://doi.org/10.1145/2994539.2994541
David Botta, Kasia Muldner, Kirstie Hawkey, and Konstantin Beznosov. 2011. Toward understanding distributed cognition in IT security management: The role of cues and norms. Cognition, Technology and Work 13, 2 (2011), 121-134. https://doi.org/10.1007/s10111-010-0159-y
David Botta, Rodrigo Werlinger, André Gagné, Konstantin Beznosov, Lee Iverson, Sidney Fels, and Brian Fisher. 2007. Towards understanding IT security professionals and their tools. ACM International Conference Proceeding Series 229 (2007), 100-111. https://doi.org/10.1145/1280680.1280693
Sathya Chandran, Xinming Ou, Alexandru G. Bardas, Jacob Case, Michael Wesch, John McHugh, and S. Raj Rajagopalan. 2019. A human capital model for mitigating security analyst burnout. SOUPS 2015 - Proceedings of the 11th Symposium on Usable Privacy and Security (2019), 347-359.
CIRCL. 2021. CIRCL - Computer Incident Response Center Luxembourg. Retrieved September 15, 2021 from https://www.circl.lu
CIRCL. 2021. MISP - Malware Information Sharing Platform and Threat Sharing - Training Materials. Retrieved September 15, 2021 from https://www.circl.lu/services/misp-training-materials/
CISA. 2020. Alert (AA20-352A) Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations. https://us-cert.cisa.gov/ncas/alerts/aa20-352a.
CISA. 2021. Alert (AA21-131A) DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks. Retrieved September 15, 2021 from https://us-cert.cisa.gov/ncas/alerts/aa21-131a
Dave Clemente. 2013. Cybersecurity. In Routledge Companion to Intelligence Studies. Routledge. https://doi.org/10.4324/9780203762721.ch26
Lorrie Cranor and Simson Garfinkel. 2005. Security and Usability: Designing Secure Systems that People Can Use. O'Reilly Media, Inc.
Alessandra de Melo e Silva, João José Costa Gondim, Robson de Oliveira Albuquerque, and Luis Javier García Villalba. 2020. A methodology to evaluate standards and platforms within cyber threat intelligence. Future Internet 12, 6 (2020), 1-23. https://doi.org/10.3390/fi12060108
Ignacio Díaz-Oreiro, Gustavo López, Luis Quesada, and Luis A. Guerrero. 2019. Standardized Questionnaires for User Experience Evaluation: A Systematic Literature Review. Proceedings 31, 1 (2019). https://doi.org/10.3390/proceedings2019031014
Josiah Dykstra and Celeste Lyn Paul. 2018. Cyber Operations Stress Survey (COSS): Studying fatigue, frustration, and cognitive workload in cybersecurity operations. 11th USENIX Workshop on Cyber Security Experimentation and Test, CSET 2018, co-located with USENIX Security 2018 (2018).
ENISA. 2010. Incentives and Challenges for Information Sharing in the Context of Network and Information Security. Technical Report. European Union Agency for Network and Information Security, Heraklion.
ENISA. 2013. Detect, SHARE, Protect: Solutions for Improving Threat Data Exchange among CERTs. Technical Report. European Union Agency for Network and Information Security, Heraklion.
ENISA. 2015. Cyber Security Information Sharing: An Overview of Regulatory and Non-regulatory Approaches (ISBN 978-92-9204-131-1). Technical Report December. European Union Agency for Network and Information Security, Heraklion. 1-64 pages.
Thomas Erickson, David N. Smith, Wendy A. Kellogg, Mark Laff, John T. Richards, and Erin Bradner. 1999. Socially Translucent Systems: Social Proxies, Persistent Conversation, and the Design of “Babble”. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (Pittsburgh, Pennsylvania, USA) (CHI'99). Association for Computing Machinery, New York, NY, USA, 72-79. https://doi.org/10.1145/302979.302997
Europol. 2020. Internet Organised Crime Threat Assessment (IOCTA) 2020. Technical Report. European Union Agency for Law Enforcement Cooperation. 64 pages.
Gina Fisk, Calvin Ardi, Neale Pickett, John Heidemann, Mike Fisk, and Christos Papadopoulos. 2015. Privacy principles for sharing cyber security data. Proceedings - 2015 IEEE Security and Privacy Workshops, SPW 2015 (2015), 193-197. https://doi.org/10.1109/SPW.2015.23
Steven Furnell, Pete Fischer, and Amanda Finch. 2017. Can't get the staff? The growing need for cyber-security skills. Computer Fraud & Security 2017, 2 (2017), 5-10. https://doi.org/10.1016/S1361-3723(17)30013-1
Esther Gal-Or and Anindya Chose. 2005. The economic incentives for sharing security information. Information Systems Research 16, 2 (2005), 186-208. https://doi.org/10.1287/isre.1050.0053
GitHub. 2021. GitHub - MISP/MISP/MISP (core software) - Open Source Threat Intelligence and Sharing Platform. Retrieved September 15, 2021 from https://github.com/MISP/MISP
Lawrence Gordon, Martin Loeb, and William Lucyshyn. 2003. Sharing information on computer systems security: An economic analysis. Journal of Accounting and Public Policy 22, 6 (2003), 461-485.
Eric T. Greenlee, Gregory J. Funke, Joel S. Warm, Ben D. Sawyer, Victor S. Finomore, Vince F. Mancuso, Matthew E. Funke, and Gerald Matthews. 2016. Stress and workload profiles of network analysis: Not all tasks are created equal. Advances in Intelligent Systems and Computing 501 (2016), 153-166. https://doi.org/10.1007/978-3-319-41932-9_13
Marc Hassenzahl, Sarah Diefenbach, and Anja Göritz. 2010. Needs, affect, and interactive products - Facets of user experience. Interacting with Computers 22, 5 (September 2010), 353-362. https://doi.org/10.1016/j.intcom.2010.04.002
Marc Hassenzahl, Axel Platz, Michael Burmester, and Katrin Lehner. 2000. Hedonic and ergonomic quality aspects determine a software's appeal. Conference on Human Factors in Computing Systems - Proceedings 2, 1 (2000), 201-208. https://doi.org/10.1145/332040.332432
Martin Horák, Václav Stupka, and Martin Husák. 2019. GDPR compliance in cybersecurity software: A case study of DPIA in information sharing platform. ACM International Conference Proceeding Series (2019). https://doi.org/10.1145/3339252.3340516
Kasper Hornbæk. 2006. Current practice in measuring usability: Challenges to usability studies and research. International Journal of Human-Computer Studies 64, 2 (2006), 79-102. https://doi.org/10.1016/j.ijhcs.2005.06.002
E Hutchins. 1995. (1995b). How a cockpit remembers its speeds. Cognitive Science, 19, 265-288. (1995).
Christopher S. Johnson, Mark Lee Badger, David A. Waltermire, Julie Snyder, and Clem Skorupka. 2016. Guide to Cyber Threat Information Sharing. Technical Report NIST Special Publication (SP) 800-150, October, 2016. National Institute of Standards and Technology, Gaithersburg, MD. https://doi.org/10.6028/NIST.SP.800-150
Shinichi Kamiya, Jun-Koo Kang, Jungmin Kim, Andreas Milidonis, and René M Stulz. 2021. Risk management, firm reputation, and the impact of successful cyberattacks on target firms. Journal of Financial Economics 139, 3 (2021), 719-749. https://doi.org/10.1016/j.jfineco.2019.05.019
Mazaher Kianpour, Harald Øverby, Stewart James Kowalski, and Christopher Frantz. 2019. Social Preferences in Decision Making Under Cybersecurity Risks and Uncertainties. In HCI for Cybersecurity, Privacy and Trust, Abbas Moallem (Ed.). Springer International Publishing, Cham, 149-163.
Faris Bugra Kokulu, Yan Shoshitaishvili, Ananta Soneji, Ziming Zhao, Gail Joon Ahn, Tiffany Bao, and Adam Doupé. 2019. Matched and mismatched SOCs: A qualitative study on security operations center issues. Proceedings of the ACM Conference on Computer and Communications Security (2019), 1955-1970. https://doi.org/10.1145/3319535.3354239
Sari Kujala, Tanja Walsh, Piia Nurkka, and Marian Crisan. 2014. Sentence completion for understanding users and evaluating user experience. Interacting with Computers 26, 3 (2014), 238-255. https://doi.org/10.1093/iwc/iwt036
Mike Kuniavsky. 2007. User Experience and HCI. In The Human-Computer Interaction Handbook: Fundamentals, Evolving Technologies, and Emerging Applications (Human Factors and Ergonomics Series), Andrew Sears and Julie A. Jacko (Eds.). L. Erlbaum Associates Inc., USA, 897-916.
Carine Lallemand and Vincent Koenig. 2017. How Could an Intranet Be Like a Friend to Me? Why Standardized UX Scales Don't Always Fit. In Proceedings of the European Conference on Cognitive Ergonomics 2017 (Umeå, Sweden) (ECCE 2017). Association for Computing Machinery, New York, NY, USA, 9-16. https://doi.org/10.1145/3121283.3121288
Bettina Laugwitz, Theo Held, and Martin Schrepp. 2008. Construction and Evaluation of a User Experience Questionnaire. In HCI and Usability for Education and Work, Andreas Holzinger (Ed.). Springer Berlin Heidelberg, Berlin, Heidelberg, 63-76.
Jeff May. 2020. The Security Intelligence Handbook: How to disrupt adversaries and reduce risk with security intelligence. CyberEdge Group, LLC.
Florian Menges, Benedikt Putz, and Günther Pernul. 2020. DEALER: decentralized incentives for threat intelligence reporting and exchange. International Journal of Information Security (2020). https://doi.org/10.1007/s10207-020-00528-1
Alain Mermoud, Marcus Matthias Keupp, Kévin Huguenin, Maximilian Palmié, and Dimitri Percia David. 2019. To share or not to share: A behavioral perspective on human participation in security information sharing. Journal of Cybersecurity 5, 1 (2019), 1-13. https://doi.org/10.1093/cybsec/tyz006
MISP. 2021. COVID-19 MISP Information Sharing Community. Retrieved September 15, 2021 from https://www.misp-project.org/covid-19-misp/
MISP. 2021. MISP - Open Source Threat Intelligence Platform & Open Standards For Threat Information Sharing. Retrieved September 15, 2021 from https://www.misp-project.org/
Aziz Mohaisen, Omar Al-Ibrahim, Charles Kamhoua, Kevin Kwiat, and Laurent Njilla. 2017. Rethinking Information Sharing for Threat Intelligence. In Proceedings of the Fifth ACM/IEEE Work shop on Hot Topics in Web Systems and Technologies (San Jose, California) (HotWeb'17). Association for Computing Machinery, New York, NY, USA, Article 6, 7 pages. https://doi.org/10.1145/3132465.3132468
Sean Oesch, Robert Bridges, Jared Smith, Justin Beaver, John Goodall, Kelly Huffer, Craig Miles, and Dan Scofield. 2020. An Assessment of the Usability of Machine Learning Based Tools for the Security Operations Center. Proceedings - IEEE Congress on Cybermatics: 2020 IEEE International Conferences on Internet of Things, iThings 2020, IEEE Green Computing and Communications, GreenCom 2020, IEEE Cyber, Physical and Social Computing, CPSCom 2020 and IEEE Smart Data, SmartData 2020 (2020), 634-641. https://doi.org/10.1109/iThings-GreenComCPSCom-SmartData-Cybermatics50389.2020.00111
Celeste Lyn Paul. 2014. Human-centered study of a network operations center: Experience report and lessons learned. Proceedings of the ACM Conference on Computer and Communications Security 2014-November, November (2014), 39-42. https://doi.org/10.1145/2663887.2663899
Desmet Pieter and Hekkert Paul. 2007. Framework of Product Experience. International Journal of Design 1, 1 (2007), 57-66. http://www.ijdesign.org/ojs/index.php/IJDesign/article/viewFile/66/7
Andrew Ramsdale, Stavros Shiaeles, and Nicholas Kolokotronis. 2020. A comparative analysis of cyber-threat intelligence sources, formats and languages. Electronics (Switzerland) 9, 5 (2020). https://doi.org/10.3390/electronics9050824
Lena Reinfelder, Robert Landwirth, and Zinaida Benenson. 2019. Security managers are not the enemy either. Conference on Human Factors in Computing Systems - Proceedings (2019), 1-7. https://doi.org/10.1145/3290605.3300663
Richard M Ryan and Edward L Deci. 2000. Self-Determination Theory and the Facilitation of Intrinsic Motivation, Social Development, and Well-Being. The American psychologist 55, 1 (2000), 68-78.
Nader Sohrabi Safa and Rossouw Von Solms. 2016. An information security knowledge sharing model in organizations. Computers in Human Behavior 57 (2016), 442-451. https://doi.org/10.1016/j.chb.2015.12.037
Tomas Sander and Joshua Hailpern. 2015. UX Aspects of Threat Information Sharing Platforms: An Examination and Lessons Learned Using Personas. In Proceedings of the 2Nd ACM Workshop on Information Sharing and Collaborative Security (WISCS'15). ACM, New York, NY, USA, 51-59. https://doi.org/10.1145/2808128.2808136 http://doi.acm.org/10.1145/2808128.2808136.
Clemens Sauerwein, Christian Sillaber, Andrea Mussmann, and Ruth Breu. 2017. Threat intelligence sharing platforms: An exploratory study of software vendors and research perspectives. The 13th International Conference on Wirtschaftsinformatik (2017), 837-851.
Daniel Schlette, Fabian Böhm, Marco Caselli, and Günther Pernul. 2021. Measuring and visualizing cyber threat intelligence quality. International Journal of Information Security 20, 1 (2021), 21-38. https://doi.org/10.1007/s10207- 020- 00490- y
Martin Schrepp. 2019. User Experience Questionnaire Handbook (Version 8). Version 8 (31.12.2019).
Ari Schwartz, Sejal C Shah, Matthew H MacKenzie, Sheena Thomas, Tara Sugiyama Potashnik, and Bri Law. 2016. Automatic threat sharing: how companies can best ensure liability protection when sharing cyber threat information with other companies or organizations. U. Mich. JL Reform 50 (2016), 887.
Oscar Serrano, Luc Dandurand, and Sarah Brown. 2014. On the Design of a Cyber Security Data Sharing System. In Proceedings of the 2014 ACM Workshop on Information Sharing & Collaborative Security (Scottsdale, Arizona, USA) (WISCS'14). Association for Computing Machinery, New York, NY, USA, 61-69. https://doi.org/10.1145/2663876.2663882
Kennon M Sheldon, Andrew J Elliot, Youngmee Kim, and Tim Kasser. 2001. What Is Satisfying About Satisfying Events? Testing 10 Candidate Psychological Needs. Journal of personality and social psychology 80, 2 (2001), 325-339.
Florian Skopik, Giuseppe Settanni, and Roman Fiedler. 2017. The Importance of Information Sharing and Its Numerous Dimensions to Circumvent Incidents and Mitigate Cyber Threats. In Collaborative Cyber Threat Intelligence: Detecting and Responding to Advanced Cyber Attacks at the National Level, Florian Skopik (Ed.). Auerbach Publishers, Incorporated.
Jessica Staddon and Noelle Easterday. 2019.'It's a generally exhausting field' A Large-Scale Study of Security Incident Management Workflows and Pain Points. 2019 17th International Conference on Privacy, Security and Trust, PST 2019 - Proceedings (2019). https://doi.org/10.1109/PST47121.2019.8949012
Borce Stojkovski, Gabriele Lenzini, Vincent Koenig, and Salvador Rivas. 2021. What's in a Cyber Threat Intelligence sharing platform? - Appendix [Data set]. https://doi.org/10.5281/zenodo.5531990
Clare Sullivan and Eric Burger. 2017. “In the public interest”: The privacy implications of international business-to-business sharing of cyber-threat intelligence. Computer Law and Security Review 33, 1 (2017), 14-29. https://doi.org/10.1016/j.clsr.2016.11.015
Sathya Chandran Sundaramurthy, John McHugh, Xinming Ou, Michael Wesch, Alexandru G. Bardas, and S. Raj Rajagopalan. 2016. Turning Contradictions into Innovations or: How We Learned to Stop Whining and Improve Security Operations. (June 2016), 237-251. https://www.usenix.org/conference/soups2016/technical-sessions/presentation/sundaramurthy
Moin Syed and Sarah C. Nelson. 2015. Guidelines for Establishing Reliability When Coding Narrative Data. Emerging Adulthood 3, 6 (2015), 375-387. https://doi.org/10.1177/2167696815587648
Wiem Tounsi. 2019. What is Cyber Threat Intelligence and How is it Evolving? In Cyber-Vigilance and Digital Trust. John Wiley & Sons, Ltd, Chapter 1, 1-49. https://doi.org/10.1002/9781119618393.ch1arXiv:https://onlinelibrary.wiley.com/doi/pdf/10.1002/9781119618393.ch1
Wiem Tounsi and Helmi Rais. 2018. A survey on technical threat intelligence in the age of sophisticated cyber attacks. Computers and Security 72 (2018), 212-233. https://doi.org/10.1016/j.cose.2017.09.001
UEQ. 2021. User Experience Questionnaire. Retrieved September 15, 2021 from https://www.ueq-online.org/
Manfred Vielberth, Fabian Bohm, Ines Fichtinger, and Gunther Pernul. 2020. Security Operations Center: A Systematic Study and Open Challenges. IEEE Access (2020), 1-25. https://doi.org/10.1109/ACCESS.2020.3045514
Cynthia Wagner, Alexandre Dulaunoy, Gérard Wagener, and Andras Iklody. 2016. MISP: The Design and Implementation of a Collaborative Threat Intelligence Sharing Platform. Workshop on Information Sharing and Collaborative Security (WISCS) (2016), 49-56. https://doi.org/10.1145/2994539.2994542 http://dl.acm.org/citation.cfm?doid=2994539.2994542.
Thomas D. Wagner, Khaled Mahbub, Esther Palomar, and Ali E. Abdallah. 2019. Cyber threat intelligence sharing: Survey and research directions. Computers & Security 87 (2019), 101589. https://doi.org/10.1016/j.cose.2019.101589
James Igoe Walsh. 2013. Intelligence Sharing. In Routledge Companion to Intelligence Studies. Routledge. https://doi.org/10.4324/9780203762721.ch30
Rodrigo Werlinger, Kasia Muldner, Kirstie Hawkey, and Konstantin Beznosov. 2010. Preparation, detection, and analysis: The diagnostic work of IT security incident response. Information Management and Computer Security 18, 1 (2010), 26-42. https://doi.org/10.1108/09685221011035241
Ping Zhang and Na Li. 2005. The Importance of Affective Quality. Commun. ACM 48, 9 (Sept. 2005), 105-108. https://doi.org/10.1145/1081992.1081997
Adam Zibak and Andrew Simpson. 2019. Cyber threat information sharing: Perceived benefits and barriers. ACM International Conference Proceeding Series (2019). https://doi.org/10.1145/3339252.3340528
