What Agencies and Industry Can Learn from Sharing Cyber Threat Intel

With cybersecurity threats to the federal government increasing by the day, agencies need a revamped cybersecurity process—but this must go beyond simply implementing cyber tools.

To fully realize this complex mission, private and public partnership is essential. Collaboration between the government and private industry ensures the strongest defense against cyberattacks. Recognizing this need, CISA has taken the first step toward a new national cybersecurity strategy by prioritizing collaboration with its new Joint Cyber Defense Collaborative, or  JCDC, initiative. 

The JCDC will combine the expertise and resources of the public and private sectors to develop future cyber defense plans. The group features representatives from the Homeland Security and Justice departments, U.S. Cyber Command , the National Security Agency as well as leading mobile technology and cloud computing providers and private-sector owners of critical infrastructure. 

A Government Accountability Office report from March 2021 emphasizes the importance of public-private collaboration—the coordination of which is one of CISA’s primary responsibilities—stressing partnership’s role in developing a holistic cybersecurity strategy. 

Government can provide access to the sensitive cyber threat information that private industries need to prioritize and coordinate national cybersecurity efforts. But together, leaders from both sectors benefit from their diversity of knowledge, broad customer bases and unique specializations.  

A Breadth of Enterprise Expertise 

As mentioned, the JCDC includes a wide range of partners, recognizing the many ways cyber threats can reach an agency—from the endpoint to the cloud. 

This is especially relevant for threats like advanced surveillanceware and ransomware campaigns, which will frequently start on a mobile device only to move laterally into cloud-based infrastructure. Often, these attacks start by collecting login credentials through socially engineered phishing campaigns on mobile apps such as SMS, social media, third-party messaging platforms and even dating apps. 

From there, attackers can use the credentials to log in as a legitimate user and navigate the infrastructure until they find valuable data to lock up or exfiltrate. Working with industry partners that can provide insights from varied perspectives will help fill crucial gaps like these in government security strategies. 

More Informed Together 

Government agencies may also benefit from the breadth of information that the private sector can provide. Because government agencies are not always able to share information across agencies, they may not have access to the same wealth of information and data sets as enterprises. For example, Lookout has a mobile dataset with telemetry from over 200 million devices and 150 million apps.

These large databases provide anonymized insights that allow government agencies to automate their awareness of the cyber landscape by continuously scanning for threats against the private sector's large databases of telemetry data. This data can show where threats originate, as well as expose new approaches that bad actors are just beginning to exploit. 

This is a significant benefit for government agencies. They don't have to duplicate the resources and time spent scanning for threats; instead, they can use the information already collected to better understand the root of a threat.

Federal agencies should seek industry partners that can keep them better informed and offer resources they can’t access. 

Making Government a Specialist in Every Sector 

Private sector partners not only bring a broader set of perspectives, but they are specialists in what they do, empowering government with targeted expertise and solutions developed through focused attention to their respective areas. For example, many agencies are aware mobile devices can pose a threat, but mobile device management is often their only protection—too basic to truly protect an agency. 

But endpoint to cloud protection should be included in a comprehensive zero trust strategy—a central element, rather than an afterthought. Specialists in these areas can lay out the platform necessary to fill these common zero trust gaps. 

A platform built on secure access service edge including cloud access security broker and zero trust network access solutions can provide a consistent baseline to ensure applications like antivirus and anti-malware, enterprise digital rights management and data loss prevention are consistently applied across the network. However, these applications may be overlooked when working with just a single partner with a different specialty. 

The new JCDC initiative highlights the importance of partnership—and there are numerous reasons this approach needs to be a central consideration in government cyber efforts moving forward. To protect against increasingly sophisticated cyber criminals, the public and private sectors must begin to pool resources. Empowered by the best experts in every element of cybersecurity, the federal government can overcome the seemingly insurmountable challenge of modern cyber threats.

Tony D’Angelo is vice president of North America, Public Sector at Lookout.