After We Have Threat Information Sharing Legislation, Then What?
Much to their credit, Congress and the president are on the verge of passing and enacting legislation that will facilitate improved sharing of cyberthreat information between government and industry. The question becomes … what is next?
The pending and proposed cybersecurity legislation to improve bidirectional information sharing between government and industry is an important and necessary step, but some policy makers may believe that information sharing legislation alone is sufficient to address the evolving cybersecurity challenge. Accordingly, it is imperative that Congress, the administration and the stakeholder community understand there is more work to be done and commit to continuing to push forward to help make our nation safer and more secure.
Collectively, we must continue to work toward a true joint, integrated, public-private operational capability for cybersecurity through information sharing, analysis and collaboration. Such an effort should produce timely, reliable and actionable situational awareness that will improve detection, prevention, mitigation and response to cyber events that could become incidents of national or even global consequence. Maturing our analytic capability to identify patterns and trends of abnormal, anomalous or even malicious behavior that could prompt alerts, warnings and even recommended protective measures to a wide range of stakeholders across government, industry, academia and digital users of all sizes and sophistication will improve our ability to reduce cyber risk and enhance our nation’s cybersecurity protection profile.
There are models from which we can learn. For example, by utilizing technology, established information sharing mechanisms and enhanced analytic capabilities, we have become more successful in predicting pending weather events through a robust capability developed at the National Weather Service. This progress allows timely, reliable and actionable early warnings and recommended protective measures that have proved to enhance detection, prevention, mitigation and response to significant weather events. The result is less property damage, reduced injury and even prevention of loss of life.
Similarly, we have matured a national capability at the Centers for Disease Control and Prevention to gather, correlate and analyze health information in a timely, reliable and actionable manner to identify patterns and trends of health-related events that could trigger increased attention. This capability has enhanced our ability to issue alerts and warnings and to recommend protective measures to communities and health centers around the country to contain events that may have local, regional and even national consequence.
Both of these examples also engender trust—an ingredient that requires much work in our current cybersecurity processes to achieve. Another key element of this effort is to facilitate continued advances in the automated exchange of cyberthreat indicators while ensuring protections for privacy and civil liberties in support of an around-the-clock operational capability.
A coordinated operational capability for cybersecurity is essential to our national and economic security. In recent years we have taken important steps in that direction. We can mature this necessary national capability with continued collaboration across the stakeholder community and with the support of Congress; the administration; federal, state, local, tribal and territorial governments; small, medium and large businesses; academia; and other organizations.
Much progress has been and is being made. But, much work remains for our nation to be more cyber secure.
Robert B. Dix Jr., is vice president, global government affairs and public policy for Juniper Networks.
