Comment from Ron Southworth
Time: March 23, 2007, 11:28 am

Dale I thought about sending you some words off blog. Like everyone I do this from time to time if it is more apropriate etc. The challenge for us all is to be as open about what we discuss as we can. I hope you did not see me as having a go at you as this was not what i was trying to convey at all. I commend that you are trying to consistantly convey a hig degree of openness.

I subscribe to the AUSCERT listings and the USCERT notifications but I dont know how many others would say the same as an end user. I can understand your conviction in regards to seing a method of sharing vulnerabilities but I dont’ know if the market is ready for the public openness you are trying to promote with vulnerabilities.

I think that the goal has merit perhaps a question of time or maybe for control systems a different approach is needed.

I can but only agree with Jake’s assessment as a general rule for the water industry - there are always exceptions.
The concerns he expressed are quite farmiliar.

An alternate apporach perhaps an answer maybe to look at developing a trust based information sharing system not just on vulnerabilities but also on qualitive threat analasys and mitigation techniques and other related subject matter.

Who do you bring together in the environment ? The government, vendors, consultants, end users and researchers.

This is something that a couple of us have been muting around these parts and it is early days but so far so good.

There is a need to take the IT info and have it filtered and put into this trust sharing system mabe even use the sharing arrangements as part of the analasys and quantification process. There is a need to have credible analised threat information, assistance with forensics and in maintianing buisness continuity and probalby a host of other things that I have not mentioned.

Can you see some merrit in this alternate approach or is this the area where you have a fundamental difference of view?

Comment from Dale Peterson
Time: March 23, 2007, 11:53 am

Ron - don’t worry about offending me with comments. The comments that disagree are usually more interesting and thought provoking than the amen comments.

In the US there are Information Sharing and Analysis Centers, see http://www.isaccouncil.org/about/, by vertical industry that are trying the approach you describe. I have heard a couple are working ‘ok’, but most have not been very helpful. The problem is most participants are hesitant to share any information. They don’t see the benefit and worry about a possible leak. When stock prices and public confidence are at stake it is hard to argue their concerns are unwarranted.

This is one of the reasons we included Sandia’s paper on anonymous information sharing at S4. I’m not sure if they hit on the exact solution (it may be too complex), but the concept was interesting.

The NERC CIP standards requiring reporting cyber security incidents so that should be interesting to watch.

Comment from Ron Southworth
Time: March 24, 2007, 3:55 am

From my research to date I have found that the ISAC’s seem to be unidirectional. The info is flowing up to the top but not going back down. The exception may be the energy sector . The other aspect of making it a direct user pays system does not help. I think the shared burden model is much more appealing. I don’t think the concept of the ISAC is exactly the same as what I am talking about as teh concept is a bit more lateral and has provision for sector sharing. When we bed down things a bit better I will send you some graphical representations off blog of how we are trying to bring it all together.

Have a great weekend