In info sharing, trust counts

Agencies are expected to share information about the security vulnerabilities and attacks they’ve endured, but they’re often reluctant to do so. Randy Vickers, associate deputy director of the U.S. Computer Emergency Readiness Team at the Homeland Security Department, said recently that agencies are often reluctant to reveal the information because they think it reflects negatively on them. “Unlike policies and technologies, this is the people part, and it is the most difficult,” Vickers said at a May 22 conference sponsored by (ISC)2. A strong convergence of policies, relationships and information sharing would improve the flow of security data among agencies, which would allow them to do more than just wait for attacks, he said. Building relationships and trust among agencies would also help ensure cybersecurity progress as a new administration takes office, Vickers said. This summer, deadlines for several security policy and technology initiatives will converge to improve agencies’ security environment, including implementation of IPv6, Homeland Security Presidential Directive 12, the Federal Desktop Core Configuration and Trusted Internet Connections initiative, he said. Technologies and policies can make data and systems more robust so agencies can more easily share information, but they can’t produce the trust, Vickers said. That task falls to agency leaders. Agencies experience similar security problems and should talk to one another about how they handle those daily challenges, he said. “We’ve got to exchange the business cards upfront so we’re not waiting until the crisis happens to figure out who I need to talk to,” he said. After agencies start sharing information and giving one another feedback, the trust grows with time and experience, as it does in any relationship, he said. After the election, the president-elect will need to be immediately aware of agencies’ security environments. The Commission on Cybersecurity for the 44th Presidency, made up of 35 private- and public-sector members, plans to produce recommendations to improve security in the next administration, said Jerry Dixon, director of analysis at Team Cymru, a commission member and former director of DHS’ National Cyber Security Division.“All members have worked a lot with cybersecurity in government, so we have an idea of what works and what doesn’t,” he said. The Center for Strategic and International Studies sponsors the commission. The level of activity is increasing, and the commission is on track to complete draft recommendations by the end of summer and send a final report to the president-elect in December, Dixon said.The commission aims to make sure that the new administration continues the momentum for more cybersecurity, said Amit Yoran, chief executive officer at NetWitness and former director of DHS’ National Cyber Security Division. “Otherwise, we’ll spend the administration playing catchup,” he said.Leadership is a critical issue for progressing and creating a security culture, Yoran said. “Unless you have strong, tangible White House backing on the issue, I don’t think other organizations are able to muster the support to make meaningful progress,” he said. The commission has made no decisions on recommendations, Dixon said, but it is discussing issues such as the merits of establishing:Commission workgroups are also looking at spending and acquisition for cybersecurity, public/private partnerships to make systems and infrastructure more secure, and how security components fit together.