INSA: public, private sectors should work together on cybersecurity

The federal government can't handle cyber security issues on its own, and neither can the private sector.

Together, though, they might be able to work out viable solutions.

That's the idea behind a new report, Addressing CyberSecurity through Public-Private Partnership, which was recently released by the Intelligence and National Security Alliance (INSA).

Ellen McCarthy is that organization's president, and explained that INSA has been involved with cybersecurity issues and the federal government for some time.

They were one of the organizations that provided support to Melissa Hathaway when she was developing the 60 day Cybersecurity review for the White House earlier this year.

McCarthy said her organization wrote this most recent report as a follow on to the 60 day review, and added that a cyber 'czar' is certainly needed.

"We really do need someone who can come in and sort of move out from the government perspective and take the lead on coordinating many of these efforts and develop the necessary policies -- the doctrines. But, this is a problem that is as much a private sector problem as it is a government problem and you've got a lot of companies and individuals who want to see some movement. The genesis of this paper was that there've been a number of problems that we've faced in this country where the private sector has sort of taken the lead in finding solutions, so we really did look at different models of where the private sector organized and engaged with the public sector."

She added that the Internet is an infrastructure that is predominantly owned and operated by the private sector, which means it is clear they need to have a role when it comes to cybersecurity.

"Our paper really does focus on what the private sector can do first, hence the recommendation in [it] that some sort of a community of interest be working with the government to sort of lay out problems. Part of what's been discussed in the past is privacy and companies being worried about their own personal information or business information being mishandled. Well, what better way to guide standards and to guide rules than to actually be engaged in the development of those standards and rules?"

What needs to be avoided, though, is stubbornness. McCarthy said neither side can dig in its heels if the partnership is to work.

"If you don't like what's being regulated, then why not get engaged in the development of those regulations or standards? Be a part of the process."

One excellent example is how the public and private sectors worked together in the wake of the Y2K conundrum.

"When we first sat down, the task force, which was senior level industry folks, intel folks [and others], it was pretty much agreed that we were really making it hard. Part of it is, when you refer to security, all of a sudden all these red lights go on, because concerns about privacy. So, instead of looking at this as a security problem, why don't we look at this as a safety issue?"

One of the ways INSA plans to help is to encourage that small steps be taken, rather than large leaps. McCarthy said there is one other thing to remember about the report, as well.

"This was not meant to be a fait acompli. This is one suggestion amongst what could be multiple, different [solutions]. Essentially it suggests a community of interest. Who plays in that community is sort of critical. Clearly you would need private sector representation, privacy group representation, legal group representation, and you also need to have some government involvement."

Learn more with the Federal News Radio tag search: cybersecurity.