A silver lining of the current Covid-19 pandemic has been the cooperation of industry and government who have been working closely together to bring solutions that alleviate supply shortages and cultivate treatments to combat the lethal virus. Not since World War II have we witnessed such a monumental effort of companies adapting their manufacturing lines to build emergency medical products, and collaboratively work with the public sector on the greater mission. This Covid-19 working model of addressing threats via Public Private Partnerships (PPPs) should be replicated to help meet the challenges of cyber-securing our digital world.
A higher level of public-private collaboration is needed to address the growing cyber-threat landscape through Public Private Partnerships. The global threat actors targeting critical infrastructure are terrorists, criminals, hackers, organized crime, malicious individuals, and, in some cases, adversarial nation-states. Addressing the threats requires incorporating a robust calculated security strategy of public and private sector partnering based on layered vigilance and protections, readiness, and resilience.
Phishing, malware ransomware, and denial of service attacks are means and methods hackers are using to attack both government and industry assets. Some of the specific cybersecurity areas a government public-private partnership could collaborate to defend against those threats include threat intelligence, data security, browser security, cloud security, container security, endpoint protection, identity, access management and authentication, mobility, and IoT Security. Cybersecurity awareness and training should also be part of the PPP equation.
The Covid-19 outbreak has compounded cyber threats as both government agencies and companies have had to move their workforces to remote arrangements. Remote work has increased vulnerabilities in the digital attack surface ecosystem. There has been an uptick in COVID-19-themed phishing attacks aimed at workers using personal Wi-Fi networks with less cyber-protection outside their offices. More nefarious has been the spate of ransomware attacks directed against hospitals and healthcare facilities during this pandemic.
As in the response to COVID-19, open communication and commitment from both government and industry leadership in cybersecurity is critical. The industry should regularly collaborate with the government to best utilize risk management models and manage digital assets and productivity tools. Industry and government should also share resources for research and development and for rapid prototyping of potential cybersecurity technology solutions. This cooperation is especially valuable with artificial intelligence, quantum computing, 5-G, the Internet of Things with other emerging technologies that could enhance cybersecurity capabilities.
Critical infrastructure protection is a good example of where PPPs can provide impact in cybersecurity. In the U.S., most of the critical infrastructure, including defense, oil and gas, electric power grids, health care, utilities, communications, transportation, education, banking, and finance, is owned by the private sector and regulated by the public sector.
Mitigating evolving threats and being resilient to breaches are paramount for critical infrastructure protection. PPPs are dependent on information sharing, planning, investment in emerging technologies, and allocation of resources (and roles and responsibilities) coordinated by both the public and private sectors in special working cybersecurity partnerships.
Many industry-specific public/private partnerships are now being facilitated via Information Sharing and Analysis Centers (ISACs) that help critical infrastructure owners and operators (in coordination with the government) protect their facilities, personnel, and customers from cyber and physical security threats and other threats. Lessons learned from the current pandemic crisis can be assimilated into existing ISAC networks. More investment and industry participation are needed in these ISACs.
In the federal civilian sector DHS’s new agency, Critical Infrastructure Security Agency (CISA) puts a keen focus on DHS’s integral role in cyber preparedness, response, and resilience for critical infrastructure. DHS has identified 16 infrastructures deemed critical because their physical and digital assets, systems, and networks are considered vital to national economic security, safety, and national public health. CISA’s stated role is to coordinate “security and resilience efforts using trusted partnerships across the private and public sectors, and deliver training, technical assistance, and assessments to federal stakeholders as well as to infrastructure owners and operators nationwide.”
The Department of Defense (DOD) also works closely with industry to ensure the security of the defense industrial base. Cybersecurity collaboration is integral to this effort, especially in protecting logistics and the supply chain. The United States Transportation Command provides a good case study of effective PPPs. “USTRANSCOM encourages its commercial partners in the airline, marine, trucking, and rail industries to voluntarily alert USTRANSCOM of threat-related information (cyber, social media, physical attack) that may be of widespread interest to other industries.”
The current COVID-19 crisis has demonstrated that collaboration between government and industry stakeholders is a model that makes good sense. The existing models employed by DHS, DOD, and other government agencies, should be enhanced and accelerated in their applications to cybersecurity challenges. Through such expanded public-private partnerships (PPPs) we can better share intelligence, identify product and policy solutions, align and evaluate technology gaps, and help design scalable architectures that will lead to greater efficiency in cybersecurity.