The past few months have shown that collaborations between experts from the cybersecurity industry and the public sector are efficient at disrupting cybercrime.
Drawing on big successes, like the LockBit takedown, Operation ‘Trust No One’ or the LabHost operation, the World Economic Forum’s (WEF) Partnership against Cybercrime released a framework to strengthen anti-cybercrime collaboration.
Outlining the ‘why’ and ‘how’ of operational collaborations, the WEF paper highlighted three pillars of cooperation:
- Incentives for organizations to collaborate
- Elements of a good governance structure
- Resources required to set up, maintain and accelerate partnerships
The World Economic Forum’s Anti-Cybercrime Roadmap
Incentives for Collaboration
According to the WEF, successful operational collaborations to counter cybercrime should demonstrate the following:
- A clear mission: This provides participants with an ongoing justification for joining and remaining part of the collaboration
- A substantial impact, suggesting the need for frequent feedback to individuals, participating organizations and external stakeholders
- Peer-to-peer learning and feedback loops
- Public recognition, using several communication channels providing an additional business incentive to engage
- Cyber-resilience as a value creator: Information obtained from collaboration can be used to improve cyber defenses and post-attack recovery
Organization and Governance
The WEF highlighted the need for flexible governance frameworks that support stringent control over sensitive areas, such as data management and use, through legal contracts, where necessary, while allowing different stakeholders some leeway depending on the nature of the organization.
“While some parts of governance will be rigid, others will need to have space into which the collaboration can grow,” the paper summarized.
The WEF cited its Cybercrime Atlas and the Cyber Threat Alliance (CTA), a US-based nonprofit organization, as examples of existing structures that can help build such operational frameworks.
The WEF also advocated for membership capability assessments. “Participants in a collaboration are sought based on the capabilities they bring and they [should] understand what they are obliged to provide to the collaboration in order to retain membership. The collaboration has ways of measuring engagement and the value provided by each member,” the paper explained.
Neal Jetton, Interpol’s Cybercrime Director, commented: “For effective operational collaboration, appropriate governance structures are necessary to strike a balance between the costs and benefits for affected stakeholders. Interpol’s Cybercrime Directorate is accountable to member countries and we strive to fight cybercrime with open, inclusive and diverse partnerships for a safer world.”
Data Normalization
Finally, the WEF advised stakeholders engaged in anti-cybercrime collaboration to define common taxonomies and use data normalization tools to ensure a cohesive response.
“As cyberthreat information is typically generated by a variety of sensors, systems and platforms, it arrives in different formats, often incompatible with one another,” reads the WEF paper. “Through the process of data normalization, these disparate data streams are converted into a unified structure, which is essential for effective aggregation, analysis and dissemination across stakeholders.”