{"id":23629,"date":"2016-02-17T15:56:16","date_gmt":"2016-02-17T15:56:16","guid":{"rendered":"https:\/\/one.sightlinemg.com\/federaltimes\/uncategorized\/2016\/02\/17\/dhs-releases-initial-guidelines-for-cyber-threat-info-sharing\/"},"modified":"2026-08-08T04:49:18","modified_gmt":"2026-08-08T04:49:18","slug":"dhs-releases-initial-guidelines-for-cyber-threat-info-sharing","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/federaltimes\/management\/2016\/02\/17\/dhs-releases-initial-guidelines-for-cyber-threat-info-sharing\/","title":{"rendered":"DHS releases initial guidelines for cyber threat info-sharing"},"content":{"rendered":"\n

The Department of Homeland Security is moving forward with the biggest piece of cybersecurity legislation passed last year, issuing preliminary guidance on how the private sector and government will communicate threat data as part of the Cybersecurity Information Sharing Act.<\/p>\n\n\n\n

In cybersecurity \u2014 possibly more so than most other endeavors \u2014 knowledge really is power.\u00a0Knowing the signature of an attack vector, the telltale signs of certain types of malware or, as DHS Secretary Jeh Johnson suggested, “the subject line of a spear-phishing email or the IP address of the computer from which it originated” can help defenders block malicious traffic and stop hackers in their tracks.<\/p>\n\n\n\n

Of course, that only works on a large scale if that information is shared in a timely manner.<\/p>\n\n\n\n

“These guidelines provide federal agencies and the private sector with a clear understanding of how to share cyber threat indicators with DHS’s National Cybersecurity and Communications Integration Center and how the NCCIC will share and use that information,” Johnson said in\u00a0a news release.<\/p>\n\n\n\n

Johnson pointed to DHS\u2019s Automated Indicator Sharing system, which is how the government and private sector currently <\/span>share threat data in real time. The guidance, released Feb. 16, for persons and companies sharing with the government\u00a0updates the procedures for info-sharing, which\u00a0include new liability protections and require the scrubbing of personally identifiable information.<\/p>\n\n\n\n

“The law importantly provides two layers of privacy protections,” he said. “Companies are required to remove personal information before sharing cyber threat indicators and DHS is required to and has implemented its own process to conduct a privacy review of received information.”<\/p>\n\n\n\n

The new guidelines offer companies a road map for how to share information with the government while staying within the bounds of the law, as well as how the feds will reciprocate.<\/p>\n\n\n\n\n\n

The guidance includes four draft documents:<\/p>\n\n\n\n