Industry must take the lead in forming public-private cybersecurity partnerships, experts say

Collaboration between industry and government works better when there is a foundation of trust and industries lead the way, panelists say.

When it comes to public and private collaboration, it’s time for government to step back and let industry have a turn at the wheel, cybersecurity experts and government officials say.

In a panel discussion titled “Before Things Go Boom: Improving Government and Industry Cooperation Before it’s Too Late” at the New America think tank Friday in Washington, officials from both the private and public sector discussed the need for collaboration in light of the Trump administration’s recent executive order on cybersecurity.

The executive order largely calls on federal agencies and departments to conduct a series of internal, comprehensive reviews of their digital defenses. By collecting a reasonable measure of existing protections, the White House hopes to better allocate funding.

Kiersten Todt, executive director of the Presidential Commission on Enhancing National Cybersecurity, said that thoughtful, industry-driven relationships and engagement prior to major cybersecurity events will lead to the trust necessarily for improved information sharing.

“Government does incident response really well, but we don’t focus enough on what happens before the event, because at that point we haven’t developed those relationships,” Todt said as part of the panel.

The key to greater collaboration is finding the mechanism that allows government to work productively with industry. “Government has failed on this piece up to this point,” Todt said.

Rick Howard, chief security officer of Palo Alto Networks, agreed with what Todt called the “Reagan model” of collaborating. “Here’s what it really means in practicality: Find reasons to get into a room together and drink beer together … because you start to know that person on a one-to-one basis,” Howard said.

Efforts made by National Institute of Standards and Technology have been successful in the past because “we let industry identify where the key issues were and work with government,” Todt said.

The value of government, Todt said, is its knowledge on nation-state actors, ability to provide incentives, and policy. But in order for this to be useful to industry collaborators, the government must clean up its classification system to avoid using over-classification as an “excuse” to protect government information that has not been organized.

David Weinstein, CTO for the State of New Jersey and New America Cybersecurity Fellow, said government often wants to be the driver for public-private partnerships, but it also shrinks away from moving beyond the federal government in cybersecurity issues.

This lack of emphasis on state and local cybersecurity is a “gaping hole” in the recent executive order, Weinstein said.

Both Howard and Todt stressed that collaboration and harmonization of regulations must also extend to the international front. Hackers are no longer teens in basements, Howard explained, “these organizations have vast infrastructure … we just need to start building that coalition.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure