Infosec industry calls for more public sector collaboration

While the private sector has increasingly contributed to law enforcement operations against cybercriminals and nation-state actors, infosec professionals agree there's more to be done as threats continue to rise.

Law enforcement agencies across the globe announced several takedowns over the year that successfully disrupted cybercriminal operations, particularly ransomware groups, and led to arrests of alleged threat actors in some cases. Many actions only temporarily impacted the threat landscape, and actors found ways to resume activities. But infosec experts agree they did make a difference.

In some cases, private sector collaborations made those law enforcement operations more successful through information sharing with government agencies. Those partnerships are important, but many infosec professionals told TechTarget Editorial they could be enhanced.

One of the most significant botnet takedowns ever, dubbed Operation Endgame, occurred in May. The international effort resulted in four arrests, more than 100 server seizures and 2,000 domain takeovers. The takedown disrupted several malware droppers, including IcedID, Smokeloader and TrickBot, that attackers often used to bypass detection tools to deploy ransomware. Operation Endgame involved agencies from all over the world as well as private industry partners such as BitDefender, Proofpoint and the Shadowserver Foundation.

Randy Pargman, director of threat detection at Proofpoint, expanded on Proofpoint''s contributions to the operation. Pargman told TechTarget Editorial that one goal Proofpoint set for itself is to share specific information it had discovered with law enforcement agencies, which can use it to take action against threat actors.

"Proofpoint threat researchers shared their technical expertise of botnet infrastructure, identifying new patterns in how the threat actors set up their servers and proactively identifying new malware infrastructure as it was created," Pargman said. "We lent our expertise in reverse engineering malware to provide accurate and insightful information about how the bot clients were designed and written, which helps law enforcement understand how to safely remediate it."

He added that threat researchers helped law enforcement identify the largest and most effective malware distribution campaigns. "We also used our extensive knowledge of how many botnets started and grew over time to identify the new botnets that are most likely to grow and become the dominant threats affecting the most number of people around the world," Pargman said.

There are other ways private sector companies can assist law enforcement efforts. Mark Lance, vice president of digital forensics and incident response at GuidePoint Security, said his company urges clients they've worked with to set up threat intelligence sharing groups. "We're not asking them to share trade secrets with their direct competitors but share with what you're dealing with because everyone's dealing with it, so let's be open and learn from it," Lance said. "There used to be a stigma associated with incidents, like they don't want to talk about it, and no one will acknowledge it."