TLP
Traffic Light Protocol
Ampel-Protokoll zur Einstufung der Weitergabe
The Traffic Light Protocol is a simple, internationally recognised colour scheme that defines how far shared information may be passed on. With four levels — from „recipients only“ to „unrestricted“ — it creates a common language for the confidential exchange of threat data. It governs not the content but the permitted circle of recipients.
History & facts. The TLP is maintained by Forum of Incident Response and Security Teams (FIRST); the current version TLP 2.0 (2022) has four markings: TLP:RED (only for the recipients present), TLP:AMBER (organisation and clients, optionally limited to one's own organisation as TLP:AMBER+STRICT), TLP:GREEN (community) and TLP:CLEAR (unrestricted, formerly TLP:WHITE (now TLP:CLEAR) (TLP:WHITE)). It is deliberately kept simple so that it is understood and followed everywhere without technical hurdle — from e-mail to exchange platform.
Outlook & recommendation. TLP is the basis of functioning information exchange between organisations, CERTs and in platforms such as MISP — Open Source Threat Intelligence Platform (MISP), where it controls distribution. Its value depends solely on the discipline of those involved — forwarding a TLP:RED piece of information undermines the trust that makes future exchange possible in the first place. Anyone participating in exchange should know the current version, in particular the renaming of WHITE to CLEAR.