Information Sharing and Member Engagement Best Practices

Lessons Learned from Attending the Auto-ISAC Summit

By Mayya Saab, Executive Director, FB-ISAO

I had the pleasure of participating in the Auto-ISAC Summit on 07 and 08 September 2022. I hesitated to register as it has been a while since I travelled for business or pleasure and the idea of traveling and congregating with others was very daunting to me. After a lot of thought (and some encouragement from the team, friends, and family) I decided to attend the Summit. As the Executive Director of the Faith-Based Information Sharing and Analysis Organization (FB-ISAO,) attending the summit was an opportunity to benchmark and to learn more about information sharing and member engagement best practices. I am so glad that I decided to go!

The Auto-ISAC is just one information sharing and analysis center (ISAC.) ISACs help critical infrastructure owners and operators protect their facilities, personnel and customers from cyber and physical security threats and other hazards. There are 16 critical infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so vital to the United States. ISACs are trusted entities established by critical infrastructure owners and operators to foster information sharing and best practices about physical and cyber threats and mitigation. Typically, nonprofit organizations, ISACs reach deep into their sectors, communicating critical information far and wide and maintaining sector-wide situational awareness.

The FB-ISAO is an information sharing and analysis organization. DHS states: “America’s cyber adversaries move with speed and stealth. To keep pace, all types of organizations, including those beyond traditional critical infrastructure sectors, need to be able to share and respond to cyber risk in as close to real-time as possible. Organizations engaged in information sharing related to cybersecurity risks and incidents play an invaluable role in the collective cybersecurity of the United States. However, many companies have found it challenging to develop effective information sharing organizations—or Information Sharing and Analysis Organizations (ISAOs).”

To maintain situational awareness across the various critical infrastructure sectors, ISACs and ISAOs collaborate and share threat and mitigation information with each other and other partners through the National Council of ISACs.

Back to the Auto-ISAC Summit… I was astounded by the number of people who participated. The Auto-ISAC serves the automotive sector and is an industry-driven community to share and analyze intelligence about emerging cybersecurity risks to the vehicle, and to collectively enhance vehicle cybersecurity capabilities across the global automotive industry. Auto-ISAC members are many and include the top car manufacturers in the U.S. and across the world. The membership encompasses the supply chain that makes up the auto-industry. Needless to say, the large ballroom where the speakers and panelists shared their knowledge was packed.

The summit agenda was engaging and included industry experts, members of the Auto-ISAC, members from other ISACs, representatives of the U.S. Government Agencies to include NHTSA, CISA and the FBI as well as vendors in the space. The vendors did an amazing job of integrating into the community by way of collaboration. Representatives of the U.S. Government emphasized their support of the work being done to secure the sector.

I learned so much – much more than I can write in this post!

• Information sharing works. The Auto-ISAC and other ISAC communities testified to that during their presentations and discussions. Government officials also attested to the success of information sharing initiatives during their presentations.
• Member engagement is vital. Members of ISAC / ISAOs need to put in the work, however, members did point out that there are so many benefits to participating and those include:
  • The ISAC / ISAO keeps everyone moving in the same direction.
  • Joining an ISAC / ISAO means belonging to a trusted community that “has your back.”
  • Participating in an ISAC / ISAO means leveraging other smart people to help with the myriad of security related challenges that the sector must address.
  • Being part of an ISAC / ISAO makes one ‘look up’ and to be in a position of anticipating as opposed to reacting.
  • Identifying challenges presents opportunities for further and deeper collaboration.
  • Since preparedness and resilience contribute to security and security is a long game, being part of something bigger than one has infinite benefits.
  • Tackling security issues is not an easy process, however, one can invest in oneself, and others, to teach and learn. If everyone does that, the job becomes easier.
  • Members, and member organizations, must make an investment of time and money.

I also learned that consistency is key. Members must anticipate that they will need to work together regularly. Intermittent engagement means losing momentum – as members of the Auto-ISAC community noted, and that won’t work.

Then there’s a whole slew of groups that are doing great work! There are working groups, committees and tiger groups. They all meet a need, and they all serve a function. The team and I look forward to having to manage that many groups as we grow the FB-ISAO together!

Finally, it was obvious to me that Auto-ISAC members, the Auto-ISAC team, the various partners, and vendors reached, and continue to negotiate, their needs and goals. They are BIG on getting and using feedback to benefit the resiliency of the entire community. In that sense, FB-ISAO has a lot of work to do. FB-ISAO asks for feedback often. We do this by way of asking for feedback on our products, on the Priority Intelligence Requirements, and on the utility of our collaborative workspace. I challenge each and every member of FB-ISAO to reach out to the team to tell us what you need – what are your goals for joining FB-ISAO? What resources and products should we focus on? What threat intelligence are you looking for? What training do you think you need?

I left the Auto-ISAC summit energized. I learned so much about member engagement and information sharing best practices. Although the Faith-Based Information Sharing and Analysis Organization and the Automotive ISAC serve two very different communities, the road to building resiliency in the Auto sector and for the faith-based community is much the same. FB-ISAO has some more maturing to do, but certainly the community faces challenges that are better faced together. I hope this post motivates the faith-based community to deepen their commitment to the FB-ISAO and get to work with fellow members. I know we have work to do. I also know that we can do it. I hope you will join me and your community!

Reduce the threat.

Protect the free practice of faith.