Leveraging a TAXII Server to Protect Your Data

We don’t always concern ourselves with how cyber-security applications work internally. TAXII (Trusted Automated eXchange of Indicator Information) is a new threat data format convention one must understand in order to harness. TAXII isn’t an application for sharing threat intelligence. It’s a standard language of cyber threat information. Indicators of compromise are coded into a machine-readable language which can be universally shared between different applications, even if they are produced by different developers.Your TAXII server is built on standardized feeds of information but it’s not a one-size-fits-all tool. Users still have control over which aspects of their traffic logs they wish to contribute to the zeitgeist. There is a growing awareness of the need to share threat intelligence among the finance, retail, military, healthcare, and government agencies which are inundated with threats.Since much of the hacking affecting the US today is sponsored by foreign governments, the DHS has issued a statement suggesting businesses put aside their differences and work together to identify and stop cyber criminals. Remitting this data through a TAXII server makes threats found in your traffic logs usable to other would-be victims without revealing whose network was affected. Before this initiative, the prevalent method to report cyber-threats was to e-mail the DHS a report of the incident. Collecting useful intelligence was very labor intensive before this standard was introduced. From this standardization, TAXII renders four main deliverables:<ol><li>Discovery - Learning how to interact with services</li><li>Collection management – Discovering and requesting access to data collections</li><li>Poll messaging – Sending out a message requesting specific content</li><li>Inbox – Receiving content directly</li></ol>Participation in this exchange gives you greater protection, but with that come some responsibilities. When sharing threat intelligence through a TAXII server, you must adhere to some guidelines. These guidelines are in place to ensure anonymity about victims or other individuals not responsible for the threat. Naming individuals or failing to <a href="http://www.darkreading.com/threat-intelligence/how-to-share-threat-intelligence-through-cisa-10-things-to-know-/d/d-id/1324619" target="_blank">remove other identifying details</a> jeopardizes your protection from liability. If any significant portion of your traffic is from Europe, consider looking into EU regulations regarding using a TAXII server. The rules are much stricter and if violated, they can levy a <a href="http://www.theregister.co.uk/2016/05/12/gdpr_potential_fines_for_data_security_breaches_more_severe_for_data_controllers_than_processors_says_expert/" target="_blank">fine up to €20 million or 4%</a> of your global profits.Ordered data is known as a Data Feed whereas unordered data is a Data Set. When <a href="https://www.anomali.com/blog/learn-how-to-standardize-threat-intelligence-with-stix-and-taxii">sharing threat intelligence to a TAXII server</a>, there are different models for the direction of information flow:<ul><li>Hub and Spoke – Data flows to and from one central bank</li><li>Peer to Peer – Users share intel with others at their discretion</li><li>Source and Subscriber – Users rely on intelligence from one central source</li></ul>Using one standard format to <a href="https://www.anomali.com/blog/learn-how-to-standardize-threat-intelligence-with-stix-and-taxii">send and request threat data</a> is a big step for the threat intelligence community. Strongly consider arming your IT security team with the tools to send and receive very specific threat feeds through a TAXII server.To learn more about using standards like TAXII to protect your data, download our white paper.<a class="cta_button" cta_dest_link="{page_3458}" href="https://cta-service-cms2.hubspot.com/ctas/v2/public/cs/c/?cta_guid=4f082f1c-a704-4df4-a627-a030c2f8e351&placement_guid=79cc3352-61a2-44b7-8b7c-6f25d759918c&portal_id=458120&redirect_url=APefjpHH6xiwIX-TM8B7_qFRL6uhJGLu0TxSuE6ntEtHxGpd1t893lsRi8AydUrtE0ZLt9aScfxezzQzztpG36M6CCbL0x5B68jQlmhYc2q0SGR8Yr8S0UP5U0yHZ2wnwdZZs8DZzw20TuiLeJkIuN4cHEyolFKOyawqBDMXes0VgqdaVAMDC3QBMEXhduTY4ATukqm6TQMQMYzdCcE6TelKHSdMxDkF2rOr2sKJyEA13VYdP76Lxhk0JkKVPqfrL0XLx05Qls0e-9dD5_YwWfztVkeokea5oZWIJ52cN6Iek-i7xif1ReNSfQfGY88ZHmsoJ0w68SU9HX08t6Cz4e39gwgJPpDwlQ&hsutk=2767d93d6471d657e0c9f660e4b58ef8&utm_referrer=https%3A%2F%2Fblog.anomali.com%2Fleveraging-a-taxii-server-to-protect-your-data&canon=https%3A%2F%2Fblog.anomali.com%2Fleveraging-a-taxii-server-to-protect-your-data&pageId=4260925544&__hstc=41179005.2767d93d6471d657e0c9f660e4b58ef8.1456736058655.1478822660171.1478831861868.179&__hssc=41179005.62.1478831861868&__hsfp=1335165674" id="cta_button_458120_4f082f1c-a704-4df4-a627-a030c2f8e351" style="margin: 20px auto;" target="_blank" title="Download Here">Download Here </a> <script charset="utf-8" src="https://js.hscta.net/cta/current.js"></script> <script type="text/javascript">hbspt.cta.load(458120, '79cc3352-61a2-44b7-8b7c-6f25d759918c', {});</script>