| | | | |  | | By John Sakellariadis | With help from Eric Geller
| | | — CISA oversees half of all the country's critical infrastructure sectors. It's an enormous mandate — and one lawmaker is concerned the agency can't handle it. HAPPY MONDAY, and welcome to Morning Cybersecurity! I have fallen seriously behind "The Rings of Power," and I forbid you from spoiling it for me. On an unrelated note, I recently watched two more seasons of "Emily in Paris" than I ever intended to. Don't judge me. Got tips, feedback or commentary for MC? Email me at jsakellariadis@politico.com . You can also follow @POLITICOPro and @MorningCybersec on Twitter. Full team contact info is below. Want to receive this newsletter every weekday? Subscribe to POLITICO Pro . You'll also receive daily policy news and other intelligence you need to act on the day's biggest stories.
| | | Emily Goldman, a strategist at U.S. Cyber Command, speaks at a Heritage Foundation event about her co-authored book on U.S. cybersecurity strategy. Noon.
| | | OVERWORKED — A key House Democrat is concerned that CISA may be stretched too thin managing the cyber and physical security of eight infrastructure sectors, far more than any other agency. "There must be greater transparency and accountability around CISA's role as a [sector risk management agency], how it measures success, and whether it has the authorities and resources it needs to oversee multiple sectors of critical infrastructure effectively and exclusively," Rep. Ritchie Torres, a member of the House Homeland Security cyber subcommittee, said in an Oct. 14 letter to CISA Director Jen Easterly. We're watching: Torres' letter, first reported by MC, underscores congressional concerns about CISA's ability to triage its massive responsibilities, particularly as the Biden administration seeks to impose new cyber regulations on multiple industries. The letter also emphasizes Torres' interest in playing a larger role on cyber policy for House Democrats and sharpening Congress' oversight of the issue, ambitions he discussed in an August interview with POLITICO. With multiple cyber-focused members retiring in January, Torres is poised to play an increasingly important role in holding agencies' feet to the fire on their cybersecurity missions. Deets, please: Torres asked Easterly about CISA's "unique activities, initiatives, or risk management efforts" in the eight sectors it manages, from dams to nuclear reactors, as well as information about how CISA maintains relationships with companies in those sectors and what it considers each sector's biggest risk. NIPP it in the bud: Torres also asked when CISA would complete its overdue update to the National Infrastructure Protection Plan and how that overhaul would inform its updates to each sector's plan.
| | | | NEW AND IMPROVED POLITICO APP: Stay up to speed with the newly updated POLITICO mobile app, featuring timely political news, insights and analysis from the best journalists in the business. With a fresh look and improved features, the sleek and navigable design offers a convenient way to access POLITICO's scoops and groundbreaking reporting. Don't miss out on the app you can rely on for the news you need, reimagined. Already a POLITICO app user? Upgrade today! DOWNLOAD FOR iOS – DOWNLOAD FOR ANDROID . | | | | | | | | MAKING A CASE — Top cyber defense officials from across the U.S. government are taking the stage this week at Mandiant's Worldwide Information Security Exchange Conference (mWISE), in what will be a key opportunity for the Biden administration to promote its progress on cybersecurity ahead of the midterms. Here are some key themes that you might see from NSA Cybersecurity Directorate lead Rob Joyce, National Cyber Director Chris Inglis and CISA Director Jen Easterly: National cyber strategy — With last week's publication of the Biden administration's new national security strategy, the "doomsday clock" for the follow-on cyber document officially stands at one minute to midnight. If Inglis doesn't tip the new cyber strategy, expect him to address three themes sure to animate it: industry's responsibility to meet the government halfway on mitigating cyber threats, a clarification of the roles and responsibilities of the federal government's cyber defense bureaucracy and how to overcome the cyber talent shortage in America. Incident reporting — It's nearing two years since U.S officials learned that top-tier Russian hackers had burrowed into the supply chain of nine federal agencies and upwards of 100 private companies, and a key lesson from that experience is sure to feature heavily at mWISE: the need for private companies to report breaches to the federal government. That's not just because FireEye — the company who lifted the lid on SolarWinds by disclosing that Kremlin hackers had slipped its defenses — will be playing host. One day before Easterly takes the stage, CISA will hold its first and only D.C. listening session for the new incident reporting bill. Doing the basics — Don't assume industry execs at a fancy cyber confab are beyond some instruction in the basics: Two weeks ago, Joyce's Cybersecurity Directorate fired a warning shot at the country's defense industrial base, highlighting how multiple foreign hackers had slipped into a defense contractor's network and gained access to sensitive national security information. Industry can hawk shiny cyber products that allegedly mitigate "uber-sophisticated" threats all it wants. But expect Inglis, Easterly and Joyce to hammer home the importance of two-factor authentication, least privilege account management and network segmentation.
| | | WOLF IN SHEEP'S CLOTHING — A previously unidentified ransomware strain that bears conspicuous overlap with Russian intelligence is menacing critical infrastructure entities in Ukraine and Poland, according to researchers at Microsoft. Superficially just another attempt to string cryptocurrency from desperate victims, the so-called "Prestige" ransomware attacks raised the eyebrows of Microsoft researchers last Friday because they affected several transportation and logistics companies within the span of an hour, bore no ties to known ransomware groups and appeared to deploy different tradecraft across victims — a far-cry from the rote approach of most criminal groups, which tend to work more mechanically from victim to victim. Not having seen such activity before, Microsoft researchers were unable to tie the attacks to a known threat actor. However, they left little doubt about their suspicions, underscoring that the attack "shares victimology with recent Russian state-aligned activity." New tool, same game — If the Kremlin is responsible, the attacks would mark a new spin on a familiar pattern of Russian cyber activity in Ukraine. Since the Russian invasion last February, Kremlin-linked hackers have pummeled Ukrainian networks with data-destroying "wiper" attacks. While ransomware can have the same effect, it encrypts but does not delete data, meaning information theoretically remains recoverable to victims. A mystery, sort of — Along with the Kremlin's apparent efforts to avoid re-using known tradecraft, that distinction could help the Russian government deny its involvement in the attacks. That argument might seem thin, but it's a card Russia has played many times before, both literally — having launched a destructive cyberattack, NotPetya, that masqueraded as ransomware — and figuratively — with the Kremlin often denying involvement in nefarious activities despite overwhelming evidence to the contrary, as with the downing of Malaysia Airlines Flight 17.
| | | SURVEILLANCE STATE — A report out this morning from the Atlantic Council explores how the People's Republic of China uses investments in a web of private surveillance tech companies to pursue two goals: becoming a global technology leader and exerting domestic social control. The report, authored by Bulelani Jili, also argues China's public-private partnerships have helped it export surveillance technologies to the Global South, presenting a new and growing threat to U.S. national security interests. BACK AT IT — Researchers at Palo Alto Network's Unit 42 have identified links between a pesky new group of extortionists and a notorious ransomware gang, according to a report published Friday. The so-called Ransom Cartel cybercrime group likely "had some relationship" to REvil — a prolific Russian ransomware group that went quiet after authorities in Moscow cracked down on it last January. Appearing shortly after REvil's disappearance, Ransom Cartel appears to have access to some REvil source code but not some of the group's other tools, write the Unit 42 researchers.
| | | Dr. Kate Klonick, who studies how private platforms govern online speech, has an interesting thread about what the recent Meta vs. Wire dust-up reveals about the fallibility of digital evidence. Take a look here :
| 
Twitter | | | | Today, identity and access management provider Okta will announce it is joining the Alliance for Digital Innovation, an industry association that lobbies for government adoption of advanced digital technologies.
| | | — Former Wall Street Journal reporter accuses law firm of hiring cyber mercenaries to sabotage his career. (Reuters) — How much information should state and local governments disclose in the wake of a cyberattack? (Governing.com) — State Department wants Silicon Valley to be a closer ally when it comes to the country's national security. (Wall Street Journal) — For two years, Microsoft "botched" a key Windows security measure. (Ars Technica) Chat soon. Stay in touch with the whole team: Eric Geller ( egeller@politico.com ); Maggie Miller ( mmiller@politico.com ); John Sakellariadis ( jsakellariadis@politico.com ); and Heidi Vogt ( hvogt@politico.com ). ~~~~~~
| | | | LISTEN TO POLITICO'S ENERGY PODCAST: Check out our daily five-minute brief on the latest energy and environmental politics and policy news. Don't miss out on the must-know stories, candid insights, and analysis from POLITICO's energy team. Listen today . | | | | | | | | | Follow us on Twitter | | | | Follow us | | | | |
Comments
Post a Comment