CISA Gives Protection For Sharing Cybersecurity Attack Information

The US Chamber’s public letter on cybersecurity last month urged businesses to take full advantage of the Cybersecurity Information Sharing Act signed into law by President Obama in December 2015. It caused renewed interest in the law, and this post outlines how small and midsized businesses can be sheltered by it when they partner with others to deal with the most common cybersecurity threat, spear phising.

Used in even the most sophisticated cyber-attacks, spear phising is nothing more than getting employees to transfer money or information by emails pretending to be from another person authorized to make the requests.

Spear phishing works when bad actors steal enough information to know who to impersonate and who to give orders to.

The information is stolen in many ways. Tracking how thieves attacked your company is vital to secure your systems and prevent future attacks. Re-creating the crime often means sharing information with financial institutions, suppliers, customers, employees, law enforcement, and others.

The thieves won’t sue you for exposing their activity, but if personal information about people is exchanged in the tracking process, lawsuits and other legal damage can and does result.

The CISA protects companies sharing information about specific individuals in connection with “cyber threat indicators” and “defensive measures” for a cybersecurity purpose. If you follow its rules, among other things your company can’t be sued for sharing the information.

To make it easier to follow the rules, the Homeland Security and Justice Departments released a CISA owner’s manual, “Guidance to Assist Non-Federal Entities to Share Cyber Threat Indicators and Defensive Measures with Federal Entities Under the Cybersecurity Information Sharing Act of 2015.”

https://www.us-cert.gov/sites/default/files/ais_files/Non-Federal_Entity_Sharing_Guidance_%28Sec%20105%28a%29%29.pdf

Personal information is involved in the description of a spear phishing attack by definition. The Guidance recognizes this includes information about the bad actor, the subject line, the email message content, message ID, and X-Mailer. But the identity of the individual being impersonated and his or her email address are information you must scrub because it is “not directly related to” the threat.

Also needing to be removed are such things as protected health information, HR information, consumer purchasing history or preferences, and financial information.

Liability protection for sharing with the federal government requires you to go through the process set up by the Department of Homeland Security at the National Cybersecurity and Communications Integration Center. It is a 24/7 management center where incidents can be reported through the US-CERT Incident Reporting System. https://www.us-cert.gov/forms/report

Good features of the CISA assure you that sharing threats and defensive measures does not waive privileges like the lawyer/client privilege or protections for trade secrets. Sharing can’t violate the antitrust laws or make proprietary information public. And shared information can’t be used by federal, state or local regulators.

Additional requirements include restrictions imposed by other parties sharing information with you, and having a “security control” to guard threat indicators and defensive measures from unauthorized access.

Yes, there’s a cost for CISA’s protections. But it has many benefits and compliance has benefits beyond the ones built into the law, such as providing an excellent roadmap when managing a spear phising attack. Deciding whether to share threat information or defensive measures under the CISA should ideally be part of your overall cybersecurity strategy.

Smaller and mid-sized companies may not feel they can afford the luxury of developing a cybersecurity strategy at leisure, so their strategy may have to be the result of dealing with threats as they occur.

Being aware of CISA’s protections and requirements can still be valuable if you must make decisions while under attack.

About Craig Pinkus

Craig Pinkus is a partner in the Intellectual Property Group. He also is a member of the Litigation and the Sports, Entertainment and Media Groups. He assists clients with a broad range of disputes and transactions involving all areas of intellectual property, entertainment, and other complex business arrangements. He has conducted trials and arbitrations throughout the United States and has argued appeals before the Seventh, Sixth and Federal Circuit Courts of Appeal, the Indiana appellate courts, and United States Supreme Court.
This entry was posted in Cybersecurity, Uncategorized. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s