Former National Security Agency and CIA director Michael Hayden, in an open question to the nation, wonders: “The government warns Americans about health, pollution, weather and other threats. Why not cyber threats?”
In an opinion column published by Federal Computer Week Dec. 9, Hayden, and co-authors Samuel Visner and David Zolet, executives at CSC, suggest: “Washington should begin sharing cyber warnings with those responsible for America’s critical infrastructure, from hospitals to water systems to banks.”
At the same time, “the private sector should act on its own without waiting for the government.”
The authors, all of whom have extensive familiarity with the risk cyber security threats pose to the nation’s infrastructure, make the case that there are many parallels in the private sector involving the sharing of information that already benefits public safety.
From private food and consumer product suppliers, to neighborhood watches, to drug stores reporting pharmaceutical sales, to health officials alerting the public on contagious diseases–there are a wide range of models for informing the public about threats on the safety.
However, while the Homeland Security and Justice departments employ billions in taxpayer dollars to counter cyber threats, much more should be done, they wrote.
In particular, “private sector involvement is crucial,” they argued. “Private industry owns 85 percent of the country’s critical infrastructure and deploys far more cybersecurity experts than the government ever will,” they wrote.
Hayden, now a principal consultant with the Chertoff Group, and his co-authors said that a first step would involve critical infrastructure operators and their IT providers banding together to “establish a clearinghouse to share information on cyber threats and countermeasures.”
They also suggested creating a partnership with the Defense Department and the broader defense industry which actually manages or supports many of the networks and systems that support the military.
That would presumably provide a mechanism that would “build upon” an existing 24×7 operational awareness center, staffed by public and private sector players at the National Cybersecurity and Communications Integration Center, which is managed by Department of Homeland Security.
The NCCIC, is responsible for the production of a common operating picture for cyber and communications across the federal, state, and local government, intelligence and law enforcement communities and the private sector. It also issues a variety of services and tools to help partners and the public to protect against cyber and communications threats.
The entire article can be found at Federal Computer Week.