Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

3/11/2019
05:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

NSA, DHS Call for Info Sharing Across Public and Private Sectors

Industry leaders debate how government and businesses can work together on key cybersecurity issues.

If money were no object, and you didn't have to worry about bureaucracy or politics, what would you have your organization do to make a difference in the public-private sector discourse on cybersecurity? How would you improve tactics and techniques?

"The thing I'd love to be able to do is share in real time," said Neal Ziring, technical director for the National Security Agency's Capabilities Directorate. The question was posed to him, and two other panelists from the public and private sectors, in the RSA Conference panel "Behind the Headlines: A Public-Private Discourse on Cyber-Defense," last week in San Francisco.

Ziring explained how if policy were not an issue, he would want to take NSA's foreign intelligence and turn it into actionable warnings in real time. "That's not easy. We're trying to work in that direction," he said, adding that there are "considerable policy obstacles to that right now."

Defenders are overwhelmed with an onslaught of threat data, user error, poor endpoint protection tools, and myriad other factors making their jobs harder. This discussion brought together security experts to put the spotlight on which threats should be prioritized and how the government and private sector can better improve their relationships to address them.

John Felker, director of the DHS's National Cybersecurity & Communication Integration Center (NCCIC), outlined the security threats that are top-of-mind for government. China, he said, is a big one: It continues to engage in cyber espionage despite a 2015 agreement to stop. Industrial theft is a primary concern as China's long-term strategy is to improve its economy, he said.

"We've seen lots and lots of threats from Iran," Felker continued. Iran is now heavily focusing on oil and gas, primarily in the Middle East. "We believe they're posturing for future activity."

Next up: Russia. "Part of the Russia threat relates to keeping their economy strong and the things they want to participate in to allow their form of government to continue," he explained. There is "significant potential for mischief" as there remains a possibility Russia will segregate itself from the Internet as a threat. Finally, Felker pointed to North Korea, which is primarily financially motivated and needs funds to develop domestic IT infrastructure and industry.

A Call for Info Sharing
Information sharing was a key theme of the talk, and all panelists emphasized a greater need for the public and private sectors to share threat intelligence. "It doesn't do us any good to exchange business cards in the middle of a cyber incident," Felker said. He encourages organizations to reach out if they're hit. "Make sure someone knows it's OK to do that," he added.

While the NSA doesn't have the public facing role the DHS does, Ziring noted the organization does interact with the public and business communities. His advice: "If we go to the trouble to publish advice, take it," he said. "We don't publish all that frequently, and when we do there are really good reasons behind it."

He also advised businesses to collaborate with the NSA on a technical level. "The goal we're trying to achieve is shared visibility into the cyberspace where we all have to operate," Ziring continued. Threat actors have visibility over all of us; it would help businesses to do the same.

Security teams need to establish trust before an attack takes place. Part of building relationships involves conducting internal and external exercises across the organization so senior leadership knows what's happening and what to do. If you implement a security framework, blog about it, said Curtis Dukes, executive vice president and general manager for the Security Best Practices and Automation Group at the Center for Internet Security.

"You are a target – it's not if but when you're attacked," Dukes explained. "Communicate 'here's what happened and why.' That way, we all learn from your misfortune, but more importantly we can protect ourselves."

Modern C-suites are more aware of cybersecurity and the effect it can have on a business, he added. Major incidents have taught them how poor security can affect a bottom line, and now they're asking for board members who have cybersecurity expertise.

However, "where we're falling short is we still haven't done an adequate job of translating cyber-risk to business risk," he added. Businesses will place high value on certain business processes but fail to recognize the impact of losing that process in a cyberattack.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19642
PUBLISHED: 2019-12-08
On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or ShareNa...
CVE-2019-19637
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_decode_raw_impl at fromsixel.c.
CVE-2019-19638
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function load_pnm at frompnm.c, due to an integer overflow.
CVE-2019-19635
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function sixel_decode_raw_impl at fromsixel.c.
CVE-2019-19636
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_encode_body at tosixel.c.