NATO’s Defence Capacity Building Initiative
The Shadowserver Foundation is excited to announce its inclusion in the DSCD Bedrock Pool of Implementing Agents for NATO’s Defence Capacity Building (DCB) Initiative. The DCB Initiative is NATO’s primary mechanism for assisting partners in strengthening their defence capabilities, improving resilience, and building enduring capacities in the defence and security sectors.
Shadowserver joins as one of the over 30 Allied bilateral agencies currently within the Bedrock Pool who implement defence capacity building services to NATO partners. Implementing Agents will provide partners with strategic advice, specialised expertise, education and training, equipment, tools, services, and infrastructure across a range of security sectors, to include cybersecurity. The DCB Initiative helps foster the Alliance’s overall security and promotes regional and international stability.
Shadowserver’s Role
Shadowserver’s cybersecurity capacity building (CCB) services will help NATO partners improve threat / vulnerability detection, enhance cyber situational awareness, gain increased visibility into their attack surface, enable effective incident response, and strengthen cyber resilience within their countries.
As an Implementing Agent, Shadowserver will devise a program tailored to the specific needs and maturity level of the partner using available tools in Shadowserver’s CCB toolkit. The toolkit includes the following components:
- Shadowserver’s free, daily cyber threat intelligence (CTI) data (network reports) for the entirety of the country
- “Shadowserver-in-a-Box” platform using open-source tools (i.e., IntelMQ, Elasticsearch, Kibana) to enable partners to automate the ingesting, processing, visualizing, analyzing, and sharing of voluminous CTI data provided by Shadowserver and other available sources
- Trainings and workshops on topics that include effective use of Shadowserver’s CTI data, attack surface assessments, automation tools, and partnership development
- Data enrichment programs to improve the quality of a partner’s CTI data through device fingerprinting, targeted vulnerability scanning, and the deployment of honeypot sensors to collect and analyze attack data
- Joint analysis of CTI data collected from observed attacks, malware capture, device fingerprinting, critical vulnerabilities in exposed infrastructure, and identifying Known Exploited Vulnerabilities (KEV)
- Threat / vulnerability reduction initiatives to address the partner’s most critical threats and vulnerabilities through collaboration with key stakeholders
- Collaboration, outreach and partnership development with National CSIRTs, Sector CSIRTs, ISACs, ISPs, private sector entities, security researchers, and member organizations such as FIRST.org
- Metrics to track the partner’s progress in identifying and remediating critical threats over time using aggregated country-level statistics available on Shadowserver’s public Dashboard
The CCB programs crafted by Shadowserver will provide partners with: (1) greater visibility into their attack surface to proactively address threats for improved security; and (2) an essential digital pipeline to ingest, process, analyze, and visualize voluminous CTI data, then distribute the data to affected network owners within the country through automated alert notifications.
These alert notifications act as both an Early Warning Service, identifying exposed, misconfigured, and vulnerable devices on a network to be patched before a breach occurs, and a Victim Notification Service, identifying compromised devices on a network to be remediated before further exploitation, such as a ransomware attack, can occur.