Posted
ThreatConnect Communities have become the indispensable Swiss army knife in the analyst collaboration arsenal this past year. While our community blueprint has always included – a “Common Community” for open sourced shares, a “Subscriber Community” for proprietary, advanced shares developed by our ThreatConnect Research Team, and garden variety of vetted, Industry Moderated Communities; it has been both surprising and inspiring to see our customers adopt ThreatConnect Communities to support their very diverse set of collaboration requirements in ways that we had not envisioned.
Some of the more interesting Community use cases have involved binding together virtual first responders to focus on emerging cyber campaigns and events. Because it is “that quick and easy”, impromptu communities were launched to support military missions and training exercises. In another case, a community provided a venue for businesses from across a particular geography to collaborate on a new malware strain. Our own ThreatConnect Research spun-up a community to share threat intelligence they discovered with the Brazilian World Cup sponsors. In each of these examples, the need for a community focused on a specific short-term problem. When their purpose was accomplished, the community disbanded or went dormant. However, the relationships formed between the members remain intact and are there when needed again.
Private communities also serve our members around longer-term issues. Also, calling a ThreatConnect Community “home” is a large public/private sector partnership, a couple of tightly vetted “listservs”, a handful of Managed Security Service providers who have opted to use a ThreatConnect Community to share their intel with customers, and a couple of guys from Fortune 200 companies who used to meet at a burger place for lunch every-so-often to talk about what they were seeing. The members of each of these communities use them on a regular basis to contribute relevant intelligence in a retrievable and machine-readable format.
ThreatConnect Communities provide an opportunity to get started quickly and scale easily for growth. There is no need to have a complete set of members at the onset. (Think go-and-grow.) Our community template supports attributable or anonymous collaboration, and community directors manage membership with role-based access controls. Threaded discussions and activity logs are enriched with contextual links to threat data, and each community has the ability to set its own policies regarding data privacy and usage.
We use ThreatConnect Communities to share what we know about the threat. Maybe you should too.