There is some sharing of security data happening out there right now, in varying degrees of scope and success.

Public and semi-public clearinghouses such as MalwareDomainList.com provide an excellent free source of single-scope threat intelligence. But the data is limited and organizations must construct their own processes and technology to consume it effectively.

Private data sharing arrangements exist between some large organizations, and some government bodies mandate the need to share information, but we live in an age where the tide is turning against publicly available information. Information is valuable beyond measure and things of value are instinctively hoarded away in private.

So, after a decade of discussion and attempts to reach critical mass in the move to a sufficiently effective level of data sharing, we still find ourselves at this impasse.

So by all means, let's all share YOUR data with one another and we'll all be better off; but let's not share MY data, that would be bad! 

I think we've hit the problem right on the head: the progress we haven't made in security data sharing isn't because of limitations in technology or legal implications (both of which can be overcome with little effort).

People don't want to share because of those old faithful standbys still gnawing at the human mind: fear and greed. Fear of how whatever we share may be used against us, greed for anything we can get for free, or better yet, monetize the transaction.

We're not going to make this go away overnight; if we're going to find an effective middle ground towards a security data sharing network that is effective for all, we are going to have to find ways to route around these two mindsets.

So how do we move forward? So far, the only answer I've arrived at for this is that stressing the importance of enlightened self-interest may be the only winnable argument in this debate – the idea that if I help others, it furthers my own goals seems to be a perfectly reasonable compromise.

Data sharing doesn't mean giving things away

Any good data sharing solution is going to result in you receiving more than you give. A data sharing solution that allows one participant to gain a fundamental business advantage over other parties is likely broken.

Data sharing is not an all-or-nothing arrangement

Within the security realm there are a great number of layers of data within the field. Being selective about what is shared and to what level of detail is perfectly reasonable.

Paranoia leads us to start from a default-deny position, and try to justify what can be opened up after the fact. For anyone who has ever filed a FOIA request, it is easy to see how this is a method that gains few results for a great deal of work. Instead we should consider the alternative of starting out from the viewpoint of "everything is good to share" and then selectively removing the things identified as not OK to share.

I would be amiss to stand here and claim that universal public security data sharing will fix all our woes overnight (though I'm certainly saying it would give us more of a fighting chance). There are significant hurdles to encounter and overcome when dealing with data and intelligence sharing that need to be addressed by any organization entering a data sharing arrangement.

All intelligence is counter-intelligence / the most valuable intelligence becomes less valuable the more widely it is distributed

Open information sharing networks will be infiltrated by attackers, without a doubt. So long as the system does not enable the attacker to infer detailed information about what a particular target knows, it is possible to stay a step ahead of them.

Intelligence data that cannot be acted upon, is worthless

The more open an intelligence source, the more generic the format it must be communicated in. Public sources of threat intelligence are published in the lowest-common denominator format – text files of IP address, CSV files, etc. For many security organizations using these feeds, they process the information manually via analysts performing searches across logs.

The path forward

It is essential to the success of data sharing that the content is detailed and consumable – or it won't work. Getting organizations to overcome the reluctance to share detailed information outside their borders will require more detailed, incremental programs of information sharing; ones that start out with simple statistical sharing (like the Verizon VERIS framework) and then ramp up through programs of threat agent information.

 Adoption of tokenization and anonymization techniques and standards that can be implemented without significant effort will be an important factor in allowing organizations to collaborate without undue legal or operational liability.  Some level of assurance that the information shared will not (nay, cannot) be used against the contributing organization directly, is a requirement only the most reckless would ignore.

We've spent well over a decade now debating the need for more shared security data as the sanest way to raise the cost of entry and lower the return on investment for criminals and spies alike.

"Fail Early, Fast Fast, Fail Often" is a popular idea nowadays; let's see that applied to more attempts at making the promises of a shared pool of security data arrive while we're all still in business to see it.

Conrad Constantine is a research team engineer at AlienVault in Campbell, Calif.