Getting inside the first national cyber director’s head

Delivered every Monday by 10 a.m., Weekly Cybersecurity examines the latest news in cybersecurity policy and politics.

Jan 18, 2022 View in browser   By Sam Sabin With help from Eric Geller Quick Fix — In an exclusive interview, National Cyber Director Chris Inglis details his priorities and the pushback his office has received to recent cyber regulations. — Government officials and researchers' comments following a recent cyberattack on Ukraine gives some clues about what exact cyber threats government officials are worried about in the Ukraine-Russia conflict. — On the docket in the House this week: Securing pipelines, elections and government tech acquisitions. HAPPY TUESDAY, and welcome back to Morning Cybersecurity! I'm your host, Sam Sabin. If I've learned anything in my time on the beat, it's that there's nothing like a long holiday weekend that really riles up hackers. Have tips and secrets to share with MC? Or thoughts on what we should track down next? Send what you've got to ssabin@politico.com . Follow along at @POLITICOPro and @MorningCybersec. (Full team contact info below.) Let's get to it: Critical Infrastructure EXCLUSIVE: INGLIS PREVIEWS HIS PLANS — As National Cyber Director Chris Inglis works to prove the value of his new office, he's targeting monitoring digital security of new federal infrastructure projects, supporting the resilience of open-source software and helping to improve Americans' cyber literacy, as Eric reports in an exclusive interview published this morning for Pros. Inglis also shares new details with Eric about how he's setting up his office, describes his conversations with federal cyber leaders and laid out the challenges that come with balancing crisis response with long-term security improvements. As a bonus for MC readers, here are a few interview excerpts that didn't make it into the story: EG: What's your response to industry groups and Republican lawmakers who say the administration is moving too fast and too heavy-handedly with its cybersecurity regulations? Inglis: The feedback we're getting, from my view, isn't so much that it's heavy handed, but that the consultation has not been broad and deep and rich enough. We need to address that. The questions that are often asked are … "Do we understand what it is we're trying to do? Do we know who the beneficiaries are? Are the benefits worth the burdens?" Those are reasonable questions and we need to answer them. EG: GAO recently issued a report on the federal response to the SolarWinds and Microsoft Exchange incidents . One of its findings was that agencies didn't have enough visibility into what was happening on their networks. Are we making progress on solving that problem? Inglis: I think we are. I think there's a lot more work to be done. We need to make sure that we don't simply have information about each and every one of these lines of effort, but that we're able to synthesize that broadly across the larger enterprise, such that the experience of one can profit anyone else within that enterprise. EG: Which of the Cyberspace Solarium Commission recommendations requiring executive action do you think stand the best chance of implementation in the near future? Inglis: Creating a Joint Cyber Environment, the architecture that can contain this unstructured, disparate data, and perhaps formalizing or structuring our approach to systemically [important] critical infrastructure. EG: You've said that you plan to release a formal strategy document that will expand on your vision statement and describe the office's plans in greater detail. What can the American people expect to see from your office along those lines? Inglis: We will characterize what the various roles and responsibilities are at the White House of the cyber leadership. We're working our way through now how … to describe with greater fidelity the role of the National Cyber Director in the context of the National Security Council. I think you'll see that in the near term measured in — perhaps, months.   STEP INSIDE THE WEST WING: What's really happening in West Wing offices? Find out who's up, who's down, and who really has the president's ear in our West Wing Playbook newsletter, the insider's guide to the Biden White House and Cabinet. For buzzy nuggets and details that you won't find anywhere else, subscribe today.     Want to receive this newsletter every weekday? Subscribe to POLITICO Pro. You'll also receive daily policy news and other intelligence you need to act on the day's biggest stories. Russia ONLY THE BEGINNING — For weeks, Biden administration officials have warned about the possibility of Russian cyberattacks targeting Ukraine as tensions mount on the two countries' border. On Friday, it finally happened when hackers defaced several Ukrainian government websites. But sifting through government officials and researchers' comments following the attack offers a rough roadmap for what kinds of tactics may play a larger role in the coming weeks: — Malware wipers: Researchers at Microsoft reported over the weekend that hackers installed malware wipers onto systems belonging to "multiple government, nonprofit, and information technology organizations" in Ukraine. It's unclear if those wipers have been activated on the targeted systems yet — or if hackers had plans to activate them in the future. — Belarusian cyber intervention: One Ukrainian official said on Saturday that hackers tied to Belarusian intelligence may have been responsible for Friday's defacement of government websites. Although the Ukraine government has since formally blamed Moscow, the comment indicates that Ukraine is on the lookout for malicious cyber activity from Belarus, a close ally to Russia. — Critical infrastructure attacks : The main concern that's been underpinning officials' concerns throughout the conflict is whether Russia will target Ukraine's critical infrastructure again. In 2015, Russian-linked hackers turned off the power for several hours for millions of Ukrainians in December 2015. But Russia has yet to show signs of pursuing this route so far. How might the U.S. respond: While the Biden administration has been quick to threaten Russia and its allies with sanctions for malicious cyber activities in the past, officials haven't stated clearly what they'd do if Russia doesn't stand down this time around, as Maggie reported recently. On the Hill BACK TO THE GRIND — House lawmakers are spending one of their first weeks back tackling a myriad of cybersecurity issues, from securing pipelines against cyberattacks to shoring up election security ahead of the 2022 midterms. Here are a few hearings to keep on the calendar this week: — Pipeline security : The House Energy and Commerce Committee's energy subpanel will dive back into debate about which agency — the Transportation Security Administration or the Energy Department — is best suited to regulate pipeline cybersecurity at its hearing Wednesday. Federal Energy Regulatory Commission Chair Richard Glick and Deputy Secretary David Turk are scheduled to testify. — Government tech and cyber tool procurement : Lawmakers on the House Oversight Committee will also discuss possible changes to the Federal IT Acquisition Reform Act on Thursday, which sets rules for federal purchases and management of computer technology, including cybersecurity tools, from third-party vendors. The act became law in 2014 as a part of that year's National Defense Authorization Act and hasn't been updated since. — Election security : As the 2022 midterms start gaining more momentum, the House Homeland Security Committee's cyber subpanel will hold the first election security congressional hearing of the year Thursday. While witnesses haven't been announced yet, subcommittee chair Yvette Clarke (D-N.Y.) gave a hint of what's to come during an event last week when she announced she will introduce legislation to authorize CISA's "Rumor Control" website, which debunks false information about elections.   DON'T MISS CONGRESS MINUTES: Need to follow the action on Capitol Hill blow-by-blow? Check out Minutes, POLITICO's new platform that delivers the latest exclusives, twists and much more in real time. Get it on your desktop or download the POLITICO mobile app for iOS or Android. CHECK OUT CONGRESS MINUTES HERE.     Vulnerabilities NEVER GONNA GIVE YOU UP — The hacking group Donot Team has spent the last two years targeting the same small number of government organizations in Bangladesh, Sri Lanka, Pakistan and Nepal, according to research released this morning by cybersecurity firm ESET. The targeted organizations include ministries of foreign affairs and embassies representing these countries in other regions, researchers said, and Donot Team has repeatedly attempted to access these networks using a range of different malware variants in each attack. People on the Move — Jeffrey Wichman, who previously worked at the CIA for more than 30 years, is now overseeing election threats at the Office of the Director of National Intelligence. — Camille Stewart, Google's global head of product security strategy, and Lauren Zabierek, executive director of the Cyber Project at Harvard Kennedy School's Belfer Center, have joined New America as fellows, according to our friends at NatSec Daily. Tweet of the Day CISA is offering a salary between $187,000 and $246,000 for a role overseeing its threat hunt team, according to Director Jen Easterly. That's more than what DHS Secretary Alejandro Mayorkas made last year, according to the New York Times' David Sanger: "By way of comparison, the Vice President of the US makes $235k. @cisajen 's boss, DHS Sec Mayorkas, made $197k last year. So it's a pretty remarkable thing that the CISA cyber threat hunters run from $187 to $246. Been in the works a long time; now it is happening." Quick Bytes — "WhatsApp Ordered to Help U.S. Agents Spy on Chinese Phones — No Explanation Required." (Forbes) — "Destructive Hacks Against Ukraine Echo Its Last Cyberwar" (Wired) — Among the Beijing Winter Olympics' sponsors: Chinese companies focused on surveillance and data collection. (Bloomberg) — Albuquerque Public Schools are reopening today after canceling classes for two days last week due to a cyberattack. (KOB4) — Suspected government groups hacked into the phones of two women activists in Bahrain and Jordan using NSO Group's Pegasus spyware, researchers reported Monday. Chat soon. Stay in touch with the whole team: Eric Geller (egeller@politico.com); Bob King (bking@politico.com); Maggie Miller (mmiller@politico.com); Sam Sabin (ssabin@politico.com); and Heidi Vogt (hvogt@politico.com).   Follow us on Twitter Heidi Vogt @HeidiVogt Eric Geller @ericgeller Maggie Miller @magmill95 Sam Sabin @samsabin923   Follow us

To change your alert settings, please log in at https://www.politico.com/_login?base=https%3A%2F%2Fwww.politico.com/settings This email was sent to rouf@idiot.cloudns.cc by: POLITICO, LLC 1000 Wilson Blvd. Arlington, VA, 22209, USA Please click here and follow the steps to unsubscribe.