Between the meetings

As ISAC participation often is an activity that members engage with in addition to their normal work, not much time and resources are left for ISAC engagement between the meetings. However, if ISACs are able to motivate their members to engage also between meetings, the added value will increase for everyone. Activities could include disseminating threat intelligence, warnings, occurred incidents, mitigating recommendations, but also proposing agenda items for coming meetings and commenting on draft papers. 

In addition to collecting relevant information and “packaging” it for recipients, some information might need in depth analysis in order for it to make a difference. For example, ISACs focusing on cyber threats might need to reserve time and additional resources for analysis of data that has been exchanged. Analysts review information and data in order to identify or find indications of potential threats and abnormal patterns. These processes are very time consuming and ISACs might find a need to hire external experts for the analytical processes. This in turn quickly becomes a financial burden on the ISAC. For these reasons, analysis of information is one of the biggest challenges for information sharing communities. 

Outcome:

• Activity - analysis