Security researchers from the threat intelligence community are highlighting potential avenues to bolster private-sector coordination of cybersecurity operations during international conflicts, in a look back at lessons learned from conducting and responding to cyber operations in Ukraine.

“We have a lot of information, if we are able to bring it together through the right mechanisms,” Martijn Nuijten of Palo Alto Networks said. “We have a large volume of data that we can analyze and work with.”

Nuijten, head of global public policy and cyber partnerships at Palo Alto Networks, participated in a May 13 webinar hosted by the Cyber Threat Alliance.

He was joined by Greg Rattray of the Cyber Defense Assistance Collaborative, Douglas White of DAI Global and Olesya Danylchenko of the Tallinn Mechanism Project Office Ministry of Digital Transformation in Ukraine. The webinar was moderated by CTA president and CEO Michael Daniel.

Nuijten suggested using a “clearinghouse mechanism” as an avenue to “go away from a somewhat fragmented way of sharing information to a more professional way.”

“Most of the operational threat intelligence sharing is based on very trusted personal relationships that exist between our researchers and folks in Ukraine,” Nuijten said.

Nuijten also proposed standing up a clearinghouse function to account for the “pace of innovation” when providing cyber tools to U.S. allies.

“How do we make sure that the success stories of how we are innovating in cyber and deploying it globally can also find its way to the folks that need it most?” he asked.

A clearinghouse function could “bring all the success stories together and have the donors and the Ukrainians also better understand what the state of the art is these days and what is it that we really need currently,” Nuijten argued.

CTA’s Daniel agreed with Nuijten that “finding the right balance can be very challenging” when it comes to providing cyber tools that are being requested by international partners versus tools that are at the most up to date pace of innovation.

Daniel also pointed to the Cyber Defense Assistance Collaborative as an example of a coordinating hub. CDAC has provided a channel for private sector organizations to offer cyber tools and threat intelligence to Ukraine.

Rattray, executive director for CDAC, said his organization is “not highly resourced.” The CDAC released on March 3 an overview of lessons learned from four years of providing cyber assistance to Ukraine, with a focus on the importance of coordination mechanisms.

Rattray said, “The ability to do the coordination I have been advocating for could scale significantly the depth of the sharing, both of intelligence and now lessons learned from sharing what the Ukrainians have learned with companies and with the rest of the globe. These things take effort.”

DAI’s White is responsible for leading a State Department program to modernize Ukraine’s civilian government and critical infrastructure. White emphasized, “The private sector really has an opportunity to step in here and lead the way, because I think the government is struggling. Government has a lot of institutional knowledge to bring to the table, but there is a real partnership opportunity.”

Meanwhile, Danylchenko said the Tallinn Mechanism Project Office is “relying completely on the private sector and their support” to enhance Ukraine’s cyber resilience.

“We are looking at [the private sector]. We are learning from them, and we cannot overestimate the input they are bringing to cybersecurity because they are the only one real driving force in this ecosystem,” Danylchenko said.