Feds pledge beefed up information-sharing amid new cyber strategy

Federal cybersecurity officials pledged to work more with states and localities on information-sharing, protecting critical infrastructure and workforce development, days after the release of a major cyber strategy.

White House National Cyber Director Sean Cairncross said during the Billington State and Local Cybersecurity Summit in Washington, D.C. this week that President Donald Trump’s administration wants an information-sharing framework with state and local government and the private sector that “moves at speed and is actionable.” 

His statements come hot on the heels of the Trump administration releasing its National Cyber Strategy on Friday.

And while Cairncross said that the Cybersecurity and Infrastructure Security Agency, FBI and Department of Justice already do a “tremendous job in responding and assisting with that response,” more work lies ahead.

“We're looking for ways to streamline information sharing from the [U.S. government] side,” Cairncross said. “Often how we know things is super sensitive. What we know is less so. We want to figure out how to communicate that in a helpful, actionable way, as we work through that on the interagency side, with partners on the state and local side.”

Cairncross said the federal government will soon begin a pilot program with law enforcement agencies to explore how to better share information.

And an executive order Trump signed in addition to releasing the cyber strategy urges the Secretary of Homeland Security and CISA director to work with the National Cybersecurity Center to “provide training, technical assistance, and resilience building” to state, local, Tribal and territorial governments, “including to expand defensive capacity, share threat intelligence, and harden SLTT partners’ critical infrastructure systems against cybercrime exploitation by [Transnational Criminal Organizations].”

The announcement comes months after federal funding expired for the Multi-State Information Sharing and Analysis Center, and the organization began its new life with a paid membership model. Carlos Kizzee, senior vice president for stakeholder engagement at the nonprofit Center for Internet Security, which houses the MS-ISAC, said last month that more than 3,000 organizations have signed up and 24 states are members in some form.

But the Trump administration said there is more to come in intergovernmental cooperation. The National Cyber Strategy pledges to “galvanize the role” of state, local, Tribal and territorial governments “as a complement to — not a substitute for — our national cybersecurity efforts.”

“To be honest, as we look towards the last administration and how they approached the Office of the National Cyber Director, they really lost sight of the opportunity of being able to work with our SLTT partners and truly the amazing people, leadership and experiences that come from the state and local level within cyber, and part of that is thinking about the broader context of expertise that comes from the state and local level,” said Monroe Molesky, director for state affairs at the White House Office of the National Cyber Director.

Critical infrastructure is one area where the federal government is looking to reset its relationship with states and localities, officials said on stage. Cairncross said when water, power, pipelines, telecoms and the like faced cyberattacks, the federal government used to come in afterwards as an auditor to tell system operators where they fell short. That must change, he said.

“This is not a regulatory compliance exercise,” Cairncross said. “If you were whacked by a foreign adversary, the United States government should not turn around and hand you a compliance list and say it's your fault because you didn't do these things. You should be working together, because it's the job of the [U.S. government] to defend the country from foreign adversaries and transnational criminal organizations.”

The pledge comes as hostilities in Iran have some experts worried about hacktivists linked to the country retaliating by attacking critical infrastructure on these shores, as they have elsewhere in the Middle East. Better securing systems and harmonizing regulations should be the federal government’s focus, speakers said, as well as hacking back themselves.

“We want to make sure that, on your worst day when you're dealing with a cyber incident, that you're thinking about how to keep critical systems online, how to ensure that vital services are flowing to the people that need them most,” said Seth McKinnis, deputy assistant national cyber director for critical infrastructure at the White House Office of the National Cyber Director.

Workforce development will also be crucial, speakers said, as governments at all levels confront vacancies in the public sector and a need to get people in place. Cairncross promised a cyber academy at the federal level that he said will build a “patriotic cyber force,” and find ways for some jobs in cyber to not require a four-year degree. 

Similar work will be done at the state level, said Brandon Dues, ONCD’s deputy assistant national cyber director for cyber workforce, including working with states to “scale up those best practices” on workforce development and replicate them elsewhere and removing duplicative efforts.

“The federal government can’t and should not do this alone,” Dues said.