The workshop will presented practical approaches to implementing malware information sharing platform (MISP) in complex threat-sharing and orchestration environments, supported by concrete case studies. Participants will also receive an overview of communication flows and coordination frameworks based on European Union best practices.

Main takeaways:

• When one system is compromised, attackers will often move on to the next. The best way to defend against this is to share what we are seeing with each other quickly enough for it to make a difference.
• The Traffic Light Protocol (TLP) is a simple system that uses four color-coded labels to show how sensitive information can be shared and with whom. In contrast, the Permissible Actions Protocol (PAP) defines what actions can be taken with that information once it has been shared.
• MISP (malware information sharing platform) is a free, open-source software solution. Relying on a single MISP creates a single point of failure, meaning that if it goes down, everything is affected. To reduce this risk, it’s better to run multiple MISPs for different purposes.
• For information flow it is important to understand how information is shared between organisations. 5 distributions levels can be differenciated, meaning 5 dials that decide where an event travels: 0 (your organization only), 1 (this community only), 2(connected communities), 3 (all communities), 4 (sharing group).
• Indicator of compromise (IoCs) are atomic units that determine what you actually drop into a SIEM.
• The Pyramid of Pain is a model created by David Bianco in 2013 that shows how difficult it is for attackers to adapt when different types of threat indicators are detected by defenders.
• It is important to distinguish between sharing and dissemination: sharing is two-way, relationship-driven, and based on trust, while dissemination is one-way, more like broadcasting or publishing information.

The event will brings together Thailand’s sectoral CSIRTs and focus on strengthening cyber threat information sharing and coordinated response capabilities. The gathering involves the technical core of Thailand’s local CERT community. It provides a trusted setting for cybersecurity practitioners to exchange expertise, review recent incidents and align on operational priorities.