Scaling cyber threat intelligence sharing with the AUS Cyber Security Center
summary
ACSC runs CTIS on AWS to share machine-speed, evidence‑based indicators enriched and validated by government then redistributed to partners; the platform uses MISP and STIX for interoperability, examples include OpenCTI on EC2 + Docker, and an automated pipeline converts Security Hub findings into STIX via Lambda + Step Functions + GuardDuty to block or investigate threats. The program processes sightings (one incident reported every seven minutes, 76,000 reports last year), pushed takedowns and protected DNS for over 400 orgs, and handled partner reports of 60 malicious IPs.
AI-written summary · about
chapters (8)
- 0:00Introduction to threat intel
- 0:34The role of the ACSC
- 9:38The Cetus program
- 13:57Partnership and engagement
- 16:32Getting started on AWS
- 19:28Automating security actions
- 20:44Technical implementation
- 25:34Conclusion and resources
related talks
51mCyber threat intelligence sharing on AWS
41mThe Art of Threat-Informed Sharing: Real-life Use Cases from NSA
51mKeynote: Cybersecurity Partnership, Technology and Trust
27mStandard Classification: Connecting the Dots: How Threat Intelligence Protect...
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)
48mIntegrating Cyber Operations: CISA & CyberCom-CNMF Partnership
01h 27mSecuring at Scale Building Resilient Defences for a Growing Digital World
29mA Collective CTI Doctrine