Encryption of community-based security information

1. A method comprising:

identifying a first set of community attributes to be used to generate a first community on a security information sharing platform that enables sharing of security information among a plurality of communities;

obtaining a first security indicator from a first user of the first community, the first user associated with a first set of user attributes that satisfy the first set of community attributes, wherein each user attribute in the first set of user attributes corresponds to a private key;

obtaining first information related to the first security indicator from a second user of the first community;

including the first security indicator and the first information in community-based security information of the first community;

encrypting at least a portion of the community-based security information with a first encryption key to provide an encrypted portion;

generating a first decryption key using the private key corresponding to each user attribute in the first set of user attributes; and

authorizing a third user to access the encrypted portion of the community-based security information using the first decryption key, the third user associated with the first set of user attributes.

2. The method of claim 1 , wherein the first set of user attributes comprises a first user attribute and a second user attribute, the first user attribute corresponds to a first private key, and the second user attribute corresponds to a second private key.

3. The method of claim 2 , comprising:

generating the first decryption key using the first private key and the second private key.

4. The method of claim 1 , wherein the first security indicator comprises at least one of: an observable including an Internet Protocol (IP) address, a domain name, an e-mail address, a Uniform Resource Locator (URL), or a software file hash.

5. The method of claim 1 , wherein the first information comprises at least one of: an investigation result that is provided by the second user for the first security indicator, an indicator score for the first security indicator, a source for the first security indicator, or a threat actor for the first security indicator.

6. The method of claim 1 , wherein a fourth user is associated with a second set of user attributes that do not satisfy the first set of community attributes, the method further comprising:

preventing the fourth user from accessing the encrypted portion.

7. The method of claim 1 , comprising:

identifying a second set of community attributes to be used to generate a second community on the security information sharing platform;

obtaining a second security indicator from the first user, the first user associated with a second set of user attributes that satisfy the second set of community attributes, wherein each user attribute in the second set of user attributes corresponds to a private key;

obtaining third information related to the second security indicator from a fourth user of the second community;

including the second security indicator and the third information in second community-based security information of the second community;

encrypting at least a portion of the second community-based security information with a second encryption key;

generating a second decryption key using the private keys corresponding to the second set of user attributes; and

authorizing a fifth user to access the encrypted portion of the second community-based security information using the second decryption key, wherein the fifth user is associated with the second set of user attributes.

8. A non-transitory machine-readable storage medium storing instructions that, when executed by a processor of a computing device, cause the processor to:

obtain a data item that is originated from a source entity;

identify a security requirement that defines at least one user that is authorized to access the data item, the security requirement comprising a set of user attributes that describe a plurality of users to be authorized to access the data item;

determine an encryption mechanism to be used to encrypt the data item based on the security requirement to provide an encrypted data item;

generate a first community on a security information sharing platform that enables sharing of security information among a plurality of communities, wherein the community comprises the plurality of users; and

authorize the plurality of users to access the encrypted data item using a decryption key that comprises a private key corresponding to each user attribute of the set of user attributes.

9. The non-transitory machine-readable storage medium of claim 8 , wherein the instructions, when executed by the processor, further cause the processor to:

obtain a security indicator from a first user of the plurality of users;

obtain second information related to the security indicator from a second user of the plurality of users;

encrypt the security indicator and the second information using the encryption mechanism; and

authorize a third user of the first community to access the security indicator and the second information using the decryption key.

10. The non-transitory machine-readable storage medium of claim 8 , wherein the security requirement comprises an identification of a given user of the plurality of users, or an identification of a pre-defined group of users of the plurality of users.

11. The non-transitory machine-readable storage medium of claim 8 , wherein the instructions, when executed by the processor, further cause the processor to:

extract the security requirement from at least one of: the data item and a user profile of the source entity.

12. The non-transitory machine-readable storage medium of claim 8 , wherein the instructions, when executed by the processor, further cause the processor to:

identify a set of security key management capabilities that are available for the data item; and

determine the encryption mechanism to be used to encrypt the data item based on the security requirement and the set of security key management capabilities.

13. The non-transitory machine-readable storage medium of claim 8 , wherein the set of user attributes comprise an attribute related to at least one of: an industry sector of the plurality of users, a geographical region of the plurality of users, an organization that the plurality of users belong to, a user reputation of the plurality of users, a citizenship status of the plurality of users, an environmental condition, an indication of whether the plurality of users represents a threat intelligence feed vendor, a security clearance level of the plurality of users, or a user status of the plurality of users.

14. A system comprising:

a processor that:

identifies a set of community attributes to be used to generate a community on a security information sharing platform that enables sharing of security information among a plurality of communities;

obtains a security indicator from a first user of the community, the first user associated with a first set of user attributes that satisfy the set of community attributes, wherein each user attribute in the first set of user attributes corresponds to a private key;

obtains first information related to the security indicator from a second user of the community;

includes the security indicator and the first information in community-based security information of the community;

encrypts at least a portion of the community-based security information to provide an encrypted portion; and

prevents a third user from accessing the encrypted portion of the community-based security information of the community, wherein the third user is associated with a second set of user attributes that do not satisfy the set of community attributes.

15. The system of claim 14 , wherein the processor:

provides, to a fourth user associated with the first set of user attributes, a decryption key that is generated based on private keys corresponding to the first set of user attributes; and

authorizes the fourth user to access the encrypted portion using the decryption key.

16. The system of claim 15 , wherein the first set of user attributes comprises a first user attribute and a second user attribute, the first user attribute corresponds to a first private key, and the second user attribute corresponds to a second private key.

17. The system of claim 16 , wherein the processor:

generates the decryption key using the first private key and the second private key.

18. The system of claim 14 , wherein the security indicator comprises at least one of: an observable including an Internet Protocol (IP) address, a domain name, an e-mail address, a Uniform Resource Locator (URL), or a software file hash.

19. The system of claim 14 , wherein the first information comprises at least one of: an investigation result that is provided by the second user for the security indicator, an indicator score for the security indicator, a source for the security indicator, or a threat actor for the security indicator.

20. The system of claim 14 , wherein the processor:

identifies a second set of community attributes to be used to generate a second community on the security information sharing platform;

obtains a second security indicator from the first user, the first user associated with a second set of user attributes that satisfy the second set of community attributes, wherein each user attribute in the second set of user attributes corresponds to a private key;

obtains third information related to the second security indicator from a fourth user of the second community;

includes the second security indicator and the third information in second community-based security information of the second community;

encrypts at least a portion of the second community-based security information with a second encryption key;

generates a second decryption key using the private keys corresponding to the second set of user attributes; and

authorizes a fifth user to access the encrypted portion of the second community-based security information using the second decryption key, wherein the fifth user is associated with the second set of user attributes.