Panel: Open Data (OSINT) and Threat Intelligence Sharing Platforms and Tools

### Overview This panel session, moderated by Jean-Robert (introduced after Chris), examines the strategic role of threat intelligence sharing platforms, open-source tooling, and open data/OSINT in supporting Computer Security Incident Response Teams (CSIRTs/CERTs) and fostering national and regional collaboration. The panel features presentations from Andras Iklody (CIRCL), John Grimm (Verizon), Piotr Kijewski (Shadowserver Foundation), Adli Wahid (APNIC), and Lawrence Ouma (Silensec / CybAlliance), with a particular emphasis on practical implementation across Africa, the Arab region, and the Asia-Pacific.

### Key Topics - **Threat Sharing and Management Platforms (MISP & Cerebrate):** The development, operational philosophy, and benefits of open-source threat intelligence platforms (TIPs) like MISP, as well as fleet and community orchestration tools. - **Standardized Incident Classification (VERIS & A4 Threat Model):** Structuring breach and incident reporting through a unified lingua franca that maps to established defensive and adversarial frameworks. - **Free Large-Scale Threat Data Collection (Shadowserver Foundation):** Global sinkholing, daily scanning, honeypot telemetry, and automated reporting distributed to national CERTs and network owners. - **Community Honeynet Initiatives for Capacity Building (APNIC):** Leveraging honeypot sensor networks to train network operators, raise operational awareness, and transition from incident response to proactive defense. - **Grassroots CTI Generation in Resource-Constrained Environments:** Overcoming budgetary, competency, and trust hurdles by deploying low-overhead sensor pipelines within national CERT constituencies.

### Technical Details - **MISP and Open Source Economics:** Andras Iklody highlighted that CIRCL (the Luxembourg national CERT for the private sector) leads MISP development. Deploying open-source software directs fixed security budgets away from licensing and into developing internal staff skills. MISP serves as an incident data store that correlates indicators, triggers lookups via internal tools (passive DNS, passive SSL) and external services (VirusTotal, DomainTools, PassiveTotal), coordinates takedown requests, integrates with tools like AIL framework for information leak monitoring, and facilitates pre-CVE vulnerability disclosure. - **VERIS and the A4 Threat Model:** John Grimm explained that Verizon's DBIR relies on the VERIS framework's A4 threat model: - *Actors* (External, Internal, Partner) - *Actions* (Environmental, Physical, Error, Misuse, Social, Malware, Hacking), broken down into varieties and vectors - *Assets* (e.g., Web application server, Mail server, Database server, Documents) - *Attributes* (Confidentiality, Integrity, Availability) VERIS integrates with the VERIS Community Database (VCDB) for public breach coding (demonstrated via the Colonial Pipeline ransomware incident), aligns with MITRE ATT&CK techniques, and maps directly to CIS Controls. - **Shadowserver Data Collection Infrastructure:** Piotr Kijewski detailed Shadowserver's free telemetry: 68 daily internet scans, malware repositories totaling 1.5 billion samples (adding over 1 million unique samples daily processed via sandboxes), 50–60 million SSL certificates gathered daily, and sinkholes seeing ~5 million affected IP addresses daily (~450,000 in Africa). Reports (approaching 80 types, provided in CSV or JSON via API) cover vulnerabilities like Microsoft Exchange / Hafnium exploits, IoT attacks, and device identification. Shadowserver deploys community honeypot sensors requiring only a minimal clean Ubuntu install, low-spec hardware/VM, and at least two IPv4 addresses. - **Community Honeynets and Dashboards:** Adli Wahid outlined APNIC's community honeynet project, initiated through training at BDNOG in 2014 to teach threat detection, forensics, and mapping attacks to MITRE ATT&CK. Telemetry feeds into open-source platforms, MISP, and external partners like Shadowserver, while APNIC’s internal project DASH provides network routing and suspicious traffic insights directly to members. - **Constituency-Driven CTI Generation:** Lawrence Ouma described building threat intelligence in resource-constrained environments using a multistakeholder constituency model. Instead of relying solely on external feeds, national CERTs deploy single, low-spec sensor hardware running lightweight Docker Compose setups with up to five independent honeypots per constituency (e.g., HTTP/API for some, RDP/SSH or OT for others). Logs ship back to central CERT infrastructure running ELK and MISP, where data is enriched (including integration with Shodan) and served back through role-based access control (RBAC).

### Takeaways Effective threat intelligence relies heavily on trust, shared prosperity, and standardized communication rather than expensive proprietary tooling. Organizations can construct end-to-end intelligence pipelines using open-source platforms (MISP, ELK), free global feeds (Shadowserver), and common vocabularies (VERIS). Regional development requires addressing the driver shortage—building local human capacity and reducing technical overhead so teams can actively generate, enrich, and share localized telemetry rather than passively consume external intelligence.