With increasingly complex and growing cyber threats, the Department of Defense (DOD) needs as much information as it can get, as quickly and efficiently as possible. DOD systems are also becoming more interconnected and centralized, meaning that entry into one point can threaten the entire network. In fact, some nation-states dedicate weeks or months to cracking a single U.S. weapons system, according to a recent Government Accountability Office report, and the department probably is only aware of a fraction of the cyber threats against it.
As a result, the Department of Defense (DOD) Cyber Strategy, issued this past September, directs the DOD to “build private sector partnerships.” This threat landscape facing the DOD is one reason the secretary of defense is given express authority in the National Defense Authorization Act for Fiscal Year 2019 to engage in voluntary private sector cooperation, including information sharing.
This is one of the reasons the DOD established the Defense Industrial Base Cyber Security Program. Composed of defense contractors with clearances, the DIB CS exists to improve information sharing between the DOD and industry.
The DIB CS program is a voluntary cyber threat information sharing initiative established by the DOD to enhance and supplement DIB participants’ capabilities to mitigate cyber attacks. The program features a collaborative information sharing environment where members voluntarily report cyber threats as well as information on how to prevent/mitigate those threats.
There is no question that the department and its cyber industry partners must stay in close contact. But determining the who, what, where, when and how of reporting incidents is not always straightforward. The DIB CS has made it easy by creating a secure portal with a checklist for sending information, as well as a hotline to call in emergencies.
The DIB CS – through this portal – encourages contractors “to report information to promote sharing of cyber threat indicators that they believe are valuable in alerting the Government and others, as appropriate in order to better counter threat actor activity. Cyber incidents that are not compromises of covered defense information or do not adversely affect the contractor’s ability to perform operationally critical support may be of interest to the DIB and DOD for situational awareness purposes.”
We believe the DIB CS program is an important one, which is why Symantec announced in April that we have elected to join from an industry perspective. Overall, the DIB CS is a win-win for government and industry. It provides an important platform to share threat information and best practices, helping to improve the overall cyber awareness and security posture of all members. Both the DOD and industry benefit from keeping the flow of information open, so they can react quickly to events and have a broader view of trends.
Perhaps most importantly, Symantec joined the DIB CS for the same reason so many American companies have historically stepped up to become part of the Defense Industrial Base: our nation is at cyber war and the partners in the DIB CS are in a position to help. Unlike past wars, the focus is not on making weapons or widgets, but on working together to share relevant global threat intelligence to counter new and emerging cyberattacks. We at Symantec are proud to be part of that effort.
