Group Pushes Economic Incentives for Security

Cybersecurity is fundamentally an economic issue rather than a technical one, and the government needs to address it by providing economic incentives to organizations rather than issuing regulatory mandates, the Internet Security Alliance (ISA) said in a report released Thursday.

"We will never have a sustainable system of cybersecurity until we change the economic equation that governs it," said Ty Sagalow, chief innovation officer of Zurich North America and chairman of the ISA.

ISA's report (PDF) on implementing elements of the Obama administration's cybersecurity strategy advocated a model of public sector-private sector partnership that was successful in establishing universal electrical and telephone service in the early 20th century. By providing incentives for cybersecurity investments, the government can help level the playing field in which cyber attackers now have all the advantages, ISA said.

The report is part of what the ISA called a continuing dialog on national cybersecurity strategy, started with the cybersecurity review by the Obama administration earlier this year. ISA President Larry Clinton said that solving some apparently vexing problems could actually be fairly easy.

"We have known for a number of years that we already know how to stop 80 to 90 percent of attacks" with existing security standards and best practices, Clinton said. But "companies are underfunding the security investments they ought to be making."

The question is how to get effective standards and practices implemented by the private sector, which controls the bulk of the nation's critical infrastructure that increasingly depends on digital technology. The solution offered is based on what ISA calls a social contract model, in which companies have incentives to include cybersecurity in business plans, rather than relegating it to an IT ghetto.

"We're not talking about a bailout or giveaways," Sagalow said. The plan combines legislation, leveraging government purchasing power and bringing in the insurance industry to help provide a way to quantify returns on security investments.

ISA created a list of key incentives to spur investment:

  • Create a cybersecurity safety act similar to the Safety Act passed after the Sept. 11, 2001 terrorist attacks that would provide marketing and insurance benefits for the products certified as implementing security technology, standards and practices.

  • Tie federal grants, loans and stimulus payments to the commercial adoption of approved cybersecurity standards and practices.

  • Leverage government purchasing power by increasing the importance of security in contract awards.

  • Streamline existing business regulations for information security, such as those in the Sarbanes-Oxley, Gramm-Leach-Bliley and the Health Insurance Portability and Accountability Acts.

  • Provide tax incentives for development of and compliance with cybersecurity standards.

  • Provide grants and direct funding for cybersecurity research and development.

  • Limit liability for organizations that implement proper standards and practices.

  • Create a national award for excellence in cybersecurity.

  • Promote cyber insurance to spur development and use of standards and practices, while helping companies to quantify and manage risk. This could also transfer some portion of the risk to the federal government in the case of a major cyber event.

The report also addressed improving methods of information sharing on cybersecurity issues between and among government and private-sector organizations. This would be done with certified threat reporters with the capability to detect and analyze threats, a National Cyber Threat Response Center as a central clearing house for reports and data, and vendors to use the information to push patches, updates and defensive measures into the field in the way that anti-virus now is updated.

Other issues addressed in the report include improving workforce and executive-level education in the corporate world, securing the global IT supply chain, international and legal issues, and standards for automation of security in technologies such as VoIP.

Some of the proposals in the ISA report are new ideas, and some have precedents from other sectors, Clinton said. "What we're saying is, apply these to cybersecurity."

About the Author

William Jackson is the senior writer for Government Computer News (


  • Surface and ARM: Why Microsoft Shouldn't Follow Apple's Lead and Dump Intel

    Microsoft's current Surface flagship, the Surface Pro X, already runs on ARM. But as the ill-fated Surface RT showed, going all-in on ARM never did Microsoft many favors.

  • IT Security Isn't Supposed To Be Easy

    Joey explains why it's worth it to endure a little inconvenience for the long-term benefits of a password manager and multifactor authentication.

  • Microsoft Makes It Easier To Self-Provision PCs via Windows Autopilot When VPNs Are Used

    Microsoft announced this week that the Windows Autopilot service used with Microsoft Intune now supports enrolling devices, even in cases where virtual private networks (VPNs) might get in the way.

  • Most Microsoft Retail Locations To Shut Down

    Microsoft is pivoting its retail operations to focus more on online sales, a plan that would mean the closing of most physical Microsoft Store locations.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.