Why wouldn’t the government disclose a cybersecurity vulnerability? According to a White House blog post, it could mean foregoing “an opportunity to collect crucial intelligence that could thwart a terrorist attack, stop the theft of our nation’s intellectual property, or even discover more dangerous vulnerabilities that are being used by hackers or other adversaries to exploit our networks,” writes White House cybersecurity coordinator Michael Daniel.
Would there be a greater return on investment if our information sharing focused less on enabling private sector victims to better duck and cover, and focused more on enabling the government to get the bad guys?
Regardless of how vigorously the industry applies risk management principles and how diligently the government shares information, there is no chance the private sector can consistently withstand intrusion attempts from foreign military units and intelligence services or even, for that matter, from transnational organized crime.