Trusted  Cooperative  Exchange  System  for  Security  Vulnerabilities  and  Exposures

João Daniel Jorge Machado

Key information

Authors:

João Daniel Jorge Machado (João Daniel Jorge Machado)

Supervisors:

Miguel Filipe Leitão Pardal (Miguel Filipe Leitão Pardal)

Published in

4 de junho de 2018

Abstract

Since the security knowledge of each company is only a fraction of the knowledge of the whole network, defenders can try to improve their stance by sharing information with other companies. There are already standard ways of representing cyber threat information, vulnerabilities (CVE), cyber observables, malware attributes, among others. There are also transport mechanisms for these kinds of information, and scoring models (CVSS) that help to quantify the severity of the vulnerabilities that are found. Recently, the MISP platform, designed for sharing, storing and correlating information about attacks on specific vulnerabilities, has been made available as open source, providing a development testbed for increased security information sharing. The main objective of this work was to design and implement mechanisms that augment MISP for automated data exchange the platform was extended with anonymization techniques to preserve the confidentiality of the asset information, of its owner and of the environment where the information was collected, while still providing ways to match security information producers with consumers. In this way, there is an added incentive for data sharing because data will be under the control of its owner. Our solution integrates the network vulnerability scanner OpenVAS with the MISP platform. The configurable solution automatically issues OpenVAS scans, extracts results from the reports generated, anonimizes the obtained results and imports them into the MISP platform. The solution was evaluated with a synthetic testbed and with another testbed provided by an air navigation service provider.