Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

3/11/2019
05:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

NSA, DHS Call for Info Sharing Across Public and Private Sectors

Industry leaders debate how government and businesses can work together on key cybersecurity issues.

If money were no object, and you didn't have to worry about bureaucracy or politics, what would you have your organization do to make a difference in the public-private sector discourse on cybersecurity? How would you improve tactics and techniques?

"The thing I'd love to be able to do is share in real time," said Neal Ziring, technical director for the National Security Agency's Capabilities Directorate. The question was posed to him, and two other panelists from the public and private sectors, in the RSA Conference panel "Behind the Headlines: A Public-Private Discourse on Cyber-Defense," last week in San Francisco.

Ziring explained how if policy were not an issue, he would want to take NSA's foreign intelligence and turn it into actionable warnings in real time. "That's not easy. We're trying to work in that direction," he said, adding that there are "considerable policy obstacles to that right now."

Defenders are overwhelmed with an onslaught of threat data, user error, poor endpoint protection tools, and myriad other factors making their jobs harder. This discussion brought together security experts to put the spotlight on which threats should be prioritized and how the government and private sector can better improve their relationships to address them.

John Felker, director of the DHS's National Cybersecurity & Communication Integration Center (NCCIC), outlined the security threats that are top-of-mind for government. China, he said, is a big one: It continues to engage in cyber espionage despite a 2015 agreement to stop. Industrial theft is a primary concern as China's long-term strategy is to improve its economy, he said.

"We've seen lots and lots of threats from Iran," Felker continued. Iran is now heavily focusing on oil and gas, primarily in the Middle East. "We believe they're posturing for future activity."

Next up: Russia. "Part of the Russia threat relates to keeping their economy strong and the things they want to participate in to allow their form of government to continue," he explained. There is "significant potential for mischief" as there remains a possibility Russia will segregate itself from the Internet as a threat. Finally, Felker pointed to North Korea, which is primarily financially motivated and needs funds to develop domestic IT infrastructure and industry.

A Call for Info Sharing
Information sharing was a key theme of the talk, and all panelists emphasized a greater need for the public and private sectors to share threat intelligence. "It doesn't do us any good to exchange business cards in the middle of a cyber incident," Felker said. He encourages organizations to reach out if they're hit. "Make sure someone knows it's OK to do that," he added.

While the NSA doesn't have the public facing role the DHS does, Ziring noted the organization does interact with the public and business communities. His advice: "If we go to the trouble to publish advice, take it," he said. "We don't publish all that frequently, and when we do there are really good reasons behind it."

He also advised businesses to collaborate with the NSA on a technical level. "The goal we're trying to achieve is shared visibility into the cyberspace where we all have to operate," Ziring continued. Threat actors have visibility over all of us; it would help businesses to do the same.

Security teams need to establish trust before an attack takes place. Part of building relationships involves conducting internal and external exercises across the organization so senior leadership knows what's happening and what to do. If you implement a security framework, blog about it, said Curtis Dukes, executive vice president and general manager for the Security Best Practices and Automation Group at the Center for Internet Security.

"You are a target – it's not if but when you're attacked," Dukes explained. "Communicate 'here's what happened and why.' That way, we all learn from your misfortune, but more importantly we can protect ourselves."

Modern C-suites are more aware of cybersecurity and the effect it can have on a business, he added. Major incidents have taught them how poor security can affect a bottom line, and now they're asking for board members who have cybersecurity expertise.

However, "where we're falling short is we still haven't done an adequate job of translating cyber-risk to business risk," he added. Businesses will place high value on certain business processes but fail to recognize the impact of losing that process in a cyberattack.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
For Cybersecurity to Be Proactive, Terrains Must Be Mapped
Craig Harber, Chief Technology Officer at Fidelis Cybersecurity,  10/8/2019
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-10759
PUBLISHED: 2019-10-15
safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
CVE-2019-10760
PUBLISHED: 2019-10-15
safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
CVE-2019-17397
PUBLISHED: 2019-10-15
In the DoorDash application through 11.5.2 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat.
CVE-2019-12944
PUBLISHED: 2019-10-15
Glue Smart Lock 2.7.8 devices do not properly block guest access in certain situations where the network connection is unavailable.
CVE-2019-17195
PUBLISHED: 2019-10-15
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.