Overcoming information-sharing challenges in cyber defence exercises

Abstract

Abstract Active usage of threat intelligence information supports effective prevention, mitigation and defence against cyberattacks by threat actors ranging from individual amateurs to state organizations. However, threat intelligence highly depends on security specialists’ ability to share incident data on threat information-sharing platforms. Unfortunately, business managers and educational institutions undervalue the information-sharing aspect when planning the professional development of cybersecurity-related specialists. Consequently, cybersecurity specialists are insufficiently motivated to correctly communicate and propagate relevant information with team members, superiors, relevant institutions and the global community about the impact of the incident. Literature review reveals many technological, legal and psychological obstacles hindering successful information exchange. This research aims to improve threat information sharing by focusing on the educational aspect of the problem and analysing the attitude of cybersecurity specialists during cyber defence exercises (CDX). Our case study disclosed nine factors obstructing both proper reporting to relevant authorities and adequate communication among teams. By addressing these factors, CDX organizers could substantially improve the development of highly beneficial soft skills of the technical specialists.