Cyber companies urged to share — and not sell — threat info

DHS wants cyber companies to give their threat intelligence away as widely as possible. Surprisingly, many cybersecurity companies seem to agree.

Companies that manage and distribute threat intelligence need to stop thinking of their curated feeds as a competitive advantage and instead share them as widely as possible, officials and executives from the power and telecoms sector urged last week.

“The information that can help everybody … better defend their networks is important to everybody, so it shouldn’t be a competitive advantage, it should be part of what we regularly share,”  senior Department of Homeland Security official John Felker told the Intelligence and National Security Summit last week. “When you do that, we all get better at it [cyberdefense].”

DHS runs several programs that provide free threat intelligence to the private sector, noted former Homeland Security Undersecretary Suzanne Spaulding. Additionally, Congress passed a cyberthreat sharing law in December 2015, creating liability protections and other legal safe harbors for companies that shared information with DHS.

AT&T Vice President of Global Public Policy Chris Boyer noted that the cutting edge of the new information-sharing paradigm had shifted and was now in neither the government-to-private-sector, nor the private-sector-to-government channels.

“There’s a lot of activity going on in private-to-private [information] exchange,” Boyer said.

He told the discussion Spaulding moderated that the telecom backbone providers were focused on finding new ways of spotting malicious behavior in real time, as it is traveling across the global network, but before he reaches its destination and wreaks havoc.

“What we focus on is data that’s traversing the network and looking for anomalies, looking for threats,” Boyer said, adding that About 167 petabytes of data goes across AT&T networks every day.

“There’s a lot of collaboration going on in the industry … in fact that’s probably where the a lot of the best intelligence is gathered just by working with our peers in industry,” Boyer added.

Part of the reason for that is the virtuous cycle that intelligence sharing within a trusted group creates.

“As you add those [shared intel feeds] together, voluntary shares increase,” said Fred Hintermister, who runs the Electricity Information Sharing and Analysis Center.

He told the session that cybersecurity companies needed to focus on adding value by selling what they could do with the feed, not the feed itself.

“You’re going from a roadside motel to a destination resort,” he said of the transformation.

Tom Gann, chief policy officer for McAfee told CyberScoop the industry was broadly committed to sharing and many large companies were working together in the Cyber Threat Alliance.

“It is impossible for a single organization to have a clear view of all the potential threats, vulnerabilities and attacks across the globally connected environment,” he noted.

The alliance brings together major companies like Check Point Software, Cisco Systems, Fortinet, McAfee, Palo Alto Networks, Rapid7, RSA Security, SK Infosec and Symantec.

According to the CTA website, the companies “have chosen to work together in good faith to share threat information [to bolster] defenses against advanced cyber adversaries across member organizations and their customers.”

Information sharing, Gann explained “gets more threat data on a rapid basis to customers over the short run,” and working on the process of sharing, especially the technical details, “helps cybersecurity companies further optimize their solutions … over the long run.

“It’s a win-win,” he concluded.

Sen. Peters tries another approach to extend expired cyber threat information-sharing law

A new bill renames the Cybersecurity Information Sharing Act of 2015 and would make its legal protections retroactive after its lapse.

Amazon, CrowdStrike, Google and Palo Alto Networks claim no change to threat intel sharing under Trump

Exclusive: Peters, Rounds tee up bill to renew expiring cyber threat information sharing law

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure