5 - Knowledge Sharing and Community Support

Abstract

Threat modeling is an effective tool used to understand the threat landscape within an enterprise network. However, using data generated from within the enterprise network only allows for a partial view of the threat landscape as well as the threats potentially targeting it or the security breaches that may have already occurred. To overcome this, threat modeling, as well as threat forecasting, should be performed using knowledge elements available within community-driven threat intelligence feeds. Enterprise adoption of community sharing may initially be met with hesitation because, as is the case with most community-driven projects, sharing knowledge elements may be considered insecure and potentially a bigger risk than the advantages it could provide. To help focus on the indicator of interest or indicator of compromise (i.e., the knowledge element), most community-sharing options have been designed to only express the data needed to understand the threat.