Menu
Cybersecurity firms step up intel sharing despite issues of trust

Cybersecurity firms step up intel sharing despite issues of trust

The collaboration has been protecting companies from the latest cyber attacks

The war against cybercriminals won’t be won alone. To keep hackers at bay, security vendors are establishing more ways for their customers to cooperate and share data about the latest threats -- even as it sparks concerns about trust and competition.

“We have to win this war together,” said Ben Johnson, chief security strategist of Carbon Black.

The company is the latest to help pool together security expertise with a new platform called the Detection eXchange.

Carbon Black protects the networks of thousands of companies, and it's now opening a line of communication between them. More than a virus signature or an IP address, the exchange aims to foster the sharing of "patterns of attack," which identify behaviors and tactics employed by malicious hackers.

That can be valuable knowledge, Carbon Black says, because those patterns are harder for hackers to quickly change than something like an IP address.

Although CISA has raised concerns about privacy, because the government will be the clearing house for data that gets shared, security vendors say collaborating on intelligence can help their clients prevent the next cyberattacks.

Palo Alto Networks is another vendor trying to build a culture of cooperation. The industry has been focused on protecting data, but it needs to share it too, said the company’s chief security officer, Rick Howard.

In 2014, Palo Alto Networks joined with rivals including Fortinet, Intel Security and Symantec to form the Cyber Threat Alliance. The vendors are each sharing around 1,000 malware samples each day and using that data to bolster their security products.

The alliance is still small, with only about eight members, but Howard believes it will be a “game changer” if the group can expand to 50.

Eventually, the alliance aims to have have enough intelligence to keep pace with the latest strategies hackers are using, which will let them move faster in protecting clients.

The collaboration clearly has it benefits, but an alliance in which competing vendors share information that's central to their businesses isn't easy to pull off. 

“When I first started, I gave it a year," Howard said. "I thought, 'There's no way this is going to hold together.'"

But customers like it and regularly encourage the company to expand the cooperation. He's optimistic that it could last. “We had to learn to trust each other, because we don’t like each other,” he jokes.

The intelligence sharing fills gaps in what each security vendor knows. For instance, Palo Alto Networks and Symantec overlap in only about 70 percent of the malware intelligence they share, according to Howard.

The reluctance to share may also be a challenge for Carbon Black. Companies prefer to keep data private and fear revealing too much, Johnson said, which is why contributors can chose to share on its platform anonymously. But he maintains it's useful at a time when IT security talent is scarce.

“Small companies can understand what big companies are seeing and vice-versa,” Johnson said.  “It’s a tremendous benefit.”

Jane Wright, an analyst at Technology Business Research, said Carbon Black’s exchange can act as a “water cooler” where security professionals talk about best practices and incident response. Even so, "sometimes the most valuable sharing just isn’t happening,” she said.

A major fear is that information shared about vulnerabilities or a company's infrastructure may be leaked accidentally to other hackers. But the pros can outweigh the cons. Companies Wright has talked to see the benefits of wider collaboration and even expect it from their vendor. They realize they’re walking a fine line between the risk of sharing too much and potentially stopping the next cyber attack.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

Ingram Micro completed its nationwide roadshow in Auckland last month, kicking off its Innovation Hour series with Hewlett Packard Enterprise. Uncovering the latest in storage, networking and servers, the event outlined key market trends for resellers in 2016 and beyond.

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise
IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

FireEye welcomed 143 channel partners and distributors to FireEye's 2016 annual Partner Conference, FireEye A/NZ Momentum - held at Establishment in Sydney. Delegates heard from senior trans-Tasman channel leaders, marketing and the product divisions in the morning, with FireEye customers, incident responders and threat intelligence analysts sharing knowledge during the afternoon.

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference
​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​

​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​

With New Zealand businesses now open to innovation, the industry sits on the cusp of significant disruption in the data centre. Driven by software-defined networking, the future of the data centre is fast becoming reality, as the channel seeks to keep up, keep innovating and keep growing. APC by Schneider Electric, Lenovo and key partners outlined how the channel can capitalise at The Grill restaurant in Auckland.

​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​
Show Comments