After an incident, a team documents indicators and observed attacker behavior and wants to share them with peer companies in its industry while controlling how far recipients may redistribute the information. Which approach fits?
Select an answer to reveal the explanation.
Short Explanation
Sharing intel is like passing a note in class — you pick who gets it and you write "don't pass this on" across the top. Vetting the indicators, using your ISAC, and adding a TLP label does exactly that. The trap is mixing in CVE and CVSS; those catalog and score vulnerabilities, not attacker infrastructure.
Full Explanation
The intelligence lifecycle includes authoring, sharing, and consumption. Authoring means turning incident findings into vetted indicators and behavioral descriptions, removing internal or sensitive details, and adding context such as confidence and observed time frame. Sharing with peers in the same sector is typically done through an Information Sharing and Analysis Center, which is a trusted community built for that purpose. Traffic Light Protocol markings tell recipients how widely they may redistribute the information, from TLP:RED for named recipients only through TLP:AMBER and TLP:GREEN to TLP:CLEAR for unrestricted release, which directly meets the requirement to control redistribution. Posting raw indicators publicly removes any control over redistribution and may tip off the attacker or expose internal details. The CVE program assigns identifiers to publicly disclosed vulnerabilities in products; attacker infrastructure and behavior are not vulnerabilities and do not receive CVE identifiers. CVSS scores the severity of vulnerabilities and does not describe threat indicators or govern sharing. Exam caveat: TLP labels are honored by agreement within the community and are not technically enforced. Operational check: review the indicators for internal data, apply a TLP label, publish through the ISAC's platform, and confirm the label appears on the shared objects.