This podcast is brought to you by bankinfosecurity.com. Bankinfosecurity.com is your source for the news and views, shaping security and risk management within the finance base. Cybersecurity is an increasingly debated topic. As online data breaches and cyber security threats continue to escalate.
BITS, the Technology Policy Division of the Financial Services Roundtable, this week told members of Congress that it supports the Obama administration's cyber security proposal, adding that addressing cyber security in the online ecosystem requires cooperation from all entities within and outside U.S. borders. Hi, I'm Tracy Kitman with Information Security Media Group. I'm here today with Lee Williams, President BITS.
Will you testify this week before the Senate Committee on Banking, Housing, and Urban Affairs at the cyber security and data protection in the financial sector hearing to express bit support of national legislation to promote cyber security? Can you provide our audience with some background about the key legislative points mentioned in the Obama administration's proposal that touch financial services? Sure, Tracy, I'd be happy to. And thank you for being at this conversation.
You mentioned the word ecosystem and connection with this legislative proposal. I think that's the best way to think of it, is that there are about five sections of the proposal, all of which, if you start to think about them individually, begin to connect the financial services sector with requirements and with performance in other sectors. So of the five, the first is heightened penalties for computer crime, which I think those of us in financial services risk management see as a benefit. The one addition that we suggested to it is that it was based on fraud and damage to critical computers.
I think we have some concerns about that that intellectual property that we would have added to it. The second is on breach notification. We have breach notification rules and banking, no good reason why other industries shouldn't have them to. The third is in critical infrastructure protection, generally giving more authority to DHS, while we think that our financial regulators and our sector specific agency treasury should be a part of this process.
Now we're happy to have DHS help knit what we do together with other sectors. The fourth is working federal systems. One of the things that I think is fundamentally different about this legislation is that it treats private sector and public sector both. If we strengthen federal performance, I think ultimately this ecosystem will be a stronger place.
And finally, there's a prohibition on limiting data centers to only serving people in their geographies, which for those of us who are working in cloud, or even just have data centers spread around the country or around the world, would be a real benefit. Now, I understand, Lee, that you also testified before the House today. Can you tell me about government sponsored solutions and how they might be combined with market-based solutions? That was an interesting topic today.
There was some discussion about whether the right answer is putting all of this in government hands, or the right answer is keeping all of it in private sector hands. I think for our part in a regulated industry where the government is already involved, and where we've found some interesting insights from DHS and from the intelligence community, we see a government role in all of this. Even so, if most of what we do stays on the private side, if we have our own utilities, like the information sharing and analysis center, our own vendors often industry owned, like early warning services. And we have market-based approaches, like the provision of cyber insurance.
That's all good, and that probably should still be where the weight of the effort lies. Now, going back to the legislation specifically, how does this legislation differ from legislation about cyber security that we've seen in the past? One difference is that it pulls all this together. Those half-dozen titles that I reeled off don't really exist in any other single piece of legislation.
Everyone else has dealt with a plump solution. Whereas this proposal really begins to knit it all together across industries and across public and private and even across different topics, all the way from individual level of breach notification and identity theft up through the most sophisticated defenses against the most sophisticated effects. And it sounds like the legislation is relatively detailed, but how detailed is it when it comes to collaboration that's needed among and between entities that cross international borders? That's one place where we think, actually, it could use some extension.
It was natural for very little to be in this proposal because the administration was just releasing its international strategy for cyberspace, but we think there's a lot more work to be done there. And what about collaboration and information sharing among financial services providers, such as those that are traditional like financial institutions and those that are non-traditional like PayPal? For a long time we've had this maybe artificial but important distinction between regulated and unregulated financial services providers between banks and others or insurance or securities and others. Part of what this legislation would do is that it would eliminate that distinction.
It would say we have in financial services a structure in place, but even for those like PayPal, who might live outside of it, there is something else that also applies to them. So whether it's knitting us together with PayPal and the way that we operate or with Microsoft or with Verizon, this would find a way to make those connections. And how critical will it be leave for this legislation to get support from all entities in the financial and payment space? I don't know that we'll ever have a policy solution that absolutely everyone will love, but this is something that I think will be, will work well for people who come to financial services from different angles.
And I'm hoping it'll also work well for people who come from different industries and even from the public sector. Now, going back to the testimony that you gave before the Senate committee, you stressed the need for new legislation to carefully balance overall cyberspace protections as well as sector specific efforts. What are some of those sector specific efforts from your perspective? So some of them are proactive efforts that we have as an industry, like the work of our Information Sharing and Analysis Center.
Some of them are reactions that we have to specific regulations or compliance requirements, like the audits that our examiners do in our institutions. Either way, those I think should continue in the sector, but the output from them or even the input into them should be connected to analogs over in other industries. If DHS takes on a hub role in all of this work, it will need to be connected with what's happening in Treasury and the banking regulators and what's happening in our ISAC and in other industries ISACs. And what do you see as being the greatest challenges facing this legislation, as well as the international cyber security fight overall?
Well, I don't know if it's a coincidence or if you hit just precisely on the connection between those two, but I'd say what they share is the universality. This legislation is so comprehensive that it's going to be hard to pull it all together and to have people from all these different places support it. The same is true for international. International is not a binary discussion between the US and some other country.
It requires a lot of people working together to make it happen. That'll be tough, but I think it's doable on both counts. And before we closely, could you tell our audience what they should be doing to support this legislation? Why should it be important to bank some credit unions?
I think if there's a way that we can express our general support for the overall proposal, that's always helpful. If people hear that the financial services industry has bore something as important as cyber security, that's a great and important message. I think it needs to be paired with a candid discussion of where we think things need to be more detailed or move a little bit left or right if through associations or directly institutions can provide some input, not just on what they like, but on what they think needs to be polished a little bit or refined a little bit. That would be very helpful.
Lea, I want to thank you again for your time today. Thank you, Tracy. Again, we've just heard from Lee Williams a bit. For Information Security Media Group, I'm Tracy King.
This podcast has been brought to you by bankinfosecurity.com. For more interviews, breaking news, research and educational webinars, please visit www.bankinfosecurity.com.