Home / Blogs

The Cyber Security Ecosystem: Collaborate or Collaborate - It's Your Choice

Arun Raghu

As cyber security as a field has grown in scope and influence, it has effectively become an 'ecosystem' of multiple players, all of whom either participate in or influence the way the field develops and/or operates. It's increasingly evident that, more than ever, it is crucial for those players to collaborate and work together to enhance the security posture of communities, nations and the globe.


The eco-system untwined

The cyber security ecosystem can broadly be divided into two categories, with some players (e.g. governments) having roles in both categories:

Macro-level players
Consists of those stakeholders who are in a position to exert influence on the way the cyber security field looks and operates at the micro-level. Key examples include governments, regulators, policymakers and standards setting organizations and bodies (such as the International Organization for Standardization, Internet Engineering Task Force and National Institute for Standards and Technology).

Micro-level players
Consists of those stakeholders who, both collectively and individually, undertake actions on a day-to-day basis that affect the community's overall cyber security posture (positively or negatively). Examples include end users/consumers, governments, online businesses, corporations, SMEs, financial institutions and security consultants (although as we'll discuss later, the security consultant has a unique role that bridges across the other players at the micro-level).

The macro level has, in the past, been somewhat muted with its involvement in influencing developments in cyber security. Governments and regulators, for example, often operated at the fringes of cyber security and primarily left things to the micro-level. While collaboration occurred in some instances (for example, in response to cyber security incidents with national security implications), that was by no means expected.

The formalization of collaborative security

This is rapidly changing. We are now regularly seeing more formalized models being (or planning to be) introduced to either strongly encourage or require collaboration on cyber security issues between multiple parties in the ecosystem.

Recent prominent examples include proposed draft legislation in Australia that would, if implemented, require nominated telecommunications service providers and network operators to notify government security agencies of network changes that could affect the ability of those networks to be protected, proposals for introducing legislative frameworks to encourage cyber security information sharing between the private sector and government in the United States, and the introduction of a formal requirement in the European Union for companies in certain sectors to report major security incidents to national authorities.

There are any number of reasons for this change, although the increasing public visibility given to cyber security incidents is likely at the top of the list (in October alone we have seen two of Australia's major retailers suffer security breaches). In addition, there is a growing predilection toward collaborative models of governance in a range of cyber topic areas that have an international dimension (for example, the internet community is currently involved in deep discussions around transitioning the governance model for the internet's DNS functions away from US government control towards a multi-stakeholder model). With cyber security issues frequently having a trans-national element — particularly discussions around setting 'norms' of conduct around cyber security at an international level — it's likely that players at the macro-level see this as an appropriate time to become more involved in influencing developments in the field at the national level.

Given this trend, it's unlikely to be long before the macro-level players start to require compliance with minimum standards of security at the micro-level. As an example, the proposed Australian legislation referred to above would require network operators and service providers to do their best (by taking all reasonable steps) to protect their networks from unauthorized access or interference. And in the United States, a Federal Court of Appeals recently decided that their national consumer protection authority, the Federal Trade Commission, had jurisdiction to determine what might constitute an appropriate level of security for businesses in the United States to meet in order to avoid potential liability. In Germany, legislation recently came into effect requiring minimum security requirements to be met by operators of critical infrastructure.

Encouraging a more proactive approach to security

Whatever the reasons for the push towards 'collaborative' security, it's the micro-level players who work in the cyber security field day-to-day who will ultimately need to respond as more formal expectations are placed on them with regards to their security posture.

There is also a positive linkage between facilitating more collaboration between players at the micro-level of the ecosystem, and encouraging the creation of more proactive security cultures within organizations. Enabling businesses to share knowledge on security problems that have already been considered by others in the community enables them to focus their energies on implementing measures to encourage more proactive security — for example, by educating employees on the importance of identifying and reporting basic security risks (such as the inappropriate sharing of system passwords). And encouraging a more proactive security culture within organizations will ultimately strengthen the overall cyber security posture of nation states and benefit the community as a whole.

By Arun Raghu, Technology Policy Adviser He is currently an adviser at Hivint, a startup cyber security consulting firm in Australia that is transforming the delivery of cyber security services by sharing the outcomes of consulting projects with other businesses in the community. Visit Page
Follow CircleID on
SHARE THIS POST

If you are pressed for time ...

... this is for you. More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Vinton Cerf, Co-designer of the TCP/IP Protocols & the Architecture of the Internet

Share your comments

Very good article Arun, collaboration is the Khaled Fattal  –  Oct 14, 2015 12:22 AM PDT

Very good article Arun, collaboration is the only way forward but not only by Cyber security experts but by all sectors of society and stakeholders at local, regional and global levels. This is at the heart of what the Multilingual Internet Group, MLi Group, has been doing since 2013 in our global Summit Series to educate and help stakeholders become prepared for the seismic changes to the new Era wea re in we call the New "MiLE". a New Multilingual internet and Landscape Ecosystem that is full of the gravest new threats but also the biggest opportunities especially in emerging markets.

Next on our summits diary in November are our London summits hosted by Google campus and South Africa summit hosted by Microsoft, with many other summits planned around the world Q1 and Q2 next year. For more info go to http://summits.mligrp.com or email us at Summits @ MLiGrp . com

To post comments, please login or create an account.

Related

Topics

Domain Names

Sponsored byVerisign

IP Addressing

Sponsored byAvenue4 LLC

New TLDs

Sponsored byAfilias

Cybersecurity

Sponsored byVerisign

DNS Security

Sponsored byAfilias