National Cyber Director: Bureau of Cyber Statistics needed to understand threat landscape

In an article published in Federal News Network, Josephine Wolff explains why she supports the idea of a national Bureau of Cyber Statistics in the United States.
Josephine Wolff headshot

As postmaster general of the fledgling U.S. Post Office, Benjamin Franklin gave postmasters a novel task: Jot down the local weather conditions and mail them back to headquarters on a postcard.

Piecing this information together from the field, Franklin concluded weather in one area didn’t exist in a vacuum, but was a product of conditions sweeping across the country from west to east.

National Cyber Director Chris Inglis, speaking Monday at the Atlantic Council, said the federal government should take the same approach to better understand, in terms of cyber threats, which way the wind is blowing.

“It wasn’t until we put that picture together that we understood what was happening locally. The same thing’s true in terms of what’s happening in cyberspace,” Inglis said. “Unless we can ride across the boundaries that jurisdictionally divide us, we’re not going to find the trends that afflict all of us, and we, therefore, have to appeal to a collection of that data somehow so that we can get our arms around this.”

Inglis urged Congress to stand up a Bureau of Cyber Statistics within the Department of Homeland Security that would collect, analyze and publish data on cybersecurity, cyber-crime and threats.

The idea of the Bureau of Cyber Statistics originates with the Cyberspace Solarium Commission, which also urged Congress to create Inglis’ current job. The bureau, as envisioned by the commission, would mandate organizations offering cyber response services or insurance products provide this data for statistical purposes every 180 days.

[...]

Josephine Wolff, assistant professor of cybersecurity policy at Tufts University’s Fletcher School of Law and Diplomacy, said a Bureau of Cyber Statistics would provide a level of statistical rigor that’s been lacking in the cyber policy arena, and would help agencies better understand where to commit limited resources.

“There will always be data points we’re missing, with the understanding that this landscape will change and we’ll need to keep thinking things through as things evolve, but knowing that there are some questions that we should be able to answer here that we can’t is very disheartening,” Wolff said.

Read More