Threat-data sharing is a key step in enhancing cybersecurity, but sharing of the data must have a clear purpose for it to be beneficial, speakers said at an Atlantic Council event this afternoon.  Speaking on “Breaking the Cyber Information-Sharing Logjam,” Michael Daniel, special assistant to the president and White House cybersecurity coordinator, said cybersecurity “really is a shared responsibility between the government and the private sector.  There is really no other issue [involving national security] that is shared in this manner.”

“Given the nature of cyberspace and how it functions … that means that we can’t simply assign the responsibility of cybersecurity to the federal government, or any government agency,” Mr. Daniel said.  “This is one that the private sector is always going to have to be involved in , so that means we’re having to chart some new ways of doing business.”  Cybersecurity doesn’t “fall neatly into traditional regulatory or contractual categories,” he added.

“So we’re struggling to figure out what those relationships are going to be.  We are building those relationships right now,” Mr. Daniel said.  “We are defining in the next there to four years how these relationships are going to work for the next 50.”

Mr. Daniel added that “information sharing in and of itself is not the end.  We don’t want to be sharing information just for the sake of sharing information.  We actually want to achieve something with that. The way of “breaking through that logjam” is to “focus on some of the goals we want to achieve,” Mr. Daniel said. For example, one idea that has White House support is the “concept of a cyber weather map,” Mr. Daniel said.  “That necessitates one kind of information sharing.  We should explore what to do to make that real.”

Marc Sachs, vice president-national security policy at Verizon Communications, Inc., agreed.  “Information sharing just for the sake of sharing doesn’t really get us anywhere,” he said.  “Situational awareness is important, but there is strength in sharing between groups that can take action. “It’s important that we focus on what’s actionable as opposed to just tossing it out there,” Mr. Sachs said.

Ari Schwartz, director-cybersecurity, privacy, civil liberties, and policy with the White House’s national security staff, said an executive order signed last week by President Obama makes it easier to get security clearances for non-defense contractors.  “One thing we’ve found is that many of the rules have been written to clear defense contractors,” he said.

The executive order also aims to promote threat data sharing among private parties.  “The EO really focuses on that in a new way by focusing on information sharing standards,” he said. – Brian Hammond, brian.hammond@wolterskluwer.com

Courtesy TRDaily