Case Study: Threat Intelligence Sharing

Since the initial Russian invasion of Ukraine, the Cyber Defensive Assistance Collaborative (CDAC) has been working to enhance Ukrainian cyber defensive efforts, including threat intelligence to critical infrastructure and defense organizations. CDAC recognized challenges in receiving threat intelligence from different sources such as prioritizing, de-duplicating, and parsing through a large amount of information. Thus, since early 2023, CDAC has collaborated with leaders of participating organizations, including ThreatQuotient, Recorded Future, Mandiant, now part of Google Cloud, and the Cyber Threat Alliance (CTA) to develop a centralized aggregator and distributor of threat intelligence. This endeavor has also received support from the US Cybersecurity and Infrastructure Security Agency (CISA): “CISA continues to urgently support our Ukrainian partners and provide all possible information and services to advance their cyber defense,” said CISA Associate Director Clayton Romans. “By working with key partners like CDAC, we are able to catalyze information sharing and help bring the best capabilities of government and industry to support Ukraine during this challenging time.” The platform sets forth an enhanced capability in CDAC’s ongoing mission to assist Ukraine, with broader applications to be deployed rapidly in other contexts across the globe.