Hacked Opinions is an ongoing series of Q&As with industry leaders and experts on a number of topics that impact the security community. The first set of discussions focused on disclosure and how pending regulation could impact it. Now, this second set of discussions will examine security research, security legislation, and the difficult decision of taking researchers to court.
CSO encourages everyone to take part in the Hacked Opinions series. If you would like to participate, email Steve Ragan with your answers to the questions presented in this Q&A. The deadline is October 31, 2015. In addition, feel free to suggest topics for future consideration.
What do you think is the biggest misconception lawmakers have when it comes to cybersecurity
Mike Patterson, Vice President of Strategy, Rook Security (MP): Cybersecurity laws won’t play as big of a role in making companies more secure. While they can be effective in raising minimum standards, any company who is waiting on lawmakers to tell them what to do for security is already behind. The best companies are cutting the trail and not waiting for lawmakers to tell them what the best approach is.
What advice would you give to lawmakers considering legislation that would impact security research or development
MP: Fund it! Security is important not only to our economy, but to the national security of the United States. The ROI on security R&D is infinite.
If you could add one line to existing or pending legislation, with a focus on research, hacking, or other related security topic, what would it be
MP: Given the speed at which security moves (fast) and the speed at which legislation moves (slow), any pending security legislation should have a provision that allows updates to the law to be fast-tracked and not get bogged down in red tape.
Now, given what you've said, why is this one line so important to you
MP: If lawmakers want to get serious about security, they need to match the pace at which security moves.
Do you think a company should resort to legal threats or intimidation to prevent a researcher from giving a talk or publishing their work Why, or why not
MP: While there are cases where pointing out security flaws to the public can be counterproductive, companies generally should not attempt to silence researchers acting in the public interest.
Some companies pass on the chance to remediate a flaw discreetly and the researcher has no option but to go public. Unfortunately, public pressure can be more motivating to get companies to take action.
What types of data (attack data, threat intelligence, etc.) should organizations be sharing with the government What should the government be sharing with the rest of us
MP: Organizations should join groups such as InfraGard and share relevant signatures, attack methods and other intelligence about movements made by bad actors, especially groups waging cyber warfare against the country.
If these public-private partnerships are going to work long-term, the government needs to be sharing more with the private sector. This includes dossiers on various hacker groups, the IP groups they operate out of, attack methods, signatures, etc. Knowing what to be on the lookout for makes it a lot easier to identify and make sense of suspicious activity.