March 18, 2022
Today’s White House announcement by Deputy National Security Advisor Anne Neuberger alerting the nation to evolving intelligence that Russia may be exploring options for potential cyberattacks speaks powerfully to the need for government and industry to engage in unprecedented levels of coordination and collaboration.
As the world bears witness to wrenching images coming out of Ukraine and the tragic toll Russia’s unprovoked and brutal aggression is taking on civilian populations, we are reminded that even in this modern era, lives can be upended in the blink of an eye and in unimaginable ways. As we collectively observe a powerful army wreak havoc on the lives of millions of innocent and courageous citizens of Ukraine, it serves as a stark reminder that we remain vulnerable to tyrants who disregard the most basic tenets of humanity. And while cameras and eye witnesses make the physical destruction visible to millions, other devastating threats lie under the surface where life and death matters are dependent upon a complex, global and intertwined digital ecosystem. It is not a stretch to say that in today’s world, societies may stand or fall based on the integrity and resilience of those systems.
Though there is still much work ahead, in this hyper-connected world that we all share, communications companies and other technology providers are serving with vigilance alongside our government partners on the front lines of this war. It is important to take account what we in industry have achieved, and how our ongoing work with government at all levels can be a pathway to even greater security in the cyber realm and beyond.
Indeed, while there are intense behind-the scenes cyber-related preparations associated with current geopolitical tensions, these efforts are built upon decades of collaboration and partnership with multiple government agencies in the defense, intelligence, law enforcement, and public safety communities from the federal level to state, local, tribal and territorial domains. Such activities are continuously reinforced with billions of dollars of industry investments in human, physical and cyber resources. Combined with a full-throttled industry commitment to work with government to continuously improve our defensive posture, we have a fighting chance to repel any serious cyber-attacks on our nation’s critical infrastructure. This is not to say that everything is operating like a Swiss watch or that we can protect every asset or function against a sophisticated, determined, and persistent adversary. However, what we can say is that in the cyber arena, the levels of awareness, preparations and engagement have never been more substantive.
When USTelecom was briefed by our national security and intelligence communities late last year on the potential for attacks on U.S. critical infrastructure by Russia and its agents, we immediately set in motion a call to action that focused on alerting broadband providers across the country to the possibility of major disruptions to their networks. We simultaneously reached out to senior government officials at the Federal Communications Commission (FCC) and at DHS’s Critical Infrastructure Security Agency (CISA), advising them that we were determined to keep all of our members informed of developments and especially our smaller and medium-sized members who were not part of the recently establish Joint Cybersecurity Defense Collaborative (JCDC) that included over 20 of the largest ICT companies including our three largest members (AT&T, Lumen, and Verizon). We were able to leverage critically important venues that were designed for such purposes including the Communications Information Sharing and Analysis Center (Comms ISAC) where information is routinely shared among member companies and representatives from numerous government agencies including the FBI, FEMA, Department of Defense (DoD) and Department of Justice (DoJ) to name a few. While the Comms ISAC coordinates operational readiness and response, the Communications Sector Coordinating Council (CSCC), which USTelecom Chairs, engages on broader overarching considerations to ensure that policies, procedures and protocols are optimally aligned with mission critical activities.
Together, these three entities have focused much of their energies on constructing the strongest possible safety net should the current conflict in Ukraine morph into a full-blown cyber war. Having well-organized and trusted venues during a crisis of this magnitude is table stakes for effectively managing the fallout from any potential major attack. By all indications, the appropriate stakeholders are being kept well-informed through regular briefings and alerts provided by CISA, the FBI and the intelligence community. Just as important, USTelecom and other trade associations have become vital amplifying channels to communicate directly to our respective members. This has required unprecedented levels of vigilance to ensure that insights revealed in multiple formal and informal venues are shared with the appropriate owners and operators as close to real-time as possible.
At the end of the day, it is the capabilities of individual companies and sectors that will determine how successful our nation will be in defending our privately-owned critical infrastructure against nation-state adversaries.
For the broadband innovation ecosystem we represent, ensuring the security of our networks and that of our customers has been in our DNA since the industry’s inception. As we made the transition from the analogue era to the digital age coupled with the growing threats and vulnerabilities, ensuring the availability and transactional integrity of the information carried over our networks moved cybersecurity to the top of enterprise risk management strategies. Unfortunately, there is too often an insufficient appreciation for the tools/tactics, techniques and procedures (TTPs) that companies in our sector deploy to ensure that our networks are secure and function as expected. Providing services to the world’s largest and most demanding customers including critical federal, state and local clients necessitates the highest levels of competence, vigilance and ongoing investment.
In 2018, USTelecom founded the Counsel to Secure the Digital Economy with the express purpose of delivering operational solutions, and today we are working in partnership with 15 global ICT companies and our co-facilitators at the Consumer Technology Association to evolve capabilities in such areas as fighting botnets, securing the IoT ecosystem, and building operational understandings about coordinated crisis response.
For USTelecom members and the communications sector writ large, our level of cybersecurity investment and innovation continues to grow dramatically as the networks evolve and as new services are introduced. For example, in the case of botnets, providers can detect previously unknown threats by using a combination of both static and dynamic heuristic analysis. Providers with teams of researchers can analyze suspicious code inside a sandbox to determine effective mitigation strategies, which can be shared with other stakeholders in the ecosystem. To make sense of the enormous amounts of data flowing through our largest networks, many leading providers use a technique called packet sampling. By reducing the amount of data that needs to be inspected, this technique allows operators of large networks to analyze traffic, even as the size and speed of modern networks increases. And when potentially malicious traffic is identified, providers can securely manage traffic either by using techniques that will typically result in the traffic being dropped or by delaying traffic when the data rate is anomalously high. Both of these techniques can be useful in specific circumstances and may be part of a comprehensive traffic management strategy. These examples are just a small subset of far-ranging basic and advanced capabilities that are commonly used by communication companies in their operating environment.
As government agencies, including the Federal Communications Commission (FCC) and the Securities Exchange Commission (SEC) contemplate new cybersecurity policies and compliance mandates, they should ensure their partners in industry can continue effectively to shore-up our shared cyber defenses, rather than being bogged-down by unproductive government red tape, reporting and other bureaucratic requirements.
One need look no further than the finance sector where it is estimated that its cyber practitioners now spend as much as 40 percent of their time responding to government compliance requirements. And if compliance checklists improved security, far fewer organizations that attested to following such prescriptions would not have found themselves so readily victimized.
The fact that the U.S. government and its cyber leaders have chosen to collaborate with industry during this crisis with great enthusiasm speaks to the obvious benefits of an approach that builds on trust and not the inevitable tensions that arise from overly prescriptive mandates and overwrought regulations. It is also a welcome sign that our government partners have recognized the need to revitalize interagency efforts to coordinate, streamline and de-duplicate their multiple and often overlapping cyber-related workflows, including those requiring engagement by industry counterparts. One such step was the decision to relaunch the Cybersecurity Forum for Independent and Executive Branch Regulators, a federal interagency group now led by FCC Chairwoman Jessica Rosenworcel that shares information and expertise to enhance the cybersecurity of America’s critical infrastructure.
USTelecom and our members understand that government and industry need each other to defend and protect our nation’s families, communities, enterprises and infrastructure from cyber threats, be they from Russia or any other current or future adversary. Should the current crisis bleed over into the cyber arena, the trust and capabilities that we have built in partnership over many years will prove their value decisively.
Jonathan Spalter is President and CEO of USTelecom – The Broadband Association.