Capabilities and Use of Cortex as part of the DYNAMO project

Abstract

According to the 2022 Cyber Threat Report from SonicWall, the volume of ransomware attacks in 2021 grew by 105% from 2020 and was multiplied by three compared to 2019. This alarming signal demonstrates the need for more cybersecurity resilience and business continuity planning for companies worldwide. The greatest challenges are for those companies operating in critical sectors such as energy, healthcare, or maritime transportation for which cyber-attacks can have disastrous implications. The DYNAMO project was created to address this issue. A specific task of the project, with Laurea University of Applied Sciences as lead, involves the development of a module allowing the storing and sharing of threat information within the community of DYNAMO participants in an environment that is trustworthy.

My work consists in shedding light on the open-source tool Cortex chosen for developing the module by listing the capabilities of Cortex and replacing them in the context of the Computer Security Incident Response framework and by demonstrating the use of Cortex through the creation of a test environment. Meeting these objectives will allow the project to ensure that they make the best use of Cortex and that expectations related to Cortex in the development of the module are met.