The FISMA Focus IPD

This installment, let’s examine the following questions:

• The government gives up an awful lot in CISA in terms of reassurances to the private sector. Why?
• What’s the deal with the “other” portal?
• Why exactly is the FBI so worried?

As I argued in my last post, understanding DHS’s Automated Indicator Sharing (AIS) Portal is critical to answering all three questions. The AIS threat indicators are tightly constrained, both to exclude personal information unrelated to the threat and to ensure that only specific types of actionable indicators are shared. A great many threat indicators might be relevant to understanding and countering cybersecurity threats and still simply not appropriate to AIS. The goal here is broader, faster, coordinated sharing of basic information to empower private companies to better understand and responsibly respond to threats on their systems and to raise the level of government and industry awareness.