In White House Plans Proactive Cyber-Security Role for Spy Agencies Brian Kreb writes,
America’s spy agencies for the first time would be tasked with gathering intelligence on threats to the nation’s computer networks under a policy that could be detailed by the White House as early as next week, a senior administration official said Wednesday.
Not sure how well this will work in practice. Intel agencies are not inclined to share their methods and results, but the best defense against exploits is information about preventing them or patching the vulnerability. As noted futher down in the article:
Alan Paller, director of research at the Bethesda based SANS Institute, which tracks hacking trends, said few federal civilian agencies or private sector companies have the analysts or computer power to spot the most stealthy cyber attacks. Agencies like the NSA, he said, are in a bit of a tight spot in sharing new threat information with allies and the private sector, because spy agencies very often glean intelligence by exploiting the very same security vulnerabilities in hardware and software used by enemies of the United States.
“This is the oldest conflict in security, because if we give away our best exploits, we lose the ability to use them offensively,” Paller said. “That’s a conflict the guys at NSA deal with every day. When you find good ones, how long do you wait before you tell the vendors and people defending our own networks?”
Discussion on Brian Kreb’s column Security Fix
