Lessons From Using The I-Corps Methodology To Understand .

Lessons from Using the I-Corps Methodology toUnderstand Cyber Threat Intelligence SharingJosiah Dykstra, Matt Fante, Paul Donahue,Dawn Varva, Linda Wilk, Amanda JohnsonU.S. Department of DefenseAbstractCybersecurity researchers and practitioners continually propose products and services to secure and protect against cyberthreats. Even when backed by solid cybersecurity science,these offerings are sometimes misaligned with customers’practical needs. The Innovation Corps (I-Corps) methodology attempts to help innovators, researchers, and practitionersmaximize their success through deliberate customer discovery.The National Security Agency (NSA) has adopted I-Corpsfor internal innovation and optimization. In February 2019,NSA Cybersecurity Operations embarked on a study usingthis methodology to explore cyber threat intelligence sharing.Information sharing is a foundational practice in cybersecurity. The NSA also shares cyber indicators with authorizedpartners, and sought to understand how partners consumedand valued the information to better tailor it to their needs.After 60 customer discovery problem interviews with over20 partners, six primary themes emerged. We describe ourexperiences using the I-Corps methodology to study and optimize internal processes, and lessons learned from applying itto information sharing. These insights may inform future applications of I-Corps to other areas of cybersecurity research,practice, and commercialization.1IntroductionCyber attackers pursue many targets using the same tools,techniques, and infrastructure. As a result, community andcommercial sharing of threat intelligence and indicators hasbecome commonplace. Gartner defines threat intelligence as“evidence-based knowledge, including context, mechanisms,indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be usedto inform decisions regarding the subject’s response to thatmenace or hazard” [17]. For cyber threats, threat intelligenceincludes suspicious or known-bad email addresses, URLs, IPaddresses, malware signatures, and behavior.There are numerous well-known challenges with sharing cyber threat intelligence (CTI) [15]. These challengesrange from protecting privacy, proprietary, or classified information [12] to interoperability and technical exchangeformats [14]. Some CTI requires human intervention to avoidbusiness disruption, increasing the cost to deployment andprotection. CTI feeds are notoriously large and noisy [6]. Oneunder-studied problem is discerning the value of shared intelligence. The consumers of CTI rarely provide feedbackto the provider about the utility of an individual indicator.Consumers may also have difficulty assessing the securityoutcomes and value of shared CTI from a threat feed thatcould cost 150,000 per year [16].Other research has primarily explored technical productionaspects of CTI sharing. One study interviewing ten expertsfound that the primary factors affecting shared CTI related tolimitations with integrating and consolidating CTI from different sources while also ensuring the data’s usefulness [20]. Asfuture research, the researchers suggested investigating threatintelligence use and impact. Many studies have identifiedquality issues as a barrier to effective CTI sharing, includingrelevance, timeliness, accuracy, comparability, coherence, andclarity [23]. The corollary is that consumer value and feedback are rarely captured. Platforms for sharing and managingthreat feeds have continued to evolve, and some have suggested that the problem is shifting from creating such systemsto generating value from the information [9].The United States government has a role in sharing CTI.The Cybersecurity Information Sharing Act of 2015 (CISA)requires various federal government departments and agencies to develop procedures which promote voluntary sharingof CTI with federal and non-federal entities [1]. Among theexamples given in CISA are the Department of HomelandSecurity (DHS) Automated Indicator Sharing (AIS) initiative [11] and Department of Energy’s Cybersecurity RiskInformation Sharing Program (CRISP) [10]. The NationalSecurity Agency (NSA) is authorized to share classified andunclassified cyber threat intelligence with authorized partnerswho defend their own networks and who may also share withtheir customers. The NSA shares with both First Party U.S.government partners such as DHS [18] and Second Party intel-

ligence community partners (Australia, Canada, New Zealand,and United Kingdom) [5]. One important consideration forNSA’s sharing is the equity decision between cyber defenseand protecting sensitive sources and methods [22].In February 2019, leadership in NSA Cybersecurity Operations commissioned a team to use I-Corps and exploreexisting CTI sharing by the NSA and propose changes if necessary. This work describes the methodology and key findingsfrom customers who receive CTI from the NSA. The paperis organized as follows. In Section 2, we present the I-Corpsmethodology. In Section 3, we describe how the NSA usedI-Corps to study CTI sharing and the results from the study.Section 4 presents lessons learned from our experience forthose wishing to consider our approach. Section 5 containsour conclusions.In this section we introduce I-Corps and provide an overviewof the customer discovery process.developing “Hacking for Defense” and adapted portions ofLean LaunchPad to focus on a mission rather than profit [8].This adaptation included replacement of the Business ModelCanvas with a Mission Model Canvas that is suited to userswho aim to create value for beneficiaries (such as warfighters) rather than earn money. The DoD has also adopted ICorps to accelerate the transition and commercialization ofDoD-funded research [4]. The DoD solicits applications fromcurrent and recent DoD awardees on basic research topics toreceive mentoring and funding to accelerate the transition andcommercialization of the funded research.The NSA adopted I-Corps in 2015 as one approach to innovation in a similar but distinct way from NSF and the DoD’suses [19]. A full-time team of NSA I-Corps staff train andcoach internal project teams not toward commercialization,but for increased speed of deployment and impact to NSAmissions. The goal is to help innovators and existing projectowners to optimize their offerings for internal and externalconsumers. The NSA also used the I-Corps process for itsUnfetter [2] and WALKOFF [3] projects.2.12.22Study MethodologyI-CorpsInnovation Corps (I-Corps) is a methodology developedby the National Science Foundation (NSF) based on SteveBlank’s Lean LaunchPad course [13]. Lean LaunchPad is anapproach to lean startup, a methodology for refining startupbusinesses and products through experimentation and rapid,iterative product design. Lean startup is sometimes comparedwith design thinking, a related approach to innovation. A keydifference between these methodologies is where the productis introduced in the innovation cycle. In design thinking, theapproach is to first establish the need for a product or service.The lean startup approach is to begin with a viable product,and make small, fast incremental changes to evolve the designusing feedback from users.Lean LaunchPad is based on the scientific method and hasthree parts: 1) the Business Model Canvas [21], to framehypotheses; 2) Customer Discovery, to test those hypothesesin front of customers; and 3) agile engineering, for rapid andcollaborative product development. Customer discovery isthe portion described in this paper. Lean LaunchPad is nowtaught at over 50 universities across the U.S., and I-Corps isoffered in 88 universities.For NSF, I-Corps guides academics to transfer their research into successful commercialization through a disciplined process of customer discovery and experimentation.The basic premise of I-Corps is that entrepreneurs will bemore successful if they align their products and services tocustomers’ actual problems. These insights come from interviewing a range of potential customers.Blank’s original methodology designed for startup companies has been modified for other ends. In 2016, Blank and theU.S. Department of Defense (DoD) recognized this need inCustomer DiscoveryI-Corps is predicated upon solution providers effectively understanding the practical problems of potential customersthrough semi-structured interviews. The methodology espouses that the customer discovery must be done by solutionproviders themselves and that direct learning cannot be outsourced to other investigators. Customer discovery is not afocus group, but allows a solution provider to validate theirhypotheses about who their customers are and what actually matters to them. The primary output of this process iscustomer insights to help the team determine if iteration orpivoting (substantially changing their proposal) would lead tocustomer adoption. There are three stages to customer discovery described below: pre-planning, interviews, and analysisand insight.Pre-planning. The first stage of preparing to engage withcustomers is pre-planning. The team begins by stating theassumed problem and value proposition of the innovationthey wish to develop or improve for customers. Group brainstorming is used to define problems with specificity. Similarto the scientific method, the team must define hypotheses andassumptions about customer problems, processes, and needs.The team develops a series of open-ended questions to frameinterviews with customers. Teams are given an ambitious goalto interview 100 individuals during the next stage, though theexact number is not prescribed. This number is intended todrive the team toward a full understanding of the field of customers and be able to correctly define one or more customerarchetypes. In cybersecurity, these subjects may include endusers, managers, and security professionals, depending on theproblem being solved. This stage should last a few days.Interviews. The second stage is customer interviews. This