\note[item]{Explaining the overall history of MISP especially the aspect of starting on a focused topic "malware reversing" to a more generic open source solution for sharing information.}
The Computer Incident Response Center Luxembourg (CIRCL) is a government-driven initiative designed to provide a systematic response facility to computer security threats and incidents. CIRCL is the CERT for the private sector, communes and non-governmental entities in Luxembourg and is operated by securitymadein.lu g.i.e.
\end{frame}
\begin{frame}
\frametitle{MISP and CIRCL}
\begin{itemize}
\item CIRCL is mandated by the Ministry of Economy and acting as the Luxembourg National CERT for private sector.
\item CIRCL leads the development of the Open Source MISP threat intelligence platform which is used by many military or intelligence communities, private companies, financial sector, National CERTs and LEAs globally.
\item{\bf CIRCL runs multiple large MISP communities performing active daily threat-intelligence sharing}.
\end{itemize}
\includegraphics{en_cef.png}
\end{frame}
\begin{frame}
\frametitle{What is MISP?}
\begin{itemize}
\item MISP is a {\bf threat information sharing} platform that is free \& open source software
\item A tool that {\bf collects} information from partners, your analysts, your tools, feeds
\item Normalises, {\bf correlates}, {\bf enriches} the data
\item Allows teams and communities to {\bf collaborate}
\item{\bf Feeds} automated protective tools and analyst tools with the output
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{Development based on practical user feedback}
\begin{itemize}
\item There are many different types of users of an information sharing platform like MISP:
\begin{itemize}
\item{\bf Malware reversers} willing to share indicators of analysis with respective colleagues.
\item{\bf Security analysts} searching, validating and using indicators in operational security.
\item{\bf Intelligence analysts} gathering information about specific adversary groups.
\item{\bf Law-enforcement} relying on indicators to support or bootstrap their DFIR cases.
\item{\bf Risk analysis teams} willing to know about the new threats, likelyhood and occurences.
\item{\bf Fraud analysts} willing to share financial indicators to detect financial frauds.
\end{itemize}
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{MISP model of governance}
\includegraphics[scale=0.4]{governance.png}
\end{frame}
\begin{frame}
\frametitle{Many objectives from different user-groups}
\begin{itemize}
\item Sharing indicators for a {\bf detection} matter.
\begin{itemize}
\item 'Do I have infected systems in my infrastructure or the ones I operate?'
\end{itemize}
\item Sharing indicators to {\bf block}.
\begin{itemize}
\item 'I use these attributes to block, sinkhole or divert traffic.'
\end{itemize}
\item Sharing indicators to {\bf perform intelligence}.
\begin{itemize}
\item 'Gathering information about campaigns and attacks. Are they related? Who is targeting me? Who are the adversaries?'
\end{itemize}
\item$\rightarrow$ These objectives can be conflicting (e.g. False-positives have different impacts)
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{Communities using MISP}
\begin{itemize}
\item Communities are groups of users sharing within a set of common objectives/values.
\item CIRCL operates multiple MISP instances with a significant user base (more than 1200 organizations with more than 4000 users).
\item{\bf Trusted groups} running MISP communities in island mode (air gapped system) or partially connected mode.
\item{\bf Financial sector} (banks, ISACs, payment processing organizations) use MISP as a sharing mechanism.
\item{\bf Military and international organizations} (NATO, military CSIRTs, n/g CERTs,...).
\item{\bf Security vendors} running their own communities (e.g. Fidelis) or interfacing with MISP communities (e.g. OTX).
\item{\bf Topical communities} set up to tackle individual specific issues (COVID-19 MISP)
\end{itemize}
\end{frame}
\begin{frame}
\frametitle{Sharing Difficulties}
\begin{itemize}
\item Sharing difficulties are not really technical issues but often it's a matter of {\bf social interactions} (e.g. {\bf trust}).
