Cybersecurity Leaders Launch Interoperable Security Technologies

In an interoperable security technologies development, IBM Security and McAfee join with Advanced Cyber Security Corp, Corsa, CrowdStrike, CyberArk, Cybereason, DFLabs, EclecticIQ, Electric Power Research Institute, Fortinet, Indegy, New Context, ReversingLabs, SafeBreach, Syncurity, ThreatQuotient, and Tufin to collaborate on new initiative at OASIS.

The OASIS international consortium announced an industry initiative to bring interoperable security and data sharing across cybersecurity products. With initial open source content and code contributed by IBM Security and McAfee, and formed under the auspices of OASIS, the Open Cybersecurity Alliance (OCA) brings together organizations and individuals from around the world to develop open source security technologies which can freely exchange information, insights, analytics, and orchestrated responses.

According to industry analyst firm, Enterprise Strategy Group, organizations use 25 to 49 different security tools from up to 10 vendors on average, each of which generates siloed data.  (Cybersecurity Landscape: The Evolution of Enterprise-class Vendors).

Connecting these tools and data requires complex integrations, taking away from time that could be spent hunting and responding to threats. To accelerate and optimize security for enterprise users, the OCA will develop protocols and standards which enable tools to work together and share information across vendors. The aim is to simplify the integration of security technologies across the threat lifecycle – from threat hunting and detection, to analytics, operations and response -- so that products can work together out of the box.

The purpose of the OCA is to develop and promote sets of open source common content, code, tooling, patterns, and practices for interoperable security and sharing data among cybersecurity tools. For enterprise users, this means:

• Improving security visibility and ability to discover new insights and findings that might otherwise have been missed;
• Extracting more value from existing products and reducing vendor lock-in;
• Connecting data and sharing insights across products.

“Today, organisations struggle without a standard language when sharing data between products and tools,” said Carol Geyer, chief development officer of OASIS. “We have seen efforts emerge to foster data exchange, but what has been missing is the ability for each tool to transmit and receive these messages in a standardized format, resulting in more expensive and time-consuming integration costs. The aim of the OCA is to accelerate the open sharing concept making it easier for enterprises to manage and operate.”

“When security teams are constantly spending their time manually integrating tools and maintaining those integrations, it’s not helping anyone other than the attackers,” said Jason Keirstead, chief architect, IBM Security Threat Management. “The mission of the OCA is to create a unified security ecosystem, where businesses no longer have to build one-off manual integrations between every product, but instead can build one integration to work across all, based on a commonly accepted set of standards and code.”

“Attackers maximize damage by sharing data with one another. Our best defense strategy is to share data too," said D.J. Long, vice president business development, McAfee. "The OCA creed is 'Integrate once, reuse everywhere' which builds upon McAfee’s open philosophy that led to the OpenDXL project in 2016. Organizations will be able to seamlessly exchange data between products and tools from any provider that adopts the OCA project deliverables. We're looking at the interoperable security potential for unprecedented real-time security intelligence.”

Additional Quotes from sponsor member companies -

Initial technology contributions to the open project are as follows, with additions expected as part of ongoing work:

• STIX-Shifter (from IBM Security): This project aims to create a universal, out-of-the box search capability for security products of all types, by providing a way to connect security products to other security, cloud, and software data repositories via a standardized cybersecurity data model (STIX 2). STIX-Shifter is an open source library which can identify information about potential threats within a wide variety of data repositories and translate it into a format that can be digested and analyzed by any security tool that has this standard enabled.

• OpenDXL Standard Ontology (from McAfee) focused on the development of an open and interoperable security messaging format for use with the OpenDXL messaging bus. The OpenDXL Standard Ontology will be offered under the Apache 2.0 license.