CISA’s AI cyber collaboration playbook aims to spur information

The Joint Cyber Defense Collaborative product seeks to build “a unified approach” to combat AI-related cyber threats.

The Cybersecurity and Infrastructure Security Agency is making one last push before the change in administration for increased information sharing between the public and private sectors, releasing an artificial intelligence-focused playbook Tuesday that aims to foster “a unified approach” to handling AI-related cyber threats.

The agency’s AI Cybersecurity Collaboration Playbook was developed with the FBI, the NSA’s Artificial Intelligence Security Center and a host of industry partners, including Anthropic, AWS, Google, IBM, Microsoft, NVIDIA, OpenAI, Palo Alto Networks, Scale AI and others.

The publication of the playbook, which was facilitated through the public-private Joint Cyber Defense Collaborative, comes less than a week before President-elect Donald Trump retakes the White House and as the Biden administration nears the release of a final cybersecurity executive order.

The overarching goal of the new playbook, CISA said, is to facilitate collaboration among federal agencies, industry, international partners and other stakeholders on AI-fueled risks to cybersecurity, while also bolstering the resilience of AI systems.

“The playbook also identifies actionable information sharing categories applicable to broader critical infrastructure stakeholders and other sharing mechanisms,” the agency said in a statement. “CISA encourages organizations to adopt the playbook’s guidance to enhance their own information-sharing practices, contributing to a unified approach to AI-related cybersecurity threats across critical infrastructure.”

Some of those “actionable” information-sharing items detailed in the playbook include instructions for reporting newly identified cybersecurity vulnerabilities in products and services and a checklist for “proactive” sharing regarding an incident or vulnerability. 

JCDC partners are provided in the playbook with CISA’s methods for information collection via its central hub. For information submitted to that hub, CISA said it aggregates and validates the intel, analyzes and enriches the data, and then ultimately decides whether defensive action should be taken. 

For AI security specialists specifically, CISA asks industry partners to flag opportunities for technical exchanges, identify priority issues for the AI community, promote after-the-fact analyses and knowledge-sharing, and join the JCDC.

CISA said several AI safety topics — such as risks to human life, health, property or the environment — are outside the purview of the playbook, as are issues tied to AI fairness and ethics. No policies or requirements are being instituted as part of the playbook’s rollout; the agency noted that “all actions” called out in the periodically updated document are voluntary.

In addition to the White House’s impending cybersecurity executive order, President Joe Biden has used the last few days of his time in office to release two other AI-centered documents: an EO intended to advance AI infrastructure in the United States, and a so-called AI diffusion rule via the Commerce Department that places export controls on AI models and chips.

100-plus companies call for ‘global surge’ in AI-powered cyber defense

OpenAI, Anthropic, Google, Microsoft, and others say there’s a narrow “defenders’ window” to strengthen security before AI-powered attacks become more sophisticated.

AI-fueled attacks pose ‘active threat’ to water, other sectors, U.S. agencies warn

U.S., South Korean government agencies caution to be on lookout for Gunra ransomware gang

Government

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure