| | | | | |  | | By Sam Sabin | Presented by ManTech | With help from Eric Geller | | | — Weeks later, organizations and federal cyber defenders are still wrestling with the fallout from the critical security flaws in Log4j's open source code. — The recently signed annual defense policy package gives the national cyber director's office a big boost towards achieving its 2022 hiring goals: the ability to accept government detailees. — The Biden administration is still holding out hope that Russian de-escalation on the Ukraine border is possible — leaving the door open for continued cyber diplomacy talks. HAPPY NEW YEAR, HAPPY MONDAY and welcome back to Morning Cybersecurity! I'm your host, Sam Sabin, wishing you a fulfilling and restful new year! Have tips and secrets to share with MC? Or thoughts on what we should track down this year? Send what you've got to ssabin@politico.com. Follow along at @POLITICOPro and @MorningCybersec. (Full team contact info below.) Let's get to it: | | | | A message from ManTech: ManTech's cyber experts deliver advanced full-spectrum protection that stops adversaries in the planning stages of an attack. For decades, ManTech has invested in our people, technology and capabilities leading to increased protection of federal networks – thwarting cyber attacks while reducing the threat surface and contributing to safer infrastructure regardless of the threat. To learn more about ManTech's capabilities, people and areas of expertise, visit https://www.mantech.com/federal-cyber. | | | | | | LINGERING FALLOUT — Throughout the holiday season, cyber defenders in both the private and public sectors had their hands full as a mix of criminal and nation-state hackers targeted organizations through the Log4j vulnerabilities disclosed last month. Here's what you may have missed: — The targets: Hackers have been quick to start besieging the "hundreds of millions" of devices that CISA has warned are vulnerable because of flaws in the open source software library Log4j. Those include the Vietnamese crypto trading platform ONUS, which has refused to make the $5 million extortion payment. The Belgian Ministry of Defense also shut down parts of its computer network after hackers used the Log4j flaws to try and access its systems. — The hackers: Both criminal and nation-state hackers have been exploiting the vulnerabilities, which could allow them to gain remote control of the devices they compromise. Last week, CrowdStrike researchers reported that they caught Beijing-linked group Aquatic Panda trying to exploit a large, undisclosed academic institution through the Log4j flaws for "intelligence collection and industrial espionage." The Conti ransomware group has also been seen trying to exploit the flaws. Those updates came after Microsoft said last month that nation-state hackers linked to China, Iran, North Korea and Turkey were trying to exploit the software weaknesses. — The government's response: CISA has hosted calls with private sector and government partners about the extent of the Log4j exploitations. In each, officials have warned that organizations need to patch the flaws as soon as possible to avoid ransomware attacks and espionage. CISA, the FBI, National Security Agency and their international counterparts also issued an advisory right before Christmas about "active, worldwide exploitation" of the Log4j flaws. The advisory included details about the flaws, patches and other resources. CISA gave affected federal agencies until Dec. 24 to patch the vulnerabilities, and in a statement right before the deadline, a CISA spokesperson told MC that the agency was "pleased with the urgency with which agencies are addressing Log4j." However, it's still unclear how many agencies have fully patched the flaws. Ahead of the Christmas Eve deadline, a government cyber consultant told MC he wasn't optimistic about their ability to get it done in time. | | | | POLITICO TECH AT CES 2022 - We are bringing a special edition of the POLITICO Tech newsletter to CES 2022. Written by Alexandra Levine and John Hendel, the newsletter will take you inside the most influential technology event on the planet, featuring every major and emerging industry in the technology ecosystem gathered together in one place. The newsletter runs from Jan. 5-7 and will focus on the public policy related aspects of the gathering. Sign up today to receive exclusive coverage of the Summit. | | | | | Want to receive this newsletter every weekday? Subscribe to POLITICO Pro. You'll also receive daily policy news and other intelligence you need to act on the day's biggest stories. | | | BRING ON THE DETAILEES — A provision in the recently signed annual defense policy package could help the Office of the National Cybersecurity Director fill out its team as it continues to stand up the relatively new department amid a wave of cyber incidents. Through the National Defense Authorization Act signed into law last week, National Cyber Director Chris Inglis can now accept detailees from other agencies who can help the office build up its workforce and establish its mission. The ONCD also won't have to reimburse the detailee's agency for the salary costs. — Opportune timing : The national cyber director's office was just established in 2021, under last year's NDAA, and the bipartisan infrastructure package passed last year also established a $20 million budget for the office. Inglis has said he hopes to have roughly 75 full-time employees on board by the fall. — Hiring spree: Since the Senate confirmed Inglis as director in June, his office has been stacking its ranks with hires from the Cyberspace Solarium Commission, CISA and other government bodies. Federal CISO Chris DeRusha was recruited to serve for a dual-hat role as the deputy national cyber director. The office has already started accepting government detailees, including senior policy adviser Rex Booth, who is on detail from CISA. More on the horizon : Cyber-minded lawmakers don't want to stop at beefing up Inglis' office as they head back to the Hill this week. On the top of lawmakers' cyber to-do list this year is revisiting debates about mandatory cybersecurity incident legislation, as well as re-homing provisions in the reconciliation bill providing new funding to CISA and establishing cybersecurity training programs. | | | | A message from ManTech:   | | | | | | HANGING IN THERE — As Russian military forces continue massing on the Ukrainian border, the Biden administration is pushing a familiar strategy to salvage its diplomatic relationship, including its ransomware talks, with the Kremlin: Pushing for de-escalation. Following a call between President Joe Biden and Russian President Vladimir Putin last week, a senior administration official expressed hope in a call with reporters that the two countries could find a solution to the current crisis during "strategic stability talks" scheduled for later this month. Administration officials said similar things before the holidays. — But, but, but : In the latest conversation between the two leaders, Biden upped the ante by threatening both an increased NATO force presence on the Ukrainian border, as well as economic sanctions against Russia, if Putin continued to send forces to the border, the senior administration official said. In the meantime, the fate of the ransomware crisis hangs in the balance . Russia has become a hotbed for ransomware gangs in recent years, and the Biden administration has spent months in diplomatic discussions with Putin about gangs targeting critical infrastructure like the Colonial Pipeline. But if Putin decides to invade Ukraine, any progress made on the ransomware front could be lost. — Not helping matters: White House press secretary Jen Psaki said late last week that Biden also told Putin that "substantive progress" in other diplomatic discussions, including those about cyber activity, can only happen "in an environment of de-escalation rather than escalation." | | | | STEP INSIDE THE WEST WING: What's really happening in West Wing offices? Find out who's up, who's down, and who really has the president's ear in our West Wing Playbook newsletter, the insider's guide to the Biden White House and Cabinet. For buzzy nuggets and details that you won't find anywhere else, subscribe today. | | | | | | | | MANUFACTURING VULNERABILITIES — The critical manufacturing sector is facing a heightened risk to cyberattacks because of both a lack of cybersecurity professionals to fill open positions and the growth of remote works during the pandemic, CISA warned in a report late last week . Because manufacturing companies have had to rely on more automated tools to run their factories, they've opened themselves up more to cyberattacks, the agency warned. And that growing reliance on automated tools means companies also need to hire more experienced cyber professionals. — Mitigating risks: To manage these vulnerabilities, the agency recommended organizations invest in cybersecurity training and foster partnerships between "production resources and cybersecurity analysts." | | | Nick Leiserson has joined the Office of the National Cyber Director as deputy chief of staff. He was previously the legislative director for Rep. Jim Langevin (D-R.I.) who helped create the NCD office as a member of the Cyberspace Solarium Commission. | | | From The Washington Post's Joseph Marks: "Among her many wonderful attributes, #BettyWhite was a fierce advocate for multi-factor authentication and other cybersecurity protections. 'Love is a battlefield, but your online security doesn't have to be.'" | | | — An interview with CISA Chief of Staff Kiersten Todt about how the agency is recruiting "elite cybersecurity talent" (The Record) — GAO official: The U.S. needs a comprehensive national cybersecurity strategy to shore up its defenses. (Nextgov) — Missouri Gov. Mike Parson said he believes the state attorney general will bring hacking charges against St. Louis Post-Dispatch reporter who discovered a cybersecurity vulnerability in a government website. (St. Louis Post-Dispatch) — Shutterfly is recovering from a holiday ransomware attack (CyberScoop) — A part of Beijing's surveillance apparatus includes scouring Western social media sites, including Twitter and Facebook, for information about foreign parties, according to obtained contract bidding documents. (The Washington Post) — ICYMI: "Lesson from Log4j: Open-source software improvements need help from feds" (POLITICO) Chat soon. Stay in touch with the whole team: Eric Geller (egeller@politico.com); Bob King (bking@politico.com); Sam Sabin (ssabin@politico.com); and Heidi Vogt (hvogt@politico.com). | | | | A message from ManTech: At ManTech, offense-informed defense is how we tackle the toughest cyber threats. We discover vulnerabilities, reverse-engineer malware, develop tools, exploit media and hardware, conduct advanced forensics, and support specialized missions at scale.
Cybersecurity is integrated into everything we do, from securing our nation's most sensitive intelligence and protecting the homeland, to defending our troops and securing our personal information. Decades of critical mission support, R&D and cutting-edge innovation provide the foundation of our work. Our breadth and depth in offensive and defensive cyber are unparalleled, resulting in capabilities that protect sensitive intelligence, infrastructure, weapons systems, and people. ManTech's full-spectrum cyber operations help secure our nation and protect our citizens today and every day. To learn more, visit https://www.mantech.com/federal-cyber. | | | | | | | Follow us on Twitter | | | | Follow us | | | | |
Comments
Post a Comment