The departments of Defense and Homeland Security expanded their voluntary cybersecurity information-sharing program with the defense industrial base earlier this month.
All industrial base companies are eligible to participate in the DIB Cyber Security/Information Assurance Program.
Some 1,000 firms are expected to participate in the program, which Pentagon Deputy Chief Information Officer Richard Hale said could eventually expand to include 8,000 companies.
The NDIA Cyber Division’s Government/Industry Information Sharing Committee held a seminar on threat information sharing on the same week the Pentagon announced the program expansion.
David Fastabend, vice president of ITT Exelis’ advanced information systems unit and NDIA committee chair, told ExecutiveBiz in a recent interview that the event was a timely forum for government and industry leaders to discuss the challenges of cyber threat information sharing.
Fastabend said the audience looked to the event panel to discuss how the government would actually run the DIB Cyber pilot and how it would work.
“Anyone that has a network is going to have a network that’s going to be attacked,” Fastabend said. “The ability to share information about how you’re attacked, the profile of the attacker and the hints you get that an attack is happening is incredibly useful to anyone.”
Fastabend noted that along with the potential of effective information-sharing practices, there are also significant challenges.
He told ExecutiveBiz that many of the laws that apply to cyber threats were developed during the industrial age.
Cyber threats evolve in two to three hours, he said, while laws and resulting rulings take two to three years to develop.
There is also a potential legal liability when it comes to sharing information that a firm has been breached by a cyber attack, Fastabend said.
Companies stand to benefit from sharing cyber information, but some fear they will be subject to a lawsuit for failure to adequately protect their information.
“There’s an obvious tension that people are trying resolve,” Fastabend said.
Fastabend said his committee is fond of saying: “The good news is that we have an extremely relevant topic; the bad news is we may not see it soon resolved.”