Guidelines for voluntary info sharing groups released

New guidelines for information sharing and analysis organizations highlight the need for these institutions to have plans in place to fund themselves, but offer little advice about how to generate revenue.

New guidelines for information sharing and analysis organizations highlight the need for these institutions to have plans in place to fund themselves, but offer little advice about how to generate revenue.

The guidelines were published Friday by the ISAO Standards Organization, led by the University of Texas—Austin. They’re the result of “collaboration by more than 160 experts from industry, government, and academia, combined with the input and feedback of the public,” according to the organization’s Executive Director Greg White.

In a blog post, Deputy Director Rick Lipsey calls the guidelines a “critical milestone” in the Obama administration’s push to extend cyberthreat information-sharing beyond the 1990’s-era machinery for a limited number of vital national industries and into the private sector economy as a whole.

“ISAOs are structured to adopt this concept of collaborative cybersecurity and scale it beyond critical infrastructure sectors to meet the needs of any community of interest: private or public, large or small, geographic or sector-based,” Lipsey wrote.

The push for ISAOs started after the high-profile hack of Sony Pictures Entertainment in 2014. Officials realized that although the attack — as an attempt to stop the release of a movie making fun of North Korean dictator Kim Jong-Un — struck at what President Obama called “core American values,” there was no mechanism by which the company might have shared or received information about the attack’s methodology.

A few months later, the president signed  Executive Order 13691 — Promoting Private Sector Cybersecurity Information Sharing — kicking off the push to build ISAOs.

Long-standing questions remain about the viability of the cyberthreat “information sharing ecosystem” that ISAO boosters hope to establish.

The Guidelines for Establishing an ISAO suggest that founders consider whether an informal structure might be best to start with.

“It is important to recognize that the vision, goals, and membership of the ISAO may change considerably over time, which may support consideration of starting … with a smaller, less formal organization and making changes to the governance structure as the ISAO evolves and matures.”

But should the ISAO want to collect fees or enter into contracts, the guidelines say a more formal structure might be appropriate — and counsel that founders might want to seek legal advice. “The ISAO and its stakeholders should consider consulting legal counsel to assist in choosing the most appropriate type of legal structure … Decisions on governance structures such as incorporation, boards, and not-for-profit status require knowledge of local, state, and federal laws.”

The guidelines also discuss the need to “demonstrate membership return on investment,” and to “carefully evaluate their assets, expenditures and revenue.”

“Today’s publications provide the cornerstones to build out an information sharing ecosystem at unprecedented scale,” said Lipsey, “However, they are just the beginning … We anticipate updating and expanding these guidelines based on feedback from their implementation.”

Last week, the Standards Organization launched two other initiatives on isao.org to support the growth of a cyberthreat ecosystem. The National Registry of ISAOs aims to get the organizations to list themselves for fellow ISAOs and members of the public; and the Resource Library is an online repository for a curated set of relevant documents and other resources.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure