Developing a cyber threat intelligence sharing platform for South African organisations

Abstract

Cyber attacks are on the increase in severity, complexity and frequency, negatively affecting the citizens, government, and businesses. Adversely, the security and Defence role-players in developing countries, such as South Africa, are short of the required capacity and capability to adequately defend and protect the national cyberspace against these fast moving and persistent threats and attacks. Be that as it may, the South African cyberspace still requires national attention and protection by the mandated role-players, such as the Defence force and its industry partners. Thus, within the cyber domain, the various Defence force role-players can no longer rely on traditional solutions to detect, defend, and respond to the forever changing cyber threats and cyber attacks. In order to reduce cyber security risks and strengthen cyber resilience of the nation, strategic cyber security information sharing in the Defence environment is becoming a necessity. Thus, the contribution from this paper is a systematic discussion and demonstration of a conceptual cyber threat intelligence sharing model and platform that could stimulate and enable different stakeholders within the Defence environment to seamlessly and collaboratively aggregate, analyse, and timely share contextual and actionable cyber-threat intelligence that could lead to a resilient cyber security posture and better protection of the national cyberspace.