Computer Emergency Response Teams (CERTs) provide advisory, preventive, and reactive cybersecurity services for authorities, citizens, and businesses. However, their responsibility of establishing cyber situational awareness by monitoring and analyzing security advisories and vulnerabilities has become challenging due to the growing volume of information disseminated through public channels. Thus, this paper analyzes semi-structured interviews (N = 17) with CERT employees to identify user requirements, which are translated into the design of a system for automatically retrieving and extracting security advisory documents from Common Security Advisory Framework (CSAF), HTML, and RSS sources. The evaluation using a CERT-based list of trusted security advisory sources (N = 53) shows that the developed system can retrieve 90% of the published advisory documents, which is a significant improvement over systems only relying on the retrieval from RSS feeds (30%).

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

AdvisoryHub: Design and Evaluation of a Cross-Platform Security Advisory System for Cyber Situational Awareness

  • Marc-André Kaufhold,
  • Julian Bäumler,
  • Nicolai Koukal,
  • Christian Reuter

摘要

Computer Emergency Response Teams (CERTs) provide advisory, preventive, and reactive cybersecurity services for authorities, citizens, and businesses. However, their responsibility of establishing cyber situational awareness by monitoring and analyzing security advisories and vulnerabilities has become challenging due to the growing volume of information disseminated through public channels. Thus, this paper analyzes semi-structured interviews (N = 17) with CERT employees to identify user requirements, which are translated into the design of a system for automatically retrieving and extracting security advisory documents from Common Security Advisory Framework (CSAF), HTML, and RSS sources. The evaluation using a CERT-based list of trusted security advisory sources (N = 53) shows that the developed system can retrieve 90% of the published advisory documents, which is a significant improvement over systems only relying on the retrieval from RSS feeds (30%).