States testing automated, shared threat intelligence cut response time to minutes

A pilot program testing automated cybersecurity data feeds to state and local governments drastically reduced the time it took them to deploy defensive operations, according to the Johns Hopkins University Applied Physics Laboratory (APL), which led the trial.

The goals of the one-year Indicators of Compromise (IOC) automation pilot, announced in July, were to integrate end-to-end cyber defense responses so that the time from sensing to acting was reduced from days to a few minutes and to define consistent procedures for information sharing across state and local governments.

The pilot participants included the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) as well as the state governments of Louisiana, Massachusetts, Texas and Arizona, Arizona’s Maricopa County and the Multi-State Information Sharing and Analysis Center (MS-ISAC).

The technology was developed in the 2016-2017 timeframe for the financial industry, where security researchers were looking at how to deploy security orchestration, automation and response (SOAR) tools for threat hunting, APL’s Charles Frick, the pilot’s principal investigator, said in an Integrated Adaptive Cyber Defense Community Conversation podcast. The positive results of that work convinced the researchers to “leverage both automation and information sharing as a combined ecosystem to really transform the game of how we can make threat intelligence actionable,” he said.

Thanks to a DHS grant for a state local tribal territorial IOC automation pilot, APL was able to transfer what it had learned about automating IOCs for financial institutions to state and local governments, each of which have a very different type of security governance structure. To facilitate the work with the government partners, APL worked with MS-ISAC and was able to reduce the time to response from days to minutes – a game changer for under-resourced government security operation centers.

In the pilot, the system identified indications of a cyberattack and quickly blocked traffic related to malicious IP addresses, domains and files, saving security staff from manually investigating threats.

“By getting things faster … security operation centers started placing a higher priority on using IOCs in their network defense because they were getting them fast enough to be actionable,” Frick said. “That's exactly what we wanted to be able to do because there's a lot of challenges out there.”

The new automated feed is “low regret,” APL officials said, meaning an agency can automate threat blocking and still be nearly certain that the block will not disrupt normal operations.

As IACD Technical Director Kim Watson once told Frick, low-regret means “it's OK to be wrong as long as you're not sorry.” Because the goal is to rapidly score threats, it isn’t necessarily the best plan to “take the time to 100% confirm that every single indicator is definitely malicious, definitely attributed to a particular cyber actor,” Frick said. Rather, the team wanted to rapidly score two main aspects of the threat. First they needed to determine if they had “enough information from the alert to confirm that we think this is most likely something bad,” he said.

Then, if the threat seemed malicious, they wanted to be certain that an organization would not suffer harm by blocking the threat. For example, Frick said, a web domain that’s only been active for a week, that’s hosted in an unexpected place and that is triggering security alerts is likely a serious threat, but it’s unlikely to cause harm to any organization that blocked it.

The pilot used SOAR tools to collect threat data from multiple sources and automate responses. During the pilot, one state received threat information quickly enough to protect its network from 270,000 attacks on the day the source was first spotted -- and from half a million attacks over multiple days, APL officials said in a statement.

“Too often, state and local governments learn of an attack after it has infiltrated their systems,” Frick said. “The new automated feed not only delivers actionable cyber threat intelligence and successful defense, but it also frees up network security personnel to address the most complex cyber threats.”

The technique used in the pilot could be adapted to protect infrastructure across other sectors, including financial services, transportation and energy, he added.

With the one-year pilot, APL collected data and results to make available as industry guides and best practices to impacted sectors, including state and local governments and the critical infrastructure community.

MS-ISAC is working with CISA and APL to make the feed more consumable and is preparing to offer it to state, local, tribal and territorial governments across the nation. The pilot feed remains available to the states that participated for cyber defense.