Sharing Communities: The Good, the Bad, and the Ugly

## Overview Thomas Gass presents research on cybersecurity information-sharing communities conducted through 25 video interviews with experts worldwide. The study investigates organizational structures, member motivations, and challenges in communities like FIRST and FS-ISAC, applying the Social-Technical Systems framework to understand how social and technical elements interact.

## Key Topics

**Organizational Structures** Sharing communities vary widely in formality and access. The research identifies open communities (no entry barriers), closed communities (strict entry rules), and topic/incident-related temporary task forces. Formal communities operate under legal frameworks with dedicated employees and hierarchies, while informal "hidden clubs" function on invitation and trust-based voting. Member structures are often undefined, creating challenges for collaboration and trust.

**Member Roles and Motivations** Six key roles emerged: producers (generate and share cyber threat intelligence), consumers (use intelligence and provide feedback), sharing enablers (grant permissions and allocate resources), brokers/proxies (collect and forward intelligence), hosts (administrators/organizers), and lurkers/free riders (non-contributing consumers). Members have altruistic goals including supporting peer defense, contributing to society, providing early warnings, and improving collective threat understanding, though goals sometimes differ between individuals and communities.

**Benefits and Challenges** Active participants receive threat intelligence, access knowledge repositories (reports, scripts, best practices), build relationships with diverse expertise, gain resource savings, and receive early threat warnings. However, the research identified significant interconnected challenges: low-quality intelligence, missing context, work overload, undefined member structures, subgroup formation, lack of trust, visa restrictions preventing participation, and lack of standardization in tools (Slack, Signal, MISP, Mailing lists, etc.) and taxonomies. Notably, most challenges are social rather than technical.

**Social-Technical Systems Framework** The framework represents sharing communities as complex work environments with three social elements—goals, people, and culture—and three technical elements—processes/procedures, infrastructure, and technology. All six elements interact and influence each other within an external context of regulations (GDPR, sanctions) and stakeholder pressures. High-quality, contextualized intelligence flows in trust-based hidden clubs, while open communities share lower-quality automated data.

## Key Insights - Trust is fundamental; informal communities with vouching/voting systems create safer sharing environments - Most challenges are social (fear of sharing, unclear membership) rather than technical - Standardization across communities would reduce member burden of learning multiple tools and taxonomies - Stable member composition and clear shared goals promote effectiveness - Infrastructure accessibility (visa policies, event locations) directly impacts culture and collaboration - Holistic approaches addressing social and technical elements simultaneously are necessary for improvement

## Takeaways Sharing communities critically support cyber defense but require thoughtful organizational design. Building clear goals, stable member structures with defined roles, trust-building activities (meetups, vouching systems), and standardized processes will improve both individual benefits and collective defensive capabilities. Communities should consider social and technical factors equally when addressing challenges.