Keys to Successful Info Sharing

If everyone supports the idea of sharing cyberthreat information, then why is information sharing so difficult? Shawn Henry, a former investigator with the FBI, tells how organizations can clear their biggest hurdles.

The private sector is too concerned about sharing data that might compromise client information, Henry contends. Instead, businesses and organizations need to focus on the value of providing law enforcement officials with limited cyber-attack information that can be used to thwart future threats.

"The sharing between the government and the private sector is not as robust as it needs to be," he says in an interview with Information Security Media Group. "Some companies still have some concerns that by sharing information they will reveal too much."

But these types of privacy concerns should not hinder intelligence sharing, Henry says. "There is no need to share content," he explains. "What you need to share are a lot of the technical data, the indicators that there has been a compromise." That data includes, for example, signatures associated with malware.

All cyber-investigations require some sort of international collaboration and cooperation, Henry adds. But communication between the private and public sectors, domestically and internationally, has plenty of room for improvement, he says.

Lessons from DDoS

Sharing information has become increasingly critical in the wake of the recent distributed-denial-of-service attacks waged against leading U.S. banks, Henry says. "Once you can determine where those attacks are coming from, you can take law enforcement action."

During this interview, Henry discusses:

• The actors that are waging attacks against leading U.S. organizations and agencies;
• Why DDoS attacks are concerning;
• The varying threats financial services, government and other sectors face.

Henry, who left the FBI in March 2012, is now the president of cybersecurity firm CrowdStrike. While at the FBI, he oversaw international computer crime investigations involving DDoS attacks, bank and corporate breaches and state-sponsored intrusions. Over the course of his 24-year career, Henry worked in three FBI field offices, as well as in the bureau's headquarters. He oversaw the posting of FBI cyber-experts in police agencies around the world, including the Netherlands, Romania, Ukraine and Estonia.