今天继续关于威胁情报的专题。威胁情报的理念，目前在国外已广为接受，最近美国也已将网络威胁情报信息共享视作提升其联邦政府信息系统安全的必要手段之一，并且发布了NIST SP 800-150 网路威胁信息共享指南草稿。
NIST SP 800-150 是 NIST SP 800-61 计算机安全事件响应指南的扩充，将信息共享、协调、协同扩展至事件响应的全生命期中。
本文对其主要部分进行摘录，更多内容可参照NIST发布的文档。
事件协同和信息共享的全生命期包括：
- Creation or Collection
- Processing
- Dissemination
- Use
- Storage
- Disposition
信息共享和协同的收益包括：
- Shared Situational Awareness
- Enhanced Threat Understanding.
- Knowledge Maturation
- Greater Defensive Agility
- Improved Decision Making
- Efficient Handling of Information Requests
- Rapid Notifications
协同和共享的挑战主要是：
- Legal and Organizational Restrictions
- Risk of Disclosure
- Preserving Privacy
- Producing Information
- Consuming Information
- Interoperability
- Classification of Information
- Establishing Trust
其认为的网络攻击生命期包括：
Phase 1—Reconnaissance
Phase 2—Weaponize
Phase 3—Deliver
Phase 4—Exploit
Phase 5—Install
Phase 6—Command and Control
Phase 7—Act on Objectives
威胁情报应具备的特征包括：
- Timely
- Relevant
- Accurate
- Specific
- Actionable
信息共享的架构包括集中式和P2P式：
其规划的美国国家联邦政府星型分层级的事件报告机制如下图：
其规划的美国国家信息共享和分析中心ISAC星型事件报告模型如下图：
美国国家信息共享流程如下图：
- Establish core cybersecurity capabilities
- Establish and participate in sharing and coordination relationships
- Consume basic threat intelligence from external sources
- Create basic threat intelligence
- Use basic threat intelligence to support decision-making processes
- Share basic threat intelligence with external partners
- Develop and deploy advanced cybersecurity capabilities
- Consume advanced threat intelligence from external sources
- Create advanced threat intelligence
- Use advanced threat intelligence to support decision-making processes
- Share advanced threat intelligence with external partners
事件协同和信息共享组织应具备基础架构能力包括：
- Organizational Structure for Incident Coordination
- Asset, Vulnerability and Configuration Management
- Log and Alert Collection
- Log and Alert Search and Retrieval
- Response Tools
组织应具有的核心网络安全能力包括：
- Deploy, configure, monitor, and update sensors
- Manage log data
- Document, prioritize, and manage incidents
- Perform basic network traffic forensics
- Coordinate with system/information owners
部分可进阶具备的高级网络安全能力包括：
- Conduct “deep dive” digital forensics analysis of a compromise
- Actively collect, produce, use, and share threat intelligence
- Develop threat intelligence that reveals an adversary’s TTPs, behaviors, and motives
- Use knowledge management practices to enrich data, mature knowledge, and inform cybersecurity decision-making
信息共享的能力包括：
- Coordinate the exchange of threat intelligence
- Appropriately handle sensitive or classified information
- Normalize or transform information
- Ingest information from external threat intelligence sources
- Produce and publish threat intelligence
- Acquire actionable threat intelligence
事件响应全生命期：
用来共享的信息，可以是结构化数据、可机读数据（XML，CSV，JSON），也可以是未预先定义格式的非结构化数据。
典型的共享的信息内容包括以下类型：
- IP addresses and domain names
- URLs involved with attacks
- Simple Mail Transport Protocol (SMTP) headers, email addresses, subject lines, and contents of emails used in phishing attacks
- Malware samples and artifacts
- Adversary Tactics, Techniques, and Procedures (and effectiveness)
- Response and mitigation strategies
- Exploit code
- Intrusion signatures or patterns
- Packet captures of attack traffic
- NetFlow data
- Malware analysis reports
- Campaign/actor analyses
- Disk and memory images
其也提到了，在信息共享的时候必须建立起规则，其首要需要注意的就是共享信息中的隐私问题：
信息的敏感性也至关重要，需要遵从谅解备忘录MOUs、保密协议NDAs或其他协议框架，同时也需要遵从PII、SOX、PCI DSS、HIPPA、FISMA、GLBA等法律法规。
同时也必须对交换的信息进行标识，约定其使用范围，典型标示包括：
- For Official Use Only
- Distribution limited to first responders
- Investigation underway, do not perform queries or active reconnaissance against these indicators
其他更多内容，请参见原文。
大辽已经准备好了，大宋你呢^_^
更多内容，除网站外可关注微信公众号 NUKE404
我靠，你太懒了。关键措施等等英语都不翻译一下。
不错，多谢共享和分析摘取！