News

Group Pushes Economic Incentives for Security

• By William Jackson
• December 03, 2009

Cybersecurity is fundamentally an economic issue rather than a technical one, and the government needs to address it by providing economic incentives to organizations rather than issuing regulatory mandates, the Internet Security Alliance (ISA) said in a report released Thursday.

"We will never have a sustainable system of cybersecurity until we change the economic equation that governs it," said Ty Sagalow, chief innovation officer of Zurich North America and chairman of the ISA.

ISA's report (PDF) on implementing elements of the Obama administration's cybersecurity strategy advocated a model of public sector-private sector partnership that was successful in establishing universal electrical and telephone service in the early 20th century. By providing incentives for cybersecurity investments, the government can help level the playing field in which cyber attackers now have all the advantages, ISA said.

The report is part of what the ISA called a continuing dialog on national cybersecurity strategy, started with the cybersecurity review by the Obama administration earlier this year. ISA President Larry Clinton said that solving some apparently vexing problems could actually be fairly easy.

"We have known for a number of years that we already know how to stop 80 to 90 percent of attacks" with existing security standards and best practices, Clinton said. But "companies are underfunding the security investments they ought to be making."

The question is how to get effective standards and practices implemented by the private sector, which controls the bulk of the nation's critical infrastructure that increasingly depends on digital technology. The solution offered is based on what ISA calls a social contract model, in which companies have incentives to include cybersecurity in business plans, rather than relegating it to an IT ghetto.

"We're not talking about a bailout or giveaways," Sagalow said. The plan combines legislation, leveraging government purchasing power and bringing in the insurance industry to help provide a way to quantify returns on security investments.

ISA created a list of key incentives to spur investment:

• Create a cybersecurity safety act similar to the Safety Act passed after the Sept. 11, 2001 terrorist attacks that would provide marketing and insurance benefits for the products certified as implementing security technology, standards and practices.
  
  
• Tie federal grants, loans and stimulus payments to the commercial adoption of approved cybersecurity standards and practices.
  
  
• Leverage government purchasing power by increasing the importance of security in contract awards.
  
  
• Streamline existing business regulations for information security, such as those in the Sarbanes-Oxley, Gramm-Leach-Bliley and the Health Insurance Portability and Accountability Acts.
  
  
• Provide tax incentives for development of and compliance with cybersecurity standards.
  
  
• Provide grants and direct funding for cybersecurity research and development.
  
  
• Limit liability for organizations that implement proper standards and practices.
  
  
• Create a national award for excellence in cybersecurity.
  
  
• Promote cyber insurance to spur development and use of standards and practices, while helping companies to quantify and manage risk. This could also transfer some portion of the risk to the federal government in the case of a major cyber event.

The report also addressed improving methods of information sharing on cybersecurity issues between and among government and private-sector organizations. This would be done with certified threat reporters with the capability to detect and analyze threats, a National Cyber Threat Response Center as a central clearing house for reports and data, and vendors to use the information to push patches, updates and defensive measures into the field in the way that anti-virus now is updated.

Other issues addressed in the report include improving workforce and executive-level education in the corporate world, securing the global IT supply chain, international and legal issues, and standards for automation of security in technologies such as VoIP.

Some of the proposals in the ISA report are new ideas, and some have precedents from other sectors, Clinton said. "What we're saying is, apply these to cybersecurity."