Intelligence Redux

Anybody who was at the RSA Conference a few weeks ago can attest to the fact that "threat intelligence" has become the catchphrase du jour. As was the case with "cloud" a few years ago and "data analytics" last year, every vendor on the show floor was hawking a product or service which claimed to increase my understanding of the bad guy and thus improve my ability to better defend my enterprise.

As I began to dig into these products and query my fellow practitioners, I became concerned about what the vendors were calling intelligence and the real value this latest array of tools and services would (or would not) provide. Many of my discussions quickly focusd on the concepts of intelligence and intelligence collection and how to apply these to concepts practically. While it's been years since I worked in Army Intelligence, some lessons certainly spill over into the corporate world. Allow me to share some of my thoughts on these concepts for your consideration...

Intelligence Defined.  With the term threat intelligence being widely (overly?) used these days, it's worth stepping back and understanding the difference between data, information, and intelligence. Data are facts; they are immutable and unchangeable. Information, simply put, is data in context. Intelligence is information that is extracted and revealed from an analysis of given data and information.

Confused?  Let me give you an example. Take the number 3015178088. This number is  piece of data, devoid of any context. We can attempt to provide some context to this data in an attempt to provide some level of information to the reader. Examples:

• 3,015,178,088 -- a number in excess of three billion
• 30151-70808 -- an overseas telephone number, most likely European
• (301) 517-8088 -- a North American phone number

As you can see, adding context to the data provides different information to the consumer.

In this particular example, the North American telephone number is the correct context. Now let's provide additional data/information to the reader:

• 301 is one of the area codes for Maryland
• I lived in Maryland from 1995 to 2003

Given these pieces of data and information, you might be able to extract the intelligence that the phone number listed was one of my old phone numbers. That piece of information is not stated anywhere within the provided data/information, but through simple analysis and some deductive reasoning, it can be extracted with a reasonably high level of confidence. Consumer organizations regularly extract "business intelligence" from data collected with member loyalty programs in an attempt to focus its markting and sales efforts with laser-like precision -- occasionally to the point of becoming quite intrusive.

Actionable Intelligence Collection. In order for intellignce to be actionable (i.e., result in the abiliity for me to do something better/smarter/differently/more effectively than I am at the moment), the intelligence collection effort within the enterprise must be organized and deliberate. Intelligence collection is more than information gathering/information consumption; it requires the enterprise to remain focused on fanatically answering three seemingly simple questions:

• What do I need to know? What are the most important questions for you to get answered? In the military we referred to these questions as priority intelligence requirements (PIRs). Intelligence collection efforts should be focused on answering these questions first and foremost. Note that determining these questions may be simpler than you think. I remember an intelligence exercise from my GI days involving the transport of relief supplies into a fictional European country via military convoy. As the exercise assumed a hostile force which occassionally disrupted transports along the one major highway into the area, the #1 PIR each was always "Is the road open for travel?" I would imagine that some of the PIRs for most enterprises would be equally straightforward. Some examples:
• Are bad guys in my environment right now?
• Is sensitive data leaving my environment in an unauthorized fashion?
• Which bad guys trying to get into my enterprise? 
• Where are the most likely/most vulnerable attack points?

• What is the best way to get the answers I need? Folks, PIRs can (and should) be answered by a multitude of sources. These include (but are not limited to)
• News reports
• Existing enterprise tools 
• Communications via professional organizations
• Organizations which monitor threat activity regularly (CERTs, ISACs)

While a "threat intelligence" platform or service, properly constructed, might provide indications and warning about an iminent attack it may be argued that existing sources of data from within the enterprise are better suited to determining the current state of attack if properly monitored and utilized. Indeed, focused monitoring and analysis of open-source information providers may provide reasonbly accurate and timely indications and warning of threats and attacks against the enterprise.

• What do I intend to do with the intlligence gathered?  Intelligence collection should not be an academic exercise. Answering your PIRs should drive action within your environment. If fulfilling a PIR does not drive even a minimal course correction on the actions and activities of the enterprise, then you need to consider whether or not you are answering the right questions...or whether or not you need to adjust you efforts down to that which is actionable within your current culture. This last phrase may seem like an anathema to the security professional, but given limited resources we must constantly balance our collection efforts against our execution priorities lest security become simply an academic exercise.

* * * * * 

Given the aforementioned definitions, many of the "threat intelligence" products and services being advertised today provide threat information versus threat intelligence -- i.e., they are providing yet another credible data/information source to the enterprise defenders versus true intelligence. While this data source may be more focused and more useful than other data sources available, without an understanding of organizational PIRs this data source becomes yet another firehose of "stuff" which the security team must consume lest it drown. Worse, without an ability to guide and focus collection efforts across the enterprise the security team may be looking for indications & warning regarding attacks from largely ineffective (and probably expeensive) sources.  

Threat "intelligence" products and services do have a place within the enterprise...but only if the enterprise is prepared to utilize and absorb the information provided in a cogent and thoughtful manner. While the temptation to garner information from closer to the bad guys is appealling, having yet another firehose to drink from will only hasten the drowning if you're not careful.

My two cents...

A Three-Pronged Approach to Protection

In the wake of recent merchant breaches, I have found myself on an increasing number of calls with customers, reporters, and business leaders from various industries.  Invariably, the questions asked all boil down to one overarching interrogative:  "How do we avoid becoming the next breach victim?"  After I attempt to calm nerves and reiterate that there are no silver bullets out there, my answers tend to center  around three fundamental areas that I offer up to you for critcism or comment.  Here goes...

1.  Be Harder Than The Other Guy.  Folks often ask me whether or not they should put the alarm sign in front of their house when they buy an alarm service.  My answer to them is "yes, absolutely!" Most burglaries and break-ins are by amatuers looking for easy targets and/or targets of opportunity.  While the alarm sign will alert the 1% who are specifically aiming to break into your house to cut the phone lines, it will also steer the remaining 99% to your neighbor's house if your neighbor doesn't have an alarm sign posted.  No alarm equals an easier target, so becoming a harder target than your neighbor is an attack deterrent.  The same principle applies in cyberspace.  If your protections and controls are preceived to be more durable and more resilient than your competition, it stands to reason that the bad guys will attempt to acquire data from the weaker target instead of attempting to breach the harder target.  We can see this occurring in a strategic fashion if we step back and observe the class of businesses that hackers are attacking;  instead of focusing predominantly on financial institutions and payment processors, we have seen concerted efforts against merchants, contact centers, and other potential 3rd party "aggregation points" for data.  Even within certain classes of targets, there is value in informing your  adversary  -- in general (but not opaque) terms -- of the strength of your protections in order to discourage attack.  (Note:  Those of you reading this post who have some military experience will recognize this approach from your unconventional warfare training;  if you think about it for a bit, you'll see that the same principles apply when facing off against the hacker community :o)  )

2. Be Best-In-Class At Incident Response.  If you accept the premise that even the most prepared defenses will be breached -- and they will, believe me :) -- then the ability to identify, contain, and eradicate the threat as early as possible becomes critical.  There are statistics out there which state that  the average time between infection by a sophisticated attacker and its detection in the network can be measured in months if not years.  Investing in the technologies and the personnel needed to shrink this window is a critical step in breach avoidance.  Note that investing in personnel does not just mean headcont; more importantly, it means training and education to improve general security knowledge; an understanding of the threat; and critical thinking skills.  This training needs to go beyond just those within the security team but to all members of the extended incident response team.  

3.  Add Threat Intelligence To The Mix.  If this year's RSA Conference is any indication, the importance of understanding one's adversary has come back into the forefront of the security discussion.  This will be considered good news by those who have long stated that we have become so process and business focus that we have diluted our understanding of hard-core security.  Still, I wonder how many people understand the difference between threat information and threat intelligence.  True threat intelliegencce, in order to be useful to the enterprise, requires an understanding of what knowledge is of paramount use (priority intelligence requirements); what the best sources are for obtaining that knowledge (collection management); and what actions need to be taken based upon the information obtained (risk management planning).  In the absence of these key components, threat information becomes yet one more firehose from which the the security team must drink from whilst attempting not to drown.

While these answers may provide small comfort to organizations looking for quick-fix solutions, they represent the basic building blocks for moving toward a risk-based security program.  Consider using these concepts when discussing security needs with your business leaders.  Enjoy!

Eulogy to Windows XP

(The following eulogy was written by Sam Marshall from Treca Educational Solutions.  Enjoy!  -K)

 

Many of you may have heard that Windows XP will soon see retirement and no longer receive updates or support from Microsoft.  So let’s take a moment to remember Windows XP:

• When Windows XP was released on October 25th, 2001, President George W. Bush had not yet completed his first year in office.
• The minimum amount of RAM to run it was 64MB;  the iPhone 5s comes standard with 1GB which is 16x more powerful
• When Windows XP was launched there was no Facebook, Twitter, or Pinterest
• Businesses wanting to install windows XP could prepare 6 FLOPPY DISKS to install the operating system on systems that did not have a CD-ROM drive.
• By January 2006 over 400 Million copies had been sold.
• Microsoft Officially ended sales of Windows XP on June 30th 2008 -- over 5 and a half years ago!
• Microsoft has released 3 newer Operating Systems after Windows XP
• Even in 2014 Windows XP is being used on nearly 30% of the world’s computers.  Many of these sytems are ATMs, and Point-of-Sale devices.
• Microsoft will end support of Windows XP on April 8, 2014 (Less than 60 days away)

 

Why should you care?

 

If you, your friends, or your family run Windows XP know that after April 8th these systems should no longer be considered secure. Microsoft will no longer release security patches or updates for Windows XP.  These updates are like vaccines and Microsoft ending support means no more vaccines will be made to keep your system healthy. (note:  Microsoft is offering some level of continued patching suport for businesses, but the pricepoints are punitive.  No such support has been planned for individual consumers to my knowledge). 

 

Sadly there are no easy solutions.  The only options available are to update to a new operating system or purchase a new computer if your current one cannot run a newer version

Blinded (and Bitten) by Compliance

I have remained silent on issues of security as we entered the new year, and many of my readers have asked me why. With the plethora of merchant breaches that hit the news during the holiday seasion, surely I had an opinion (or six) on the topic...so why not share them?  The reason was simple: there were already way too many "experts" and pundits providing comment with minimal information that adding one more voice to the fray would most likely be counterproductive.  The merchants who were breached have been vilified in the press and had their collective competence unfairly questioned by far too many people in far too many venues;  anything I had to say (and much of it would be favorable to my security brethren) would merely add to the noise...and might be subject to misinterpreation by folks hungering for a story.  Still, now that the media drama has subsided and we're into the "what must be done" phase of the crisis, I think its time for me to come up for air.  While I don't wish to continue "making glue" out of well-flogged security issues, there is one area that I believe bears a tad more exploration:  the PCI-DSS and its role within payment security.   

Earlier this month, Bob Russo of the PCI Council formally responded to criticisms  of the PCI-DSS standard in the wake of recent breaches.  Mr. Russo reminded nay-sayers that (a) there is no such thing as a silver bullet; (b) the PCI standard represents an "excellent line of defense" in terms of security; and that (c) it is not the job of the PCI Council to enforce merchant or banking institution security.  In short:  the recent merchant breaches do not represent a failure in the PCI-DSS but rather a breakdown in security controls within the respective institutions.

Hmmm....

I remember working as a CISO in the mid 2000s during the early days of credit card breaches.  I remember watching a couple of television commercials sponsored by all five major credit card brands touting the safety and sanctity of credit cards payments.  Every time I saw one of these commercials I noted to my colleagues that I felt the credit card companies were "running scared" from regulation in light of the then-current state of breaches;  I was curious as to what the card brands would propose to fend off the spectre of further regulatory oversight.  The very next year, PCI-DSS came into being.  More prescriptive and detailed than HIPAA, the PCI-DSS had more teeth than existing federal mandates given the ever-looming possibility of losing the ability to process electronic payments transactions.  During this time, the card brands feverishly campaigned to anyone who would listen about how PCI-DSS would collectively raise the bar in how credit card processes were secured and inject peace of mind back into transactions.

The security community willingly and eagerly jumped onto the compliance bandwagon, touting HIPAA, PCI, and GLBA whenever possible.  "At last," the community said, "we have a useful arrow in our quiver."  Security was either the law of the land or a regulatory requirement for business.  We hitched our programs onto these regulations and laws with reckless abandon, eschewing the nay-sayers (yes, I was one of them) who touted the  regulations yet cautioned that they could become yet another brand of FUD (fear, uncertainty, and doubt) if we linked our programs too closely to them.  Years would pass before we would come to realize that by equating security to compliace we risked watering down our programs to the minimum necessary controls required to obtain a compliant state.  It would be even more years before we recognized that the final determination of legal and/or regulatory sufficiency often did not reside within security but with the offices of the corporate attorney.

At the end of the day, any security professional has to agree with the statements made by Mr. Russo.  Any assessment against regulation is a point-of-time view of an organization, and while the DSS is an excellent standard it mightn't be suffient to ensure security of all critical assets within the envirionment.  Worse, if security controls are not monitored and appropriately enforced then even the most robust ecosystems will beome vulnerable.  In defending the PCI-DSS  and its viability, Mr. Russo has merely restated a tenet that security professionals started saying en masse several years ago:  compliance does not equal security. My minor umbrage, if you will, to Mr. Russo's comments stems from the fact that the security community's late realization of the aforementioned tenet was one of the contributors to the successful marketing of the PCI-DSS as a standard of excellence for security.   

One cannot help, as a community, feeling partially thrown under the "blame bus" by an ally.  

Mr. Russo's interview should hopefully represent a wake-up call for those still focused on compliance instead of security.   Anyone struggling with their leadership to focus on holistic, risk-based security versus compliance should use Mr. Russo's interview as a reminder of the role -- an limits -- of compliance within one's security program.

My two cents...

Millions of Gmail, Yahoo, Twitter, and Facebook Passwords Stolen

Hackers have stolen usernames and passwords for nearly two million accounts at Facebook, Google, Twitter, Yahoo and others, according to a report released this week.

The massive data breach was a result of keylogging software maliciously installed on an untold number of computers around the world, researchers at cybersecurity firm Trustwave said. The virus was capturing log-in credentials for key websites over the past month and sending those usernames and passwords to a server controlled by the hackers. You can read the details of the breach here  but you should change your passwords as soon as possible. on these services.  Spread the word!

Security Tips for Cyber Monday

I am a seasonal retailer's worst nighmare...

...I am a consumer who shops for Christmas well before the holidays. 

I've never done a Black Friday nor a Cyber Monday shopping extravaganza;  by this time of the year I am focusing on decorating the house, writing Christmas cards, and swinging by the local supermarket to pick up some gift cards as stocking stuffers.  The idea of queuing in lines for hours and then fighting over towels is as bewildering to me as staying up until midnight in front of a computer screen to snag an online deal.  Nevertheless, millions of consumers in the US will engage in these post Thanksgiving rituals with eageness and zeal.  

This year several prognosticators are anticipating more retail revenue generated on Cyber Monday than on Black Friday.  In anticipation of this onslaught, many in my professsion are reemphasizing the importance of protecting yourself while online shopping.  There are several decent articles out there with lists of good practices (you can find two of them here and here)...but one more can't hurt.  

Here are my Tips for Safe Cyber Shopping:

1. Patch Your Systems.  Sounds simple, doesn't it?  Still many personal computing devices and applications remain unpatched and vulnerable (as this year's data breach reports point out   Again.).  Patch the O/S.  Patch applications.  Update your virus software definitions...and run a thorough scan of the system before your start surfing.  
2. No-App Monday.  Cyber Monday is not the day to download new apps or ringtones onto  your personal device.  Expect an onslaught of "new" or "discounted" apps to hit the app sites, offering you every convenient phone functionality you can think of.  While many of these might be legitimate, a significant percentage will not be.  Remember that the easiest way for the bad guy to get into your systems is for you to willingly let him in.  Downloading an app opens your front door to the cyber crook.  
3. Ignore Pop-Ups.  Do not respond to any pop-up window offering your additional discounts/savings/deals simply by clicking on the window.  
4. Know Your Retailers. If you are going to shop online on Cyber Monday, do so with retailers that you know and have done business with before.  Cyber Monday is not the day to "try out" a new online retailer or a known retailer's new online functionality.  Also, remember to check the URL of any known retail site that you visit by hovering over the link or inspecting the full URL in the browser windor.  Look at the beginning of the string and make certain that the site you are on is the correct one (e.g.:  amazon<dot>com versus amaz0n<dot>com).  Do not assume that you will recognize a phony website just by surfing it;  scammers have become quite proficient at creating professional-looking sites.
5. Manage Your Risk.  Limit the amount of risk you incur when shopping online by controlling the dollar amount that the bad guys are exposed to.  Using credit cards is the most popular method of mitigating this risk, but not the only way.  PayPal is, by its design, a risk-limiting method of payment and is also effective.  You can also get creative with your banking instruments and designate one checking account/debit card for online shopping and only populate that account with the monies necessary to pay for your online purchases.  
6. Password Sunday.  Scammers are looking for access to your accounts and data as well as your financial instruments.  If you shop online on Cyber Monday, consider doing a full-fledge password update and lockdown the day before.  Most individuals use the same password for multiple accounts...and (as recent breaches continue to show) most of these passwords are extremely weak.  If a scammer utilizes Cyber Monday activities to gain access to your system, having strong individual passwords stored in a secure offline container may slow down the potential damage that can be done.  Given the plethora of passwords that most people need to remember, it would be foolish of me to tell you not to capture them somewhere; be smart/prudent re: where and how you store them, though.  Personally, I am a fan of KeePass which I store on an IronKey that I keep in my firebox...though there are less-paranoid and less technical solutions.
7. Remember Barnum.  P. T. Barnum is often credited with saying that "There's a sucker born every minute."  Scammers and criminals live by this philosophy.  If something sounds too good to be true, it probably is.  Be skeptical of "dream" deals and discounts.  Do not go down the rabbit hole of exploring such deals, regardless of how tempting they are.  Remember, it only takes a nanosecond to compromise a system.   

(Historical note:  for the purists out there, I am aware that Barnum never said the aforementioned maxim;  go here if you want the correct reference.  Yes, I have friends who will obsess over that point [squirrel!])

Hope this helps.  Please feel free to pass this along to your friends.  Safe shopping, all!

Vendor Kabuki

Recently, a good friend of mine and longtime CISO left the chair to become the chief security strategist at a well-known security technologies company. A few weeks after that transition, my buddy and I sat down for a long overdue dinner with some friends. During the meal we discussed the transition from responsible charge to vendor. My colleague was less than thrilled at all aspects of the transition.

"Overnight I went from being a respected colleague to 'just another vendor,'" my colleague complained. "I'm no longer allowed at CISO events; I am no longer eligible to sit in CISO-exclusive meetings; professional organizations that I have supported for years treat me like a second class citizen; and folks whom I interacted freely and openly with won't return my calls.  Why is it that CISOs treat vendors like dirt?"  

As I about to respond, another colleague of mine who had crossed over to the vendor side nodded her agreement. "You're an anomaly, Kim," she asserted.  "You treat vendors as partners; most of your peers treat us like dirt."

I admit that I was taken aback by these comments...but only a little.  Vendor opinions of me tend to be decidedly bipolar.  My style of engagement tends to be direct and pointed;  While many vendors enjoy this honest dialogue, many more have found me extremely "difficult" to engage with. I didn't pursue the conversation over dinner (I was the only non-vendor at the table and my colleagues were in full rant mode :) ), but I did spend some time mulling over the problem.  

Like most relationship challenges, the problems with the vendor/CISO relationship are two sided.  I would posit that the CISO portion of the relationship dysfunction centers around something I like to call the egoism of motivation.   In an earlier blog post, I posed the question of why security professionals do what they do.   While I left the question open ended, I would submit that the majority of us walk the path we do for semi-altruistic reasons.  While our careers tend to be fairly lucrative these days, most of us end up fighting an uphill battle for resources and understanding with those who would quickly turn us into scapegoats should an adverse event occur.  Yet despite this environment we keep going back into the fray with zeal, passion, and dedication.  We are not cops or soldiers, priests or firemen...but at some visceral level we do share the same passion for service and making a difference as those in the aforementioned professions.  In this context, it is at times difficult to engage with those whom purport to understand our concerns yet do not share our motivations.  CISOs have no objection to money or profit motives -- hell, I have a kid in college and am all about not having my paycheck bounce :)  That being said, it is at times vexing to engage in conversations about a tool or service with vendor personnel who don't share your motivations; who don't necessarily have similar experiences; and who seem more concerned about acquiring your (very) limited dollars versus resolving your near and long term challenges.  

Even for those of us who manage to get past our own egoism, there still exists the challenge of vendor-CISO communication.  Several years ago I came across a webinar by Paul Glen, author of the book Leading Geeks.  In this webinar, Mr. Glen discussed seven "contaxioms"  -- axiomatic ideas and/or concepts for which geeks and non-geeks have contrasting ideas.  Glen's 6th contraxion -- one which I feel is especially relevant to the topic -- centers around the concept of lying. For the geek:

-Lying is evil;  truth is sacred.

-Answering yes to a question when you don't absolutely know if something is true is a lie.

-Exaggeration and opinion stated as fact are lies.

For the non-geek:

-Lying is not good;  it is bad manners.

-Answering yes to a question that you know is false is a lie.

-Exaggeration and opinion stated as fact are simply a part of normal speech.

With such a disconnect in terms and terminology, the CISO oftentimes finds it daunting to trust that which he hears from his vendor brethren.  Our axiomatic differences leave us at an impasse whereby our vendor brethren are often perceived as disingenuous in their dialogue...and the time it takes to determine the proper questions to ask to get to the level of detailed, accurate data desired is time taken away from our daily missions of protection and enablement.  Just yesterday one of my esteeemed colleagues said at a conference:  "Every time a vendor speaks to someone in my organization I lose a week's worth of work getting to the truth behind the sales pitch."

With these types of cultural dynamics at play, it is easy to understand why CISOs and vendors operate at best under a gaurded truce...but it doesn't have to be that way. Indeed, both vendors and CISOs would benefit from an attitude of true partnership on both sides of the equation.  As a CISO, I operate with certain guidelines when dealing with vendors:

-1.  Be Plain Spoken.  Understand what requirements you are trying to fulfill, and communicate them directly. As part of that communication, ensure your vendor understands whether your engagement is exploratory; whether you are trying to fulfill a short term spend; or whether this will be a long term process happening within the next fiscal year.  Your vendors, like you, also have requirements they need to fulfill;  it is disrespectful of their time and mission to have them spend months with you for a supposed potential sale when in reality you have no intention of making a purchase.

-2.  No Loss Leaders.  While I admit freely that I will always try to obtain services as cheaply as possible, I recognize the vendor must make a profit.  I do not insist upon loss leaders or additional free services from a vendor in order to close a deal.  If offered, I will accept them...but I do not make or break deals based upon the amount of free stuff I receive.

-3.  Respect Vendor Budgets.  This one plays in the realm of both ethics and mutual respect.  Vendors will regularly offer up dinners, tickets, etc. to get your attention or your time.  Notwithstanding appropriate legal and corporate guidelines for accepting such gifts, I make it a practice not to accept such offers if (a) I am not interested in the product or (b) I have no budget for such products. 

The vendor reps with whom I operate best also understand my expectations of them:

-1.  Be Plain Spoken.  I would rather be told "No, I can't do that," than have someone tell me that their service or product meets a need of mine that they are not equipped to perform.  Don't attempt to put a square peg into a round hole for the sake of  a near term sale.

-2.  Focus on the Long Term.  While I respect your near-term quota, I am looking for vendor partners who understand my long term needs and constraints.  Don't sacrifice a long term relationship for the sake of a sale.

-3.  Deliver.  Do what your say you are going to do...and ensure your products do what they say they will do, as well.  I expect this level of discipline and results from staff;  I should expect no less from my vendors.

I have met a handful of vendors (Anna, Ed, Gabi, J.R., Jason, Joel..and the late Ryan Richard) who understand and operate comfortably within these expectations.  In return, I have developed strong partnerships with these individuals and the companies they represent. Indeed, as these individuals have moved from company to company they have opened doors to their new products to me;  any company that would employ vendors of their caliber clearly has highly ethical business practices.  These individuals get my most valued resource -- my time -- freely.  Conversely, I have met a plethora of vendors who refuse to be straightforward; who don't deliver on promised functionality; and remain primarily concerned about making a quarterly quota.  These vendors are either relegated as afterthoughts in my strategic planning...or are removed from my environment along with their products.

While I might be considered an anomaly to my vendor collagues, I have found the aforementioned vendors to be anomalies amongst their profession as well. Indeed, I reminded my CISO-turned-vendor that his new company (which had a reputation for arrogant, bullying marketing tactics) only hired him after the better part of a decade in the security space.  Could it be that their incentive is due to having achieved a certain market saturation that they cannot move beyond without a  long-overdue change in approach?

Vendors and CISOs do need to reevaluate their relationship if the collective profession is to improve.  Both sides have work to do in strengthening our ties if we are to succeed.

My two cents...