Information sharing and common taxonomies between CSIRTs and law enforcement

The purpose of this study is to propose a solution for the exchange of information between CSIRTs and Law Enforcement Agencies (LEAs) in the form of a roadmap and a common taxonomy, as well as a mechanism to share information based on this common taxonomy and a model on how to update the taxonomy to new phenomena. This study outlines an initial proposal for: - A common taxonomy that could be used for sharing information between CSIRT and LEA communities. - A mechanism to share information between both communities based on this taxonomy. - A model to update the taxonomy to new phenomena (such as new kind of attacks or a new vulnerability type). - A roadmap for the introduction of the proposed taxonomy to both communities and the implementation of a sharing solution between CSIRTs and LEA communities. In addition, this study outlines: - How this study aligns with the Operational Action Plan (OAP) 4.1 working group8 EMPACT (The European Multidisciplinary Platform against Criminal Threats) Cyber Attacks 2015 to avoid any overlap between both activities.