Group proposes economic incentives to improve cybersecurity
Connecting state and local government leaders
The Internet Security Alliance report on implementing a cybersecurity strategy says that the issue is an economic one rather than technical and that government needs to provide incentives for the private sector to implement existing standards and practices that are known to work.
Cybersecurity is fundamentally an economic rather than a technical issue, and government needs to address it by providing economic incentives to the private sector rather than issuing regulatory mandates, an industry trade association says in a report released today.
“We will never have a sustainable system of cybersecurity until we change the economic equation that governs it,” said Ty Sagalow, chief innovation officer of Zurich North America and chairman of the Internet Security Alliance.
ISA today released the report on implementing elements of the Obama administration’s cybersecurity strategy, advocating a model of public-private partnership that was successful in establishing universal electrical and telephone service in the early 20th century. By providing incentives for cybersecurity investments, the government can help level the playing field in which cyber attackers now have all the advantages, ISA said.
The report is part of what ISA called a continuing dialog on national cybersecurity strategy, begun with the cybersecurity review by the Obama administration earlier this year. ISA president Larry Clinton said solving some apparently vexing problems could actually be fairly easy.
“We have known for a number of years that we already know how to stop 80 to 90 percent of attacks,” with existing security standards and best practices, Clinton said. But, “companies are underfunding the security investments they ought to be making.”
The question is how to get effective standards and practices implemented by the private sector, which controls the bulk of the nation’s critical infrastructure that increasingly depends on digital technology. The solution offered is based on what ISA calls a social contract model, in which companies have incentives to include cybersecurity in business plans, rather than relegating it to an IT ghetto.
“We’re not talking about a bailout or giveaways,” Sagalow said. The plan combines legislation, leveraging government purchasing power and bringing in the insurance industry to help provide a way to quantify returns on security investments.
ISA came up with a list of key incentives to spur investment:
- Create a cybersecurity safety act similar to the Safety Act passed after the Sept. 11, 2001, terrorist attacks that would provide marketing and insurance benefits for the products certified as implementing security technology, standards and practices.
- Tie federal grants, loans, and stimulus payments to the commercial adoption of approved cybersecurity standards and practices.
- Leverage government purchasing power by increasing the importance of security in contract awards.
- Streamline existing business regulations for information security, such as those in the Sarbanes-Oxley, Gramm-Leach-Bliley, and the Health Insurance Portability and Accountability Acts.
- Provide tax incentives for development of and compliance with cybersecurity standards.
- Provide grants and direct funding for cybersecurity research and development.
- Limit liability for organizations that implement proper standards and practices.
- Create a national award for excellence in cybersecurity.
- Promote cyber insurance to spur development and use of standards and practices, while helping companies to quantify and manage risk. This could also transfer some portion of the risk to the federal government in the case of a major cyber event.
The report also addresses improving methods of information sharing on cybersecurity issues between and among government and private-sector organizations. This would be done with certified threat reporters with the capability to detect and analyze threats, a National Cyber Threat Response Center as a central clearing house for reports and data, and vendors to use the information to push patches, updates and defensive measures into the field in the way that antivirus now is updated.
Other issues addressed in the report include improving workforce and executive level education in the corporate world, securing the global IT supply chain, international and legal issues, and standards for automation of security in technologies such as Voice Over IP.
Some of the proposals in the ISA report are new ideas, and some have precedents from other sectors, Clinton said. “What we’re saying is, apply these to cybersecurity.”
NEXT STORY: Wanted: A Smokey Bear for cybersecurity