Information sharing and analysis system and method

Abstract

A system and method serves to anonymously share information about security incidents and vulnerability in corporate and national information infrastructures. The method and system provides for submitting information and categorizing the corresponding data in a secure manner in which the submitting party's anonymity is ensured. A secure facility such as a data center is established that provides for authenticated and, where appropriate, anonymous input, ensuring availability of information associated with threats to industry assets and the available resolutions or solutions. The information may be shared securely through, for example, the World Wide Web, between authorized organizations.

1 . A method for allowing sharing of information associated with threats to industry assets, comprises: 
 establishing a secured database comprised of threat data;    allowing predetermined entities access to said database;    augmenting the database with additional threat data received from at least one of a plurality of sources; and    notifying at least some of said predetermined entities of additional threat data received and augmented to the database, whereby said predetermined entities will know to access the database if it is desired to learn more about the threat data.    
   
   
       2 . The method of  claim 1  further comprising conducting said augmenting of the database with threat data received anonymously from said at least one of a plurality of sources.  
   
   
       3 . The method of  claim 2  wherein said threat data received anonymously is further reviewed for specific information which may accidentally identify the source of the threat data, and said specific information is then removed from the threat data before augmenting the database.  
   
   
       4 . The method of  claim 1  wherein said predetermined entities are subscribed participants about which information is stored, and further comprising selectively notifying said participants in accordance with the type of additional threat data received and augmented to the database.  
   
   
       5 . The method of  claim 1  wherein said predetermined entities are subscribed participants about which information is stored, and said plurality of sources comprises said participants, and vendors and government sources.  
   
   
       6 . The method of  claim 1  wherein said threat data is comprised of and arranged in the database as, (a) incident data, (b) vulnerability data, (c) threat activity data, and (d) vendor data, and further comprising storing incident resolution data separately in the database.  
   
   
       7 . The method of  claim 6  further comprising, for threat data received from a participant, temporarily storing said submitted threat data in a separate sanitized database, removing source-identifying information from threat data received, authenticating said threat data through an authentication mechanism, and after sanitizing and authenticating, augmenting the secured database with said submitted threat data.  
   
   
       8 . The method of  claim 6  further comprising classifying the threat data in accordance with the nature of the threat data severity as: (a) crisis threat data; (b) urgent threat data; and (c) awareness threat data; and notifying participants in the case of crisis or urgent threat data is received and stored on the secured database.  
   
   
       9 . The method of  claim 8  wherein said notification of participants is done electronically.  
   
   
       10 . The method of  claim 4  wherein said participants can selectively identify only specific types of threat data which has been augmented to the database about which they wish to be notified.  
   
   
       11 . A system for allowing sharing of information associated with threats to industry assets, comprising: 
 a data center comprised of a secured database containing threat data stored thereon;    a communications interface for allowing predetermined entities access to said database;    a temporary database store for storing additional threat data from at least one of a plurality of sources for allowing review and classification of said additional threat data;    said secured database being connected to said temporary database store for allowing said additional threat data to be stored on the secured database once it has been reviewed and classified; and    an electronic notification system for notifying at least some of said selected entities about additional threat data stored on the secured database, whereby said selected entities will know to access the secured database if the additional threat data stored thereon is of interest.    
   
   
       12 . The system of  claim 11  further comprising an automated system for reviewing additional threat data received anonymously by a process of key word search and removal, and for thereafter transmitting the additional threat data for review and classification by an analyst.  
   
   
       13 . The system of  claim 1  wherein said predetermined entities are subscribed participants, and further comprising a participant database comprised of participant information, including information about which type of additional threat data stored on the secured database each participant wishes to be notified about.  
   
   
       14 . The system of  claim 11  wherein said predetermined entities are subscribed participants, and further comprising a participant database comprised of participant information, including information about which type of additional threat data stored on the secured database each participant wishes to be notified about, and said plurality of sources comprises said participants, vendors and government sources.  
   
   
       15 . The system of  claim 1  wherein said threat data is comprised of and arranged in the database as, (a) incident data, (b) vulnerability data, (c) threat activity data, and (d) vendor data, and further comprising incident resolution data separately arranged in the database.  
   
   
       16 . The system of  claim 15  further comprising, for additional threat data anonymously submitted by participants, a mechanism for authenticating the additional threat data.  
   
   
       17 . The system of  claim 15  wherein said additional threat data is classified as one of crisis threat data, urgent threat data, and awareness threat data, and wherein said electronic notification system is configured for notifying participants in the event crisis threat data or urgent threat data is added to the secured database as additional threat data.  
   
   
       18 . The system of  claim 17  wherein said electronic notification system is configured for notifying said participants through at least one of pager, electronic mail and digital phone messaging.  
   
   
       19 . The system of  claim 13  wherein the communications interface allows connection to third-party anonymizer systems to allow participants to submit additional threat data anonymously.  
   
   
       20 . The system of  claim 19  wherein said participant database contains authentication information about each participant to allow authentication of additional threat data received anonymously from participants.