Beyond Free Riding: Quality of Indicators for Assessing Participation in Information Sharing for Threat Intelligence

Understand

Threat intelligence sharing has become a growing concept, whereby entities can exchange patterns of threats with each other, in the form of indicators, to a community of trust for threat analysis and incident response.

• However, sharing threat-related information have posed various risks to an organization that pertains to its security, privacy, and competitiveness.
• Given the coinciding benefits and risks of threat information sharing, some entities have adopted an elusive behavior of "free-riding" so that they can acquire the benefits of sharing without contributing much to the community.
• So far, understanding the effectiveness of sharing has been viewed from the perspective of the amount of information exchanged as opposed to its quality.