| | | | |  | | By Sam Sabin | With help Eric Geller
| | | — After the Senate quickly passed its massive cybersecurity bill, the measure's fate rests on whether House lawmakers and the Biden administration can resolve their differences. — The SolarWinds CEO talks about preparing for any new Russian espionage campaigns and how the company kept customers after their own incident last year. — Ukraine spent years trying to push out Russian telecommunications providers to stymie surveillance and cyber espionage. The war is highlighting what stymied some of those attempts. HAPPY MONDAY, and welcome back to Morning Cybersecurity! I'm your host, Sam Sabin. Hopefully you were all able to spend some time rejuvenating and resting before what is sure to be another whirlwind week of cybersecurity news. Have tips and secrets to share with MC? Or thoughts on what we should track down next? Send what you've got to ssabin@politico.com. Follow along at @POLITICOPro and @MorningCybersec. Full team contact info below. Let's get to it:
| | | ON THE AGENDA — The Senate's passage of massive cyber legislation, which includes mandatory cyber incident reporting, came swiftly last week. Now lawmakers will have to figure out how to get it through the House, especially as Biden administration officials publicly debate the liability protections found in the portion requiring companies to alert CISA to hacks within 72 hours. — What's in the bill: The Strengthening American Cybersecurity Act,S. 3600, includes the mandatory cyber incident reporting requirement as well as updates to the Federal Information Security Management Act, which dictates agencies' cyber rules, and the Federal Risk and Authorization Management Program, which regulates how agencies purchase cloud services. Each of those items failed to pass last-minute in last year's National Defense Authorization Act, and the Senate combined them into one package in early February. — A House divided? While House lawmakers working on their companion efforts told MC last week that they're excited to push the bill forward, a lobbyist familiar with the negotiations told Maggie Thursday that while House lawmakers are on board with the incident reporting mandate in the legislation, the Senate's decision to quickly push the bill through came as House negotiators were still hashing out GOP concerns about in their own legislation updating FISMA. Because of that, the lobbyist, who remained anonymous to speak freely about closed-door talks, said the potential for FISMA reform could be dead in Congress. — Biden administration squabbles: An FBI official told Eric that the bureau is pushing for the incident reporting mandate to include immunities for any company that reports a hack to their agents. As it stands now, only reports to CISA will receive immunity, and the FBI worries that will discourage companies from coming to them during a cyberattack. It's not just the fate of this massive cyber legislation that MC is watching on Capitol Hill this week. Members of the intelligence community, including NSA Director and Cyber Command lead Paul Nakasone, will testify before the House and Senate intelligence committees for their annual worldwide threats hearing. Officials will testifyin the House on Tuesday and inthe Senate on Thursday. Given the growing anticipation that more Russian-led destructive cyberattacks could be heading towards the United States as the war in Ukraine carries on, expect lawmakers to have plenty of questions about how the United States will fight off any incoming hackers.
| | | | HAPPENING TUESDAY, INTERNATIONAL WOMEN'S DAY, AN IMPORTANT CONVERSATION ON THE WOMEN IN AFGHANISTAN: Join Women Rule editor Elizabeth Ralph for a panel discussion on the future for Afghan women. Guests include Hawa Haidari, a member of the Female Tactical Platoon; Cindy McCain, U.S. ambassador to the United Nations Agencies for Food and Agriculture; Roya Rahmani, Afghanistan's first female ambassador to the U.S.; and Sen. Jeanne Shaheen (D-N.H.). Learn how female Afghan veterans are planning their futures, what the women still in Afghanistan face, and what the U.S. can do to help. REGISTER HERE. | | | | | Want to receive this newsletter every weekday? Subscribe to POLITICO Pro. You'll also receive daily policy news and other intelligence you need to act on the day's biggest stories.
| | | WORDS OF WISDOM — SolarWinds CEO Sudhakar Ramakrishna knows firsthand what it's like to experience the kinds of Russian cyberespionage threats that many businesses fear right now. When he first started in the top role in January 2021, his company was already dealing with the fallout from the crisis now known as the SolarWinds hack, which compromised at least nine federal agencies and roughly 100 companies. With U.S. government officials continuing to warn about the threat of Russian state-sponsored hackers tied to the Ukraine war, your MC host spoke with Ramakrishna exclusively in a new Q&A published this morning about how SolarWinds is preparing to fend off potential Russian espionage campaigns and his advice for business leaders. As a bonus for MC readers, here are a few excerpts from the conversation that didn't make it into the full Q&A (all edited for length and clarity). MC: Given that SolarWinds has recent experience dealing with a Russian espionage campaign, are more people coming to you for advice on what to do now? Ramakrishna: My conversations — let's say between January of 2021 and April of 2021 — with my customers were largely about: "What happened? How did it happen?" Now more and more my conversations are about "What did you learn? How did you implement the changes? How can we learn what you did and apply it to our environments so that we can create a better, safe and secure environment?" MC: How prepared is SolarWinds now for another possible espionage campaign? Ramakrishna: I am humbled to say that there is no such thing as a bulletproof security environment. One of the key areas that our chief information security officer undertakes is security training for employees. If you look at a lot of the issues that happen in every company, it's got less to do with the technology that they have deployed and more to do with the user errors. I cannot tell you how many companies have synthetic phishing attacks that they generate against themselves, and the click rate is uncomfortably high. That's the level of education that we have to do as a company and as a team. MC: After SolarWinds uncovered its hack, what strategy did you use to keep customers? Ramakrishna: The most important thing with customers is transparency, in terms of sharing what happened, what you know, what you are doing about it, et cetera. Two is urgency: They appreciate that you're telling them what happened, but they want to know what you're doing about it. Third one is constant communication with those people: Telling them, here's where we are, here's what we're doing next, here's where we're going. Fourth one is really humility, which for me is a function of owning the problem.
| | | CALL ME, MAYBE? — Russian access to social media networks and Western news sources is already fleeting as a result of the war in Ukraine. But, by and large, Ukrainians still have access to their internet and mobile phone services more than 10 days into the invasion, as your MC host and my colleague Laurens Cerulus report. There's a good reason for it: Ukrainian telecommunications networks have a trove of data that Russian state-sponsored hackers could be tapping for surveillance purposes. And despite the Ukrainian government's efforts in recent years to make it harder for Moscow to tap their phone calls, the current conflict is putting a spotlight on the challenges facing those efforts: — Battling business interests : Prior to the 2014 Crimea annexation, most of Ukraine's telecommunications providers were also either owned by Russians or Russian-Ukrainian businesspeople, giving Moscow the opportunity to lean on the private sector for help to listen into phone calls or collect metadata and geolocation info about Ukrainians, said Chris Kubecka, a cyberwarfare specialist known for getting Saudi Aramco back online after its infamous 2012 cyberattack. — Holes in the Huawei model: After Russia's annexation of Crimea in 2014, Ukraine moved to squeeze Russian mobile providers out of the country, similar to the United States' efforts to push China's Huawei. Last year, Ukrainian President Volodymyr Zelenskyy signeda round of sanctions blocking Russian IT companies, as well as media outlets and payment systems, from operating in the country. However, some Russian ownership still lingered: Russian oligarch Mikhail Fridman served on the board of Dutch telecom company Veon up until last week. Veon owns Kyivstar, the most popular provider in Ukraine. — Uphill battle: Because Russia built much of the telecom infrastructure that's still standing today in Ukraine, it's relatively easy for Russian hackers to tap those networks, said Jim Lewis, director of the strategic technologies program at the Center for Strategic and International Studies. So even if Ukraine was successful in pushing Russia out of its networks completely, Russian hackers could still use call logs and other metadata pulled from past access to inform dissident lists, said Ariel Parnes, a former top cyber official at the Israeli Intelligence Service and COO at Mitiga.
| | | | DON'T MISS POLITICO'S INAUGURAL HEALTH CARE SUMMIT ON 3/31: Join POLITICO for a discussion with health care providers, policymakers, federal regulators, patient representatives, and industry leaders to better understand the latest policy and industry solutions in place as we enter year three of the pandemic. Panelists will discuss the latest proposals to overcome long-standing health care challenges in the U.S., such as expanding access to care, affordability, and prescription drug prices. REGISTER HERE. | | | | | | | | FINAL COUNTDOWN — Mandiant warned in a blog post Friday that they have "moderate confidence" that retaliatory destructive Russian cyberattacks are on their way, with Moscow likely to target Ukrainian organizations first and then possibly NATO allies. Mandiant believes Sandworm, a Russia state-sponsored hacking group behind the NotPetya attack, will likely be among the groups conducting the retaliatory attacks, and organizations that have made publicly statements against Russia or in support of Ukraine "face elevated risk of future reprisal," the post said.
| | | — Ret. Air Force Gen. Herbert "Hawk" Carlisle is stepping down from his role as CEO and president of the National Defense Industrial Association
| | | From Matthew Green, a cryptography professor at Johns Hopkins University: "I am so glad that people spent the past several peaceful years building tools like Tor and Signal, so that people would have them when they were needed."
| | | — The growing number of volunteer hackers entering the Ukraine conflictare prompting concerns about attribution (The New York Times). And one member of Ukraine's volunteer cyber corps described the group as "a self-organizing swarm." (The Associated Press) — A top Ukrainian government official said the country has locked down its electrical grid and nuclear power systems against Russian cyber attacks. (The Washington Post) — The Justice Department said a Romanian hacker has been extradited to the United States to face charges alleging he stole and sold millions of credit card numbers obtained through malware attacks. — Op-ed from former NSA general counsel: "I've Dealt With Foreign Cyberattacks. America Isn't Ready for What's Coming."(The New York Times) Chat soon. Stay in touch with the whole team: Eric Geller (egeller@politico.com); Konstantin Kakaes ( kkakaes@politico.com) ; Maggie Miller (mmiller@politico.com); Sam Sabin (ssabin@politico.com); and Heidi Vogt (hvogt@politico.com). | | | | Follow us on Twitter | | | | Follow us | | | | |
Comments
Post a Comment