世界经济论坛-网络信息共享：建立集体安全（英文）-2020.10-26页_1mb

Cyber Information Sharing: Building Collective Security

Core Content

Cyber information sharing is essential for transitioning from individual to collective cyber resilience in a globally interconnected digital ecosystem. It enables organizations to defend themselves, enhance their resilience, and conduct collaborative investigations to detect and deter cyber threats. This report highlights the growing importance of cybersecurity in the context of the Fourth Industrial Revolution and the need for new technologies and frameworks to address existing barriers.

Main Views

• Cyber information sharing is a defining feature of the cybersecurity community and a critical shared challenge.
• The Fourth Industrial Revolution has accelerated the digitization of business and commerce, making cybersecurity a strategic issue.
• Traditional models of information sharing are not sufficient for the current and future digital landscape.
• New technologies such as AI, ML, and Privacy Enhancing Technologies (PETs) are key to enabling more effective and secure information sharing.

Key Information

The Importance of Cyber Information Sharing

• Strategic, operational, and technical information sharing is necessary for organizations to defend against cyber threats.
• No single entity can identify and address all cyber threats in isolation; collaboration is essential.
• Information sharing helps build trust and enables collective action between the public and private sectors.

Barriers to Cyber Information Sharing

1. Gaps in jurisdictional and cross-sector collaboration

   • Trust and legal barriers hinder collaboration between regions and sectors.
   • Some countries and sectors lack established frameworks for information sharing.

2. Skills and capabilities

   • A significant cybersecurity skills gap exists, especially in threat intelligence.
   • Many organizations lack the expertise to effectively share and use cyber intelligence.

3. Trust and privacy concerns

   • Stakeholders are often reluctant to share due to fears of privacy violations and legal exposure.
   • There is a lack of sector-specific guidance on privacy and rights in cross-sector information sharing.

4. Legislation, policy, and data fragmentation

   • Conflicting regulations across jurisdictions complicate information sharing.
   • Data localization policies and the GDPR have created legal and operational hurdles.

5. Operational costs

   • Implementing and maintaining information-sharing systems requires investment in technology, staff, and governance.
   • Many organizations, especially in developing economies, lack the resources for a holistic strategy.

6. Lack of clear incentives

   • There are limited incentives for organizations to participate in information-sharing ecosystems.
   • Organizations are concerned about reputational and legal risks and lack insurance incentives.

7. Interoperability and technology barriers

   • The lack of standardized formats and platforms hinders widespread adoption.
   • Open-source tools like MISP, The Hive, Cortex, and IntelMQ exist, but technical resources are still needed for implementation.

Next-Generation Technologies

• AI and ML enhance the effectiveness and value of shared data by automating analysis and improving detection rates.
• Privacy Enhancing Technologies (PETs) allow for secure and confidential information sharing while protecting privacy and security.
• The combination of AI/ML and PETs can dramatically improve the ability of organizations to protect themselves and build a resilient digital ecosystem.

Case Studies

• FS-ISAC: A financial industry consortium that helps reduce cyber risk through intelligence sharing and collaboration.
• Cyber Threat Alliance (CTA): A not-for-profit organization that enables near real-time sharing of cyberthreat intelligence.
• CDA (Cyber Defence Alliance): A consortium of financial institutions working with law enforcement to prevent cybercrime and identify threat actors.

Recommendations

• Develop clear and consistent legal frameworks to support cross-border and cross-sector information sharing.
• Create sector-specific guidance tools that map privacy principles to information-sharing practices.
• Promote interoperability and standardization of data formats and platforms.
• Invest in AI and ML technologies to automate and scale threat intelligence analysis.
• Incentivize information sharing through tangible benefits, liability protections, and insurance mechanisms.
• Encourage collaboration between public and private sectors to build a more resilient cybersecurity ecosystem.

Conclusion

Cyber information sharing is a strategic enabler of collective security in the digital age. It requires systemic improvements in cooperation, capacity, and governance, supported by next-generation technologies and clear incentives. The report emphasizes the need for bold leadership and new policy frameworks to drive the adoption of a more effective and secure information-sharing paradigm.

Contributors and Endnotes

• The report was developed by the World Economic Forum's Global Future Council on the Future of Cybersecurity.
• It reflects insights from Council Members and the Centre for Cybersecurity's extended community, including Technology Pioneers.
• References are provided to support the key points and case studies discussed.