Threats, malware, and attack techniques
Information Sharing and Analysis Centers
An Information Sharing and Analysis Center (ISAC) is a member organisation, usually for one sector, through which companies and public bodies exchange threat information, incident reports and analysis with each other.
How they work
Members contribute what they see, from indicators to full incident write-ups, and the centre distributes it, typically with the source anonymised, along with its own analysis. Sharing is governed by agreements on how information may be used and passed on, and much of the exchange is automated in STIX over TAXII. Many ISACs also run working groups, exercises and alert channels.
ISACs and ISAOs
ISACs in the United States grew out of critical-infrastructure sectors such as finance, energy and health. Information Sharing and Analysis Organizations are a broader category that allows groups formed around other lines, such as a region or a supply chain, to share on the same basis. Similar sector bodies exist in other countries under different names.
Relevance to brand protection
Phishing campaigns rarely target one company in a sector. A bank that sees a new kit will see it used against its peers within days. Sector sharing is how the second bank learns about it before its customers do, and it is a channel through which a brand-protection team can both receive early warning and give it.
Related terms
Sources
- National Council of ISACs
- CISA: Information Sharing and Analysis Organizations
- CISA: information sharing
External guidance is general. Adapt it to your legal, regulatory and operational requirements.