A new white paper advocates for improved information sharing among private sector firms, stressing the need for timely, relevant, and detailed threat information to mitigate cyberattacks, aid in system recovery, and enhance the resilience of commercial networks.
The Intelligence and National Security Alliance (INSA) Cyber Council developed the paper, entitled Challenges and Opportunities of Enabling Information Sharing, as recognition of the shared responsibility of the public and private sectors in defending U.S. cyber infrastructure.
According to the council, the national security and economic prosperity of the United States depend on the public and private sectors’ shared responsibility to defend its cyber infrastructure.
“While Federal cybersecurity policies are rapidly evolving … there is inconsistency in private sector cybersecurity, posing a risk to businesses and critical infrastructure,” the council stated in a release.
“Effective information sharing is crucial for enhancing private sector cybersecurity. The shared threat information must be timely, relevant, and detailed to effectively counter cyberattacks, assist in complete system recovery, and fortify commercial networks against future breaches,” the paper reads.
The paper offers five recommendations for private sector firms to improve information sharing:
- Collaborate with internal stakeholders;
- Improve understanding of partner priorities, collection requirements, and how recipients can act on information;
- Leverage established information sharing entities to anonymize information/intelligence sources;
- Ensure safeguards are in place; and
- Promote bi-directional sharing.
“Implementing these measures will strengthen the security stance of the nation’s cyber infrastructure, leading to a more resilient and robust collective defense,” the council said, adding that these measures provide a useful framework for firms grappling with the challenges of determining what information to share and establishing a consistent sharing process.
According to the council, through collaboration, stakeholders within an organization can establish rapport and regular touch points with relevant teams; educate the workforce on information sharing processes, partners, and safeguards in place; create an information sharing playbook and related procedures customized for each team; and conduct recurring tabletop exercises and involve all key stakeholders.
“A better understanding of the benefits of information sharing and how it can be conducted effectively will improve collaboration among both public and private sector stakeholders,” the paper says.
In addition, the council highlights that the recommendations laid out in the paper are adjustable to fit the specific needs of any organization due to their broad language. To improve cyber information sharing in the private sector “a one-size-fits-all solution to information sharing is less effective and inherently less secure than adopting a more tailored methodology that meets each stakeholder where they operate along a given value chain.”
