A threat report is marked TLP:AMBER. Can you forward it to your customers?

TLP labels look simple, but interviewers use them to test whether you handle shared intelligence responsibly. The usual wrong answers confuse AMBER with either RED or GREEN.

What TLP 2.0 says

The Traffic Light Protocol from FIRST defines how far a recipient may pass information on:

• TLP:CLEAR: may be shared with the world, subject to standard copyright rules.
• TLP:GREEN: may be shared within the community, with peers and partner organizations, but not through publicly accessible channels.
• TLP:AMBER: may be shared on a need-to-know basis within your own organization and with its clients, to protect them or prevent further harm. Clients are included by default.
• TLP:AMBER+STRICT: limited to your own organization; clients are excluded.
• TLP:RED: for named recipients only, with no further disclosure (in a meeting, only those present).

Practical reading

So forwarding an AMBER report to customers who need it for their defense is allowed, while posting it on a blog or sharing it with a peer ISAC member who is not your client is not. If the source added restrictions, you follow them, and any wider sharing needs the source's explicit permission.

Why the distractors are tempting

"Never leaves the organization" describes AMBER+STRICT. "Whole community, public channels" confuses AMBER with GREEN/CLEAR. "Single named individual" is RED.

What interviewers want

The scope of AMBER versus AMBER+STRICT, the need-to-know condition, and the instinct to ask the source before going beyond the label.