How prepared is Ukraine for Russian cyberattacks?

Delivered every Monday by 10 a.m., Weekly Cybersecurity examines the latest news in cybersecurity policy and politics.

Feb 22, 2022 View in browser   By Sam Sabin With help from Eric Geller  Quick Fix — Ukrainian officials have warned that a new bout of cyberattacks could launch today against its governments' websites. But it's doubtful Ukraine can fight them without additional tools and manpower. — Sen. Ron Wyden (D-Ore.) sits down with MC to discuss the EARN IT Act, a new CIA mass surveillance program and government use of facial recognition tools. — The Commerce Department is weighing whether to update a cybersecurity framework popular with the private and public sector. HAPPY TUESDAY, and welcome back to Morning Cybersecurity! I'm your host, Sam Sabin. Our thoughts are with the people of Ukraine as watch tensions on the Ukraine-Russia border bubble over this week. Have tips and secrets to share with MC? Or thoughts on what we should track down next? Send what you've got to ssabin@politico.com. Follow along at @POLITICOPro and @MorningCybersec. (Full team contact info below.) Let's get to it:   JOIN THURSDAY TO HEAR FROM MAYORS ACROSS AMERICA: The Fifty: America's Mayors will convene mayors from across the country to discuss their policy agendas, including the enforcement of Covid measures such as vaccine and mask mandates. We'll also discuss how mayors are dealing with the fallout of the pandemic on their local economies and workforce, affordable housing and homelessness, and criminal justice reforms. REGISTER HERE.     Want to receive this newsletter every weekday? Subscribe to POLITICO Pro. You'll also receive daily policy news and other intelligence you need to act on the day's biggest stories. Russia IS UKRAINE READY? — Cybersecurity teams around the world spent the weekend preparing for potential attacks tied to a Feb. 20 Russian invasion that never happened. But Ukrainian officials warn that today could actually be the day they've been dreading. The Ukrainian cyber agency CERT-UA warned Monday that hackers are planning to launch new cyberattacks today against Ukrainian public sector organizations, including the banking and defense sectors. "I'll make sure that most websites are down for at least one week," a hacker warned in a screenshot of a dark web post shared by CERT-UA. The message is an ominous sign for Ukraine , which has struggled to shore up its own cyber defenses before a Russian ground invasion. A string of recent cyberattacks targeting Ukrainian services and websites, as well as the West's failure to provide enough cyber aid in time, suggest the country isn't at all prepared to take on what Russia could have in store if it moves forward with a full ground invasion. Even the team of cybersecurity experts that the European Union said on Monday it will send to fight off any attacks might not be enough to help fully defend Ukraine. Here's where Ukraine's cyber defenses stand now: — Falling victim to recent attacks: Ukraine has already fallen victim to several smaller-scale Russian-led cyber incidents this year. So far, hackers have defaced dozens of Ukrainian government websites, installed malware wipers on government systems and deployed a distributed denial of service attack against both government sites and two state-run banks. Each of these attacks has been linked to Russia, with the Biden administration officially pinning the DDoS attack on Moscow on Friday. — Worrisome critical infrastructure security: Despite years of American, European and Ukrainian investments to help shore up the Ukrainian power grid against Russian threats, cybersecurity experts doubt the country's electric system is strong enough to fight off another Russian attack, as Maggie reported over the weekend. (Of course, the United States is also dealing with similar issues in shoring up its own critical infrastructure). — Attempts at cyber aid: While Ukraine put cybersecurity aid at the top of its asks of Western allies, the Biden administration and Congress haven't done much in the last two months to fill in the gaps. Congressional negotiations over a Russian sanctions bill, which could've included $50 million in cyber aid to Ukraine, fell apart last week . And the State Department's highly anticipated Cyber Diplomacy Bureau only just got congressional approval to move forward on Jan. 26. Surveillance SURVEILLANCE HEADACHES — Senate Finance Committee Chair Ron Wyden (D-Ore.) has spent most of his congressional career focused on privacy and surveillance issues — even before most people understood how much data and information new technologies are capable of collecting about Americans. The past month has brought many of those issues to the forefront for privacy advocates like Wyden: Senate Judiciary lawmakers advanced the EARN IT Act, which advocates worry will dissuade online platforms from using encryption. The IRS dropped ID.me's facial recognition tool after lawmaker and advocate scrutiny. And Wyden, along with Sen. Martin Heinrich (D-N.M.), uncovered another CIA mass surveillance program. MC caught up Thursday with Wyden about how he's mobilizing around each of these issues. This interview has been edited for length and clarity. MC: Now that the Senate Judiciary Committee has advanced the EARN IT Act, are you hearing from colleagues who are concerned about the impact the bill can have on encrypted services? Wyden : I've heard from a number of colleagues who think this is another one of those "feel-good" kind of ideas that doesn't do what's needed, which in this case is protect children from these monsters who exploit them in pictures and videos. What I'm going to do is oppose this with everything I've got. Look there's a choice: Do you want to do something effective, which is make sure you have the resources on the ground to fight these monsters? Or do you want to go along with something that sounds good, feels good and say you're doing something? MC: Switching gears to the CIA mass surveillance program that you and Sen. Heinrich uncovered earlier this month. What has the response been like since you released that information, and what comes next?  Wyden : The standard approach for the agencies when they know that you're making a valid point is just to say as little as possible and hope that it will go away. We're not going to let it go away. I know that [Executive Order] 12333 is not something most people are talking about in coffee shops across the country, but we're going to stay focused on it because we continue to believe that security and liberty aren't mutually exclusive. We'll have more to say, but we're already working on follow-up questions [to this month's letter]. This is not for the faint hearted, let us have some time. MC: And with regard to the IRS's ID.me contract, what other efforts are you and your colleagues taking to halt other government agencies from working with the company? Wyden: We just talked about it this morning. I want to work with Sen. Mike Crapo (R-Idaho), the ranking Republican on the Senate Finance Committee, to extend the IRS policy to other agencies and take the lead. I'm hopeful we can have bipartisan support on it. MC: Congress hasn't always been quick to take up surveillance or encryption concerns. What makes this time different? Wyden: This continues to evolve. It used to be because there were a whole host of areas where technology was simply incapable of intruding into people's personal lives. Now, we've seen that those times have changed, and it is capable of knowing virtually everything about everybody. If anything, the technologies have made these issues much more relevant to people. Critical Infrastructure FRAMEWORK OVERHAUL? — Commerce's National Institute of Standards and Technology is considering updating its well-known, widely used Framework for Improving Critical Infrastructure Cybersecurity as the number of cyberattacks grows and organizations face a different slate of cyber threats, according to a Federal Register notice scheduled for publication this morning. NIST is opening a 60-day comment period today to collect feedback on how the framework should be updated, as well as about how its newly launched National Initiative for Improving Cybersecurity in Supply Chains can fit into it. NIST is hoping to learn more about the current usefulness of the cybersecurity framework, any challenges organizations face in implementing it and whether the agency's current guidance properly addresses supply chain security threats, according to the notice. The comment period comes as the federal government is taking stock of its cybersecurity defenses following a wave of ransomware attacks last summer aimed at U.S. critical infrastructure. In May, President Joe Biden signed a cybersecurity executive order targeting the government's out-dated cybersecurity defenses. In it, the president directed NIST to write guidance for defending against supply chain threats. Now, NIST is hoping to understand how compatible its supply chain guidelines are with its go-to cybersecurity framework. — Well-timed: NIST also hasn't updated the Cybersecurity Framework since May 2018. At that time, the agency updated its guidelines for how to disclose vulnerabilities and how to verify users' identity. While NIST isn't guaranteed to follow through on an update after the current comment period, the stakes for an update are also high: Government officials have pushed both public and private organizations to use the framework for their own cybersecurity programs since its first release in 2014, and the Pentagon has based its recently updated cyber certification program for federal contractors on the framework. Vulnerabilities GONE PHISHING — Eighty-three percent of organizations said they experienced at least one successful email-based phishing attack in 2021, an increase from the 57 percent who said the same in 2020, according to Proofpoint's annual "State of the Phish" report released this morning. The report, which is based on a survey of 600 information and IT security professionals, also found that 11 percent of organizations had to respond to 10 or more successful phishing attacks in 2021. People on the Move — Rob Knake is joining the Office of the National Cyber Director as deputy national cyber director for strategy and budget. Knake, a senior fellow at the Council on Foreign Relations and a former director for cyber policy at the National Security Council, will start on Feb. 28. — Betsy Soehren-Jones has been named the chief operation officer of Fortress Information Security. She joins from Exelon where she was the director of cyber and physical security strategy. — Jennifer Tisdale is now the CEO of cybersecurity firm GRIMM . She was formerly a senior principal of cyber physical systems at the company. Tweet of the Day From Chris Kubecka, chair of the Middle East Institute's cyber program, who is based in Ukraine: "Every person in Kyiv I've talked to while I'm in Ukraine is concerned cyber attacks will hit critical infrastructure. From electric grid to banking services."   STEP INSIDE THE WEST WING: What's really happening in West Wing offices? Find out who's up, who's down, and who really has the president's ear in our West Wing Playbook newsletter, the insider's guide to the Biden White House and Cabinet. For buzzy nuggets and details that you won't find anywhere else, subscribe today.     Quick Bytes — "The US is unmasking Russian hackers faster than ever." (MIT Technology Review) — "Ukraine: UK ready to launch retaliatory cyber-attacks on Russia, defence secretary tells MPs" (The Independent) — Expeditors International, a Seattle-based logistics and freight company, suffered a cyberattack over the weekend that halted most of its operations. (BleepingComputer) — Cybersecurity and surveillance concerns linger as athletes, journalists and organizers head home from the Winter Olympic Games in Beijing. (The Associated Press) — ID.me disseminated talking points to state unemployment offices encouraging them to downplay the company's use of facial recognition, according to obtained documents. (CyberScoop) Chat soon. Stay in touch with the whole team: Eric Geller (egeller@politico.com ); Konstantin Kakaes (kkakaes@politico.com) ; Maggie Miller (mmiller@politico.com); Sam Sabin (ssabin@politico.com); and Heidi Vogt (hvogt@politico.com).   Follow us on Twitter Heidi Vogt @HeidiVogt Eric Geller @ericgeller Maggie Miller @magmill95 Sam Sabin @samsabin923 Konstantin Kakaes @kkakaes   Follow us

To change your alert settings, please log in at https://www.politico.com/_login?base=https%3A%2F%2Fwww.politico.com/settings This email was sent to rouf@idiot.cloudns.cc by: POLITICO, LLC 1000 Wilson Blvd. Arlington, VA, 22209, USA Please click here and follow the steps to unsubscribe.