US Government Pledges to Cyber Threat Sharing Via TLP Protocol

The US federal government has pledged to use the Traffic Light Protocol (TLP) to boost cyber threat information sharing with the cybersecurity community and private sector.

The guidance for federal agencies is designed to build trust between the government and cybersecurity research community, ensuring that crucial threat data can be shared in confidence when not in conflict with existing law or policy.

While the federal government does already use the TLP, the new guidance aims to clarify its commitment, providing clarity for security researchers.

National Cyber Director Harry Coker, Jr. highlighted the focus on information sharing in the US National Cybersecurity Strategy 2023, describing it as “the lifeblood of our discipline.”

“Here at Office of the National Cyber Director (ONCD), we are dedicated to collaboration with our partners and know that true partnership includes listening and learning – and taking appropriate action. We now understand that clarity is needed so that, across the Federal Government, we are consistently handling information with the thoughtfulness and care it deserves,” commented Coker.

Traffic Light Protocol Guidance

The TLP standards are a marking system that designates information handling permissions for data, documents or other communications. They are used by individuals and organizations around the world to ensure potentially sensitive or proprietary cybersecurity information is received and not further disseminated except in the manner indicated by the sender.

The standards are not legally binding but are a globally accepted and practiced method of communicating expectations for dissemination of data.

Vital cybersecurity data comes from a range of sources, including individuals working for companies, studying at universities or in their spare time.

“As with any partnership, it is vital that our relationships with the security research community be built on a foundation of trust. A key element of that trust is the idea that when information is shared voluntarily in confidence, the wishes of the sharer will be respected,” said Coker.

The TLP was developed and is governed by the Forum of Incident Response and Security Teams (FIRST). The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) co-chair the FIRST Special Interest Group where TLP is governed.