Rob Joyce, cybersecurity director at the National Security Agency, said the federal government should further strengthen information sharing with industry to prevent cyberattacks by providing private sector entities access to declassified information to carry out actionable cyber defense efforts, Nextgov reported Wednesday.

“We can take and understand a threat, and get it to that ecosystem at an unclassified level,” Joyce, a two-time Wash100 awardee, said at an event Tuesday.

“And that’s the key, because if I give a company a secret at a classified level, most of the time, even if the person receiving it is able to receive it at that level, the people who action it aren’t,” he added.

Joyce discussed how NSA’s Cybersecurity Collaboration Center works to help deter cyberattacks and threat actors by serving as a hub for the agency to share unclassified intelligence information with industry.

Defense One reported that Joyce highlighted the importance of Section 702 of the Foreign Intelligence Surveillance Act and that NSA will work with Congress, the FBI and other agencies to renew the authority.

“So FISA Section 702 is up for renewal this year. And it is a vital source of intelligence. It is an authority that lets us do collection against a known foreign entity who chooses to use U.S. infrastructure,” Joyce said.

“It makes sure that we don’t afford the same protections to those foreign malicious actors who are on our infrastructure as we do the Americans who live here,” he added.

The NSA cyber chief also talked about security concerns with video-sharing platform TikTok and artificial intelligence tools at the event.

Sen. Ron Wyden, D-Ore., has requested that the Cybersecurity and Infrastructure Security Agency and National Security Agency conduct annual cybersecurity audits of the AT&T-operated FirstNet broadband communications platform used by first responders and the military.

In a letter to CISA and NSA, Wyden raised concerns about security flaws in mobile networks vulnerable to exploits and surveillance by hackers and foreign intelligence services, the senator’s office said Wednesday.

“These security flaws are also a national security issue, particularly if foreign governments can exploit these flaws to target U.S. government personnel,” the letter reads.

Wyden also revealed that an unnamed CISA cybersecurity expert informed his staff that the agency “had no confidence in the security of FirstNet” because AT&T is unwilling to share the results of security audits conducted against the government-only network.

“As the lead agencies responsible for the government’s cybersecurity, CISA and NSA need to have access to all relevant information regarding the cybersecurity of FirstNet and Congress needs this information to conduct oversight,” Wyden said.

The National Cybersecurity Center of Excellence has published a six-step approach to guide small manufacturers in implementing security segmentation in order to protect their operations from cyber attacks.

NCCoE, a unit of the National Institute for Standards and Technology, formulated the guide in accordance with the NIST Cybersecurity Framework, the institute said Thursday.

The paper was written by cybersecurity engineers Michael Powell of NCCoE, and John Hoyt, Aslam Sherule, and Lynette Wilcox of MITRE. According to their approach, information and operational technology managers at small manufacturing facilities should begin by conducting an inventory of their tech assets. They should also identify where the hardware, software and data resources should be located rather than were they have been designated.

Security zones should be created based on risk assessments of the hardware assets. Every security zone must be evaluated and assigned with a risk level, which will determine the kind of protection required for each zone, the NCCoE report stated. 

IT managers of small manufacturers should map a communication network among the security zones, and then apply security controls such as remote access, firewalls, and behavior anomaly detection. The ultimate step is to design an architectural diagram illustrating each segmented security block.

On June 8, the Potomac Officers Club will host its annual Cyber Summit. To join the event, register by clicking on the image below.