Private Sector Seeks Better Cybersecurity Collaboration

Banking, telecom, and utility execs told Congress Friday that better processes need to be put in place to share information on cyber attacks more quickly, more simply, and more thoroughly.

(click image for larger view)
Slideshow: Inside DHS Classified Cyber-Coordination Headquarters
Private sector representatives Friday urged the government to do more to bolster cybersecurity-related information sharing and collaboration between federal agencies like the Department of Homeland Security and companies that own and operate critical infrastructure.
The federal government, mostly under the auspices of the Department of Homeland Security, over the last few years has increased efforts to protect private sector critical infrastructure from hackers. But representatives from AT&T, the North American Electric Reliability Corporation, and a consortium of financial services companies said in testimony before the House committee on homeland security that its still not enough.
Theres a strong need to develop appropriate and standardized protocols for sharing, said Jane Carlin, chair of the
Financial Services Sector Coordinating Council
, an association of financial companies set up in the wake of September 11 to protect the nations financial services critical infrastructure from attack. Although weve made
good progress
on information sharing entities, we have not adequately addressed issues of timeliness and completeness of information.
Carlin pointed to the aftermath of a cyber attack on a major financial exchange in October 2010 as an example of where better cooperation could have gone a long way. The exchange immediately informed its regulator and law enforcement, but information about the attack and its impact on other companies wasnt disclosed to the rest of the industry for 102 days.
This could have had an enormous impact on employees, stockholders, large and small, and the industry as a whole, Carlin said, pointing out that those 102 days spanned the year-end period when companies prepare annual financial reports. The lack of meaningful information for more than three months left the entire sector unnecessarily vulnerable.
That sentiment was echoed by Gerry Cauley, president and CEO of the North American Electric Reliability Corporation, which develops and oversees power system standards nationwide. Cauley complained that a lack of real-time, actionable intelligence sharing on attacks leaves the power industry at best a step behind the government in preventing attacks.
Ed Amoroso, senior VP and chief security officer for AT&T, voiced similar concerns, not just in terms of receiving information from DHS, but also in sending information to DHS. If you think about the question of coordination, its the case right now that theres no good way to share information in real time, he said, adding that whenever he wants to share information with the government, it seems like a room full of AT&T lawyers caution him not to. At AT&T we find it frustrating because we have information wed like to share.
While shortfalls may remain, DHS has been increasingly working closely with the private sector on critical infrastructure protection issues. Representatives from the IT and financial sectors, for example, work daily on the floor of DHSs
National Cybersecurity and Communications Integration Center
, which gathers, analyzes, and shares information on cyber attacks with government and industry and coordinates responses. DHS also is finalizing a similar relationship with the electric sector.
In written testimony provided for the hearing, Sean McGurk, the centers director, offered an example of how current modes of collaboration can be effective. Early last year, a company he didnt name was infected with the Mariposa botnet and worked closely with DHS to analyze the attack, trace it back to its point of entry to the companys network, contain the attack, and remove the malware.
The hearing came just as the White House prepares legislation that could have far-reaching effects on the Department of Homeland Securitys cybersecurity relationships with private sector critical infrastructure.
According to Federal News Radio, the 100-page bill, which is currently circulating among federal agencies, would, in addition to addressing other broader cyber-related issues, authorize the secretary of DHS to decide what constitutes critical infrastructure and assess and audit critical infrastructure systems. Critical infrastructure owners and operators, in turn, would be required to attest to the implementation of cybersecurity measures.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Private Sector Seeks Better Cybersecurity Collaboration