Content area
Full Text
Abstract: Contemporarily, one of the main challenges for information security community is the growing number of cyber threats. Large scaled, globally orchestrated and constantly evolving attacks are affecting our information systems and technologies every day. Therefore, collection and the exchange of cyber threat intelligence is of supreme importance. The term Cyber Threat Intelligence (CTI) has emerged with the contemporary because of merging the cyber intelligence concepts with the risk and threat management in cyber space. Today, a number of security companies provide cyber threat intelligence with their sensors deployed worldwide, Security Information and Event Management (SIEM) software and Intrusion Detection and Prevention Systems (IDPS) working collaboratively. The collection of Cyber Threat Intelligence is the process of collecting and producing actionable information of threats and threat actors aimed at increasing awareness and operational capabilities upon recognition of attack and attempt scenarios in a timely fashion. This research aims to investigate the recent developments of SDN and Containerized Clouds with a security perspective. The implementation of a containerized cloud with a programmable network of honeypot is implemented in this research. The implementation is tested with a scenario where a propagation of a worm that is originated from an infected container image. The security mechanisms on the cloud are fed with the collected CTI and results of the experiments along with discussions are presented.
Keywords: cyber threat intelligence, containerized clouds, cloud security, SDN
1.Introduction
From the cyber point of view, the process of producing intelligence eventually comes down to the processes of compiling, processing and fusing data (Franke & Brynielsson, 2014). Cyber Intelligence coined with Risk/Threat management has emerged the term Cyber Threat Intelligence (CTI). Many security companies as of today provide highly valued services of producing, sharing, organizing and classifying the knowledge on threats and attacks with their sensors deployed worldwide. The aim of the production of CTI is to increase awareness and improve operational capabilities upon recognition of attack and attempt scenarios in a timely fashion.
To answer the needs of producing timely cyber threat intelligence on the dynamic and ever changing nature of information, a cutting edge technological improvement, Software Defined Networking, that is on the rise in networking is investigated and deployed on a service infrastructure, containers, that is being popularized by the...