It's time for a National Cybersecurity Safety Board (NCSB)

In his book The Psychological Edge: Strategies For Everyday Living, clinical psychologist Dr. Samuel Shein writes that while we have a National Transportation Safety Board (NTSB), there is no National Psychological Research Board (NPRB). A group like the NPRB could investigate national disasters caused by those with psychological issues.

Even with tragedies such as the Columbine High School and Sandy Hook Elementary School massacres, to the Heaven's Gate mass suicide, 9/11 and more; the US still lacks a central agency that deals with psychological-based tragedies. Creating a NPRB could be crucial to avoid future tragedies and senseless deaths.

With regards to information security, the Sony breach of 2014 shows that the time has arrived to create a National Cybersecurity Safety Board (NCSB). The debacle of the FBI prematurely attributing the attack to the North Korean government is still causing embarrassment, especially to information security professionals who note that attribution, and determination of root cause and probable cause, takes time to determine.

As for the NTSB, in 1967, Congress established the NTSB as an independent agency placed within the Department of Transportation (DOT). Based on that, the NCSB would likely be placed within the Department of Commerce, Federal Trade Commission or most likely the Department of Homeland Security.

In creating the NTSB, Congress envisioned that a single organization with a clearly defined mission could more effectively promote a higher level of safety in the transportation system than the individual modal agencies working separately.

In 2000, the NTSB embarked on a major initiative to increase employee technical skills and make its investigative expertise more widely available to the transportation community by establishing the NTSB Academy at George Washington University. To date, it has issued over 13,000 safety recommendations to more than 2,500 recipients.

Based on the success of the NTSB, I think a NCSB that could perform similar tasks when it comes to information security. Transportation disasters and security breaches have many parallels, and by having a body to investigate information security breaches and advise on security safety, the entire industry would benefit.

What would a NCSB look like? As a start, when an investigation of a major breach would occur, there would be a NCSB go team comprised of specialists in fields. The go team would include experts in the following areas: malware, digital forensics, application security, network security, network infrastructure, operating systems and more. They would work in concert with the breached organizations and affected vendors.

Like the NTSB, the NCSB would determine if it needs to hold a public hearing on the breach. After all that is done, it would publish a final report and issue security recommendations. Like the NTSB, the NCSB would likely not have any legal authority to implement, or impose, its recommendations. That burden would fall upon regulators at either the federal or state level.

The NTSB also has a Most Wanted List, which represents the agencies' advocacy priorities, designed to increase awareness of, and support for, the most critical changes needed to reduce transportation accidents and save lives. The NCSB would also issue its annual cybersecurity most wanted list.

Creating the NCSB in the model of the NTSB would be a benefit to every US organization. After megabreaches at Anthem, Heartland Payment Systems, Evernote, TJX, Target, Home Depot, Sony and much more; it still leaves us in early 2015 at a standstill, when it comes to breach information sharing, cause determination and proposed recommendations.

Creating a NCSB is an idea whose time has come. If it does get created, it will be a crucial step in the growth and maturity of information security.

Ben Rothke CISSP is with Nettitude and the author of Computer Security: 20 Things Every Employee Should Know.

Join the CSO newsletter!

Error: Please check your email address.

Tags NPRsecuritysecurity awarenesssonyfbiNational Transportation Safety Board

More about Department of CommerceEvernoteFBIFederal Trade CommissionHome DepotSonyTransportation

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Ben Rothke

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place