Full Program »
What’s in a Cyber Threat Intelligence sharing platform? A mixed-methods user experience investigation of MISP
The ever-increasing scale and complexity of cyber attacks and cyber-criminal activities necessitate secure and effective sharing of cyber threat intelligence (CTI) among a diverse set of stakeholders and communities. Threat intelligence sharing platforms are becoming indispensable tools for cooperative and collaborative cybersecurity. Nevertheless, despite the growing research in this area, the emphasis is often placed on the technical aspects, incentives, or implications associated with threat intelligence sharing, as opposed to investigating challenges encountered by users of such platforms. To date, user experience (UX) aspects remain largely unexplored.
This paper offers a unique contribution towards understanding the constraining and enabling factors of security information sharing within one of the leading platforms. MISP is an open source CTI sharing platform used by more than 6,000 organizations worldwide, ranging from NATO to national CSIRTs and private sector actors. As a technically-advanced CTI sharing platform it aims to cater for a diverse set of security information workers with distinct needs and objectives. In this respect, MISP has to pay an equal amount of attention to the UX in order to maximize and optimize the quantity and quality of threat information that is contributed and consumed.
Using mixed methods we shed light on the strengths and weaknesses of MISP from an end-users’ perspective and discuss the role usability and user experience (could) play in effective cyber threat intelligence sharing. We conclude with an outline of future work and open challenges worth further exploring in this nascent, yet highly important socio-technical context.