DoD Sharing Threat Data With Critical Industries

Hugh Pickens writes "The Washington Post reports that for the past two years, the Defense Department has been collaborating with critical industries to stem the loss of important defense industry data — by some estimates at least $100 billion worth over that time. The Pentagon is considering ways to share its threat data with other industries including telecommunications and Internet service providers, led by the DoD's Cyber Crime Center, the clearinghouse for threat data from the NSA, military agencies, the DHS, and industry. The Pentagon's trial program with industry illuminates the promise and the pitfalls of such partnerships: a reluctance of intelligence and law enforcement agencies to release threat data they consider classified, and the companies' fear of losing control over personal or proprietary information. 'This isn't just about national security,' says Barbara Fast, vice president of Boeing Cyber Solutions. 'It's about the economic well-being of the United States.'"

Comments

Really?

[noundi]

"It's about the economic well-being of the United States."

It's about my stock options damn it!

Almighty Dollar

[daveime]

'This isn't just about national security,' says Barbara Fast, vice president of Boeing Cyber Solutions. 'It's about the economic well-being of the United States.'

Of course. How is the CIA supposed to sell military tech to 3rd world despots and dictators, if the bastards keep stealing it for free ?

Re:Almighty Dollar

[Jurily]

How is the CIA supposed to sell military tech to 3rd world despots and dictators, if the bastards keep stealing it for free ?

Considering weapons is just about the only thing not Made In China, that could actually be a good thing.

Always been about foreign exploitation

[FriendlyLurker]

national security...It's about the economic well-being of the United States

As Major General Smedley Darlington Butler, Americas most highly decorated Marine by the time of his death pointed out in his short book War is a racket; all military/spy agency has ever been is about "economic well-being" for a select few, and was _never_ about National Security. Using his unmatched experience "protecting" the US around the world, he went on to explain why economic well being and real National Security are apposing goals.

Re:Always been about foreign exploitation

[adavies42]

how can you possibly expect me to take someone named "Smedley Darlington Butler" seriously?

Not a conspiracy issue

[gnieboer]

This isn't a military-industrial complex conspiracy issue, nor exploiting the rest of the world.

It highlights that 'national security' of any country is much more complicated than days gone by. The 'military' can no longer guarantee security by having lots of ships and planes etc. A hacker taking out the electrical grid certainly is a threat to national security, but not a threat that can be fended off by the military.

Why not? Because as most here would know, to do that would require military 'jurisdiction' over every network node and server and firewall defending something deemed 'important'.

Since despite general cynicism on the topic, the US still is one of the most free societies on the planet, they clearly would despise such an option. So instead working together as a team makes just way too much sense.

The concerning side is valid as well... giving the same dingbats that can't secure a basic firewall the responsibility for securing -actual- classified intelligence should worry us all as well.

Of course the answer is halfway, companies need to beef up their controls and the government then needs to share. We're all in this together. And yes, in this 'new' global economy, I mean everyone, but just those pesky Americans...

Re:Not a conspiracy issue

[gnieboer]

Well, they actually do have jurisdiction over (their) air and sea, through NORAD for the air for instance. They just normally don't exercise it, leaving things to the FAA.

To do it right, to 'deploy measures' to protect a commercial asset (be it company or public utility), the gov't agency would have to take over configuration control of the servers that hold the data, the firewall, and active directory (or whatever is in use). Just securing the perimeter doesn't cut it in a 'best practice' environment.
Now imagine said company/utility wants to create a new self-pay website for their customers. Now they need to go hat in hand to the agency to ask permission for port 80 to be opened for traffic to IP 192.168.0.xxx etc etc. Whose network is it now?

Utilities will probably have more luck trying to keep critical and non-critical networks separate, but that's a lot harder for corporate networks. Especially big multi-nationals like EADS.
So deploying measures sounds good upfront, but I think it would become a nightmare if tried to implement. Not to mention having some IT team show up to 'secure' your network and taking it down in the process because they don't understand it :)

How to make America safer

[toby]

Stop doing what made you a target in the first place. This means, inconveniently, undoing:

• 50 years of foreign policy prior to "9/11";
• Doubly so, the embarrassing eight years since "9/11".

Good luck.