Why public-private partnerships need to be a cybersecurity priority in 2016
Haiyan Song, a senior vice president of security markets for Splunk, makes the case that the only way the government will survive the continuous onslaught of cyber...
Last year was a hack-heavy year. From the Office of Personnel Management and the IRS, to the Census Bureau and the Department of Defense, government networks were the targets of attacks. The OPM breach alone impacted more than 21.5 million American citizens and resulted in the loss of millions of sensitive files including Social Security numbers, fingerprints, financial records and personal health information.
During the IRS breach, the tax information of roughly 330,000 citizens was compromised because of an undetected error in the agency’s system.
In July, the cyber actors who breached the Census Bureau’s systems gained access to the Federal Audit Clearinghouse. Fortunately, the Clearinghouse did not store any sensitive data, but the breach still revealed the network’s security flaws.
Haiyan Song, senior vice president of security markets at Splunk.
And let’s not forget about the attack on a Pentagon’s Joint Chiefs unclassified email system that was suspected to be carried out by Russian threat actors. The attack compromised 4,000 military and civilian personnel.
While the origins of these cyber breaches were never the same, they all shared one common goal —gaining access to valuable information and exploiting that to serve their criminal and/or political agendas.
Some people say this year’s surge in cyber breaches will serve as a wake-up call for government to strengthen our nation’s cybersecurity posture. While this statement holds certain validity, we cannot hope the problem will resolve itself because it won’t. We need to be proactive. We need tangible, short-and long-term plans that address a wide range of security measures.
One of the most important steps we can take to ensure cyber breaches become less frequent and impactful is to bolster public-private partnerships and information sharing. Bringing together the best and most innovative IT professionals from across industry and government will enable us to create comprehensive solutions, capabilities and responses to cyber attacks. These partnerships will also help us to establish an open, transparent line of communication where government and industry can learn from each other and share best security practices that will be crucial to detect and ward off future cyber attacks.
As we look to 2016, several promising opportunities are already on the horizon to put these types of public-private partnerships in action. Take the National Institute of Standards and Technology’s (NIST) National Cybersecurity Center of Excellence (NCCoE) for example. As the country’s central lab for cybersecurity, NCCoE continuously brings together leaders from industry, federal agencies, technology companies and academia to work together on solutions to address national security challenges.
In fact, NCCoE recently worked with 10 different technology vendors to create an example solution to improve cybersecurity in the financial industry through better IT asset management. By working with the private sector, NCCoE was able to better understand the complexities of financial institutions and build an effective example solution using commercially available tools.
The Federal Information Security Management Act (FISMA) and the Federal IT Acquisition Reform Act (FITARA) represent additional opportunities for industry and government to partner to strengthen federal agencies’ protection through information sharing or during the acquisition process, respectively.
We will also be seeing more public-private sector cyber initiatives from the U.S. Chamber of Commerce’s Cybersecurity Campaign next year. The Chamber’s focus on public-private information sharing and initiatives to influence policies and regulations that promote private sector solutions to cybersecurity will become increasingly important in 2016.
While progress is being made, more must be done no doubt to encourage collaboration between public and private sector. For instance, developing an exchange program between public and private sector cybersecurity employees could help foster a better relationship and improve cross-industry collaboration, expand knowledge sets and help both sides better understand their similarities and differences to enable new ideas.
Another way to enhance communication between public and private is to ensure everyone is talking the same language. There are instances where cyber-related terms in the public sector don’t equate to the same thing for the private sector. Creating an official government “decoder ring” type of document for government that’s created in coordination with industry would be beneficial for all and enable the two sides to better understand each other. Greater coordination is necessary for everyone and we shouldn’t risk something getting lost in translation.
From an operational standpoint, perhaps allowing a bigger private sector presence in DHS Fusion Centers spread across the U.S. could facilitate improved coordination, as those centers would serve as physical posts for greater information sharing.
Fortunately, government leaders are increasingly aware of how critical public-private partnerships are to cybersecurity.
Terry Halvorsen, the chief information officer of the Defense Department, has said that despite the huge resources he is working with, help from all avenues of the private sector has been vital to establishing a better cybersecurity presence within his department. Similarly, Lt. Gen. Alan Lynn, director of the Defense Information Systems Agency, recently stated, “We absolutely need industry with us, otherwise we can’t function … I want to innovate with industry. I want to open our doors to greatness.”
In the blog post Federal CIO Tony Scott wrote announcing the long-awaited Cybersecurity Implementation Plan, he stated that as cyber threats become increasingly sophisticated and relentless, so must our efforts to mitigate and fight them. He stressed that across government and industry, the best way to enhance cybersecurity is to properly fund security investments, strengthen processes for developing and implementing best practices, develop and retain our nation’s cybersecurity workforce, and lastly, collaborate between public and private sector to leverage the best of existing, new, and emerging technology and talent.
The need for government and industry to work together to protect our assets has never been as critical as it will be in 2016. Cybersecurity efforts can no longer be in siloes. We need to work together to protect our citizens and defend our nation’s networks. Strengthening the ongoing dialogue between government and industry will help ensure we are defending our networks and data with the most up-to-date, effective cybersecurity technologies and talent available. Let’s not wait for another cybersecurity crisis to happen for us to come together. Now is the time to build the right long-term public-private partnerships so we can learn from the breaches in 2015 and ensure we are equipped for the challenges that lie ahead.
Haiyan Song is a senior vice president of security markets for Splunk.
Why public-private partnerships need to be a cybersecurity priority in 2016
Haiyan Song, a senior vice president of security markets for Splunk, makes the case that the only way the government will survive the continuous onslaught of cyber...
Last year was a hack-heavy year. From the Office of Personnel Management and the IRS, to the Census Bureau and the Department of Defense, government networks were the targets of attacks. The OPM breach alone impacted more than 21.5 million American citizens and resulted in the loss of millions of sensitive files including Social Security numbers, fingerprints, financial records and personal health information.
During the IRS breach, the tax information of roughly 330,000 citizens was compromised because of an undetected error in the agency’s system.
In July, the cyber actors who breached the Census Bureau’s systems gained access to the Federal Audit Clearinghouse. Fortunately, the Clearinghouse did not store any sensitive data, but the breach still revealed the network’s security flaws.
And let’s not forget about the attack on a Pentagon’s Joint Chiefs unclassified email system that was suspected to be carried out by Russian threat actors. The attack compromised 4,000 military and civilian personnel.
Get tips and tactics to make informed IT and professional services buys across government in our Small Business Guide.
While the origins of these cyber breaches were never the same, they all shared one common goal —gaining access to valuable information and exploiting that to serve their criminal and/or political agendas.
Some people say this year’s surge in cyber breaches will serve as a wake-up call for government to strengthen our nation’s cybersecurity posture. While this statement holds certain validity, we cannot hope the problem will resolve itself because it won’t. We need to be proactive. We need tangible, short-and long-term plans that address a wide range of security measures.
One of the most important steps we can take to ensure cyber breaches become less frequent and impactful is to bolster public-private partnerships and information sharing. Bringing together the best and most innovative IT professionals from across industry and government will enable us to create comprehensive solutions, capabilities and responses to cyber attacks. These partnerships will also help us to establish an open, transparent line of communication where government and industry can learn from each other and share best security practices that will be crucial to detect and ward off future cyber attacks.
As we look to 2016, several promising opportunities are already on the horizon to put these types of public-private partnerships in action. Take the National Institute of Standards and Technology’s (NIST) National Cybersecurity Center of Excellence (NCCoE) for example. As the country’s central lab for cybersecurity, NCCoE continuously brings together leaders from industry, federal agencies, technology companies and academia to work together on solutions to address national security challenges.
In fact, NCCoE recently worked with 10 different technology vendors to create an example solution to improve cybersecurity in the financial industry through better IT asset management. By working with the private sector, NCCoE was able to better understand the complexities of financial institutions and build an effective example solution using commercially available tools.
The Federal Information Security Management Act (FISMA) and the Federal IT Acquisition Reform Act (FITARA) represent additional opportunities for industry and government to partner to strengthen federal agencies’ protection through information sharing or during the acquisition process, respectively.
We will also be seeing more public-private sector cyber initiatives from the U.S. Chamber of Commerce’s Cybersecurity Campaign next year. The Chamber’s focus on public-private information sharing and initiatives to influence policies and regulations that promote private sector solutions to cybersecurity will become increasingly important in 2016.
While progress is being made, more must be done no doubt to encourage collaboration between public and private sector. For instance, developing an exchange program between public and private sector cybersecurity employees could help foster a better relationship and improve cross-industry collaboration, expand knowledge sets and help both sides better understand their similarities and differences to enable new ideas.
Read more: Commentary
Another way to enhance communication between public and private is to ensure everyone is talking the same language. There are instances where cyber-related terms in the public sector don’t equate to the same thing for the private sector. Creating an official government “decoder ring” type of document for government that’s created in coordination with industry would be beneficial for all and enable the two sides to better understand each other. Greater coordination is necessary for everyone and we shouldn’t risk something getting lost in translation.
From an operational standpoint, perhaps allowing a bigger private sector presence in DHS Fusion Centers spread across the U.S. could facilitate improved coordination, as those centers would serve as physical posts for greater information sharing.
Fortunately, government leaders are increasingly aware of how critical public-private partnerships are to cybersecurity.
Terry Halvorsen, the chief information officer of the Defense Department, has said that despite the huge resources he is working with, help from all avenues of the private sector has been vital to establishing a better cybersecurity presence within his department. Similarly, Lt. Gen. Alan Lynn, director of the Defense Information Systems Agency, recently stated, “We absolutely need industry with us, otherwise we can’t function … I want to innovate with industry. I want to open our doors to greatness.”
In the blog post Federal CIO Tony Scott wrote announcing the long-awaited Cybersecurity Implementation Plan, he stated that as cyber threats become increasingly sophisticated and relentless, so must our efforts to mitigate and fight them. He stressed that across government and industry, the best way to enhance cybersecurity is to properly fund security investments, strengthen processes for developing and implementing best practices, develop and retain our nation’s cybersecurity workforce, and lastly, collaborate between public and private sector to leverage the best of existing, new, and emerging technology and talent.
The need for government and industry to work together to protect our assets has never been as critical as it will be in 2016. Cybersecurity efforts can no longer be in siloes. We need to work together to protect our citizens and defend our nation’s networks. Strengthening the ongoing dialogue between government and industry will help ensure we are defending our networks and data with the most up-to-date, effective cybersecurity technologies and talent available. Let’s not wait for another cybersecurity crisis to happen for us to come together. Now is the time to build the right long-term public-private partnerships so we can learn from the breaches in 2015 and ensure we are equipped for the challenges that lie ahead.
Haiyan Song is a senior vice president of security markets for Splunk.
Want to stay up to date with the latest federal news and information from all your devices? Download the revamped Federal News Network app
Copyright © 2024 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.
Related Stories
How 21st-century data management can help leaders provide more effective correctional healthcare services
Breaking down barriers: The challenges of federal micro-purchases for small businesses
The push to upskill the technology workforce in federal agencies