Public-Private Partnerships and Collective Cyber Defence

The line between traditional military conflict and cyberattacks and related electronic crimes is increasingly blurred. Attacks by a wide range of malicious actors, ranging from state-sponsored or -sanctioned groups to independent criminal gangs of all sizes and levels of maturity, can degrade the confidentiality, integrity, and availability of entities critical to the continued orderly functioning of democratic free-market societies - and thus the continued orderly functioning of the global economy. To defend ourselves, we must prepare for, detect, defend against, and learn from such threats. How can the public and private sectors cooperate to this end? This paper explores how private sector firms can work with regulators, law enforcement, national cybersecurity, and defence agencies to help protect civil society. It presents the lessons learned by the FS-ISAC over more than 20 years of global activity, building collective defence capability in the financial sector and developing structures and capabilities to mitigate risks quickly and effectively through cooperation with government partners. The paper also lists recommendations for government stakeholders, from policymakers to defence and police agencies, on how to effectively support, and work with, private industry across national borders. Activities such as regulation, exercises, crisis response frameworks, and trust networks are all part of the repertoire that government and industry are jointly developing in the 21st century to safeguard against an ever-evolving and increasingly broad cyber threat landscape.