| | | | |  | | By John Sakellariadis | | | | — Buoyed by its success working hand-in-glove with Ukrainian security specialists, the Department of Homeland Security wants to build new cyber defense partnerships elsewhere, Rob Silvers, the Department’s undersecretary for policy, told MC in an exclusive interview. HAPPY TUESDAY, and welcome to Morning Cybersecurity! There are a few thousand-dollar ideas I had to give up for journalism. There’s the clothing line for your Alexa, for example, or Hunger Games, a fast-casual food chain where you duel fellow customers in Catan for the right to free desserts. But I still haven’t figured out how to monetize not losing an umbrella. And judging by three very recent experiences, it’s an enormous market. Got tips, feedback or other commentary? Send them my way at jsakellariadis@politico.com. You can also follow @POLITICOPro and @MorningCybersec on Twitter. Full team contact info is below.
| | | | We’re spilling the tea (and drinking tons of it in our newsroom) in U.K. politics with our latest newsletter, London Playbook PM. Get to know all the movers and shakers in Westminster and never miss a beat of British politics with a free subscription. Don’t miss out, we’ve got some exciting moves coming. Sign up today. | | | | | Want to receive this newsletter every weekday? Subscribe to POLITICO Pro. You’ll also receive daily policy news and other intelligence you need to act on the day’s biggest stories.
| | | The president’s National Security Telecommunications Advisory Committee will vote on its recent draft report on internet resiliency. 3 p.m…Today, the Supreme Court will decide whether to consider a case regarding a key NSA surveillance program.
| | | FIRST IN MC: ROB SILVERS TALKS UKRAINE, PARTNERSHIPS AND THE CSRB — Ukraine’s success fending off Russian hackers has the Department of Homeland Security thinking big about cyber collaboration, Rob Silvers, a top DHS cyber official, told MC in a wide-ranging Monday interview. Fresh off the plane from the annual Munich Security Conference, Silvers said that Kyiv’s performance during the first year of the war demonstrated that investments in cyber resilience can pay big dividends — a proof-of-concept that is encouraging DHS to get more ambitious about working with other foreign partners, too. “Overall, Ukraine has been able to defend itself, its cybersecurity and its critical networks, much more effectively than I think even the optimists thought that it might,” said Silvers. “And our lesson taken away from that is we should be looking for opportunities to work with international partners much more intensively across the board.” What that would look like — Since before Russian tanks crossed the border, Silvers said, the Department has been working “at a high velocity and intensity” to support Ukraine’s computer emergency response team. Those engagements include daily threat exchanges, joint malware analyses and an ongoing program that brings Ukrainian operators to Idaho National Labs, where U.S. officials train them how to defend industrial control systems. That degree of operator-to-operator teamwork — what Silvers deemed “operational cyber defense partnership” — is something the Biden administration now wants to emulate elsewhere, he said. Ongoing and growing — Silvers pointed to the White House-led international counter-ransomware initiative and the new cybersecurity partnership that the U.S. inked with the signatories of the Abraham Accords as evidence of the administration’s push to do just that. Asked whether DHS was eyeing similar efforts in East Asia to blunt Chinese or North Korean threats, Silvers said the government would be “nimble and opportunistic” in identifying new cyber partnerships. “We’re looking at it and exploring all the opportunities where we think we can get points on the board from collaboration,” he said, noting the U.S. had recently struck a new cyber defense deal with Japan, too. Cyber safety review update? — Silvers, who chairs the Cyber Safety Review Board, offered two hints about where the after-action review panel’s second-ever report on the Lapsus$ ransomware gang might head. Unlike many other cyber crime cases, several Lapsus$ gang members turned out to be in countries that cooperate with Western law enforcement, Silvers said. As a result, the review will consider whether the right “laws and international law enforcement cooperation frameworks” are in place to disrupt criminals. It will also offer guidance for victims about responding “to these kinds of extortion-based attacks,” he added.
| | | TWITTER DRAWS IRE ON 2FA POLICY CHANGE — In his aggressive bid to boost Twitter’s business post-takeover, Elon Musk is yet again throwing security under the bus, allege security experts. What happened? Twitter sent security watchers into a weekend uproar when it announced that it will soon forbid users from employing text-based two-factor authentication and disable the security feature for those currently using it — that is, unless they become a paid subscriber by March 20. Why that matters — While text represents a relatively more insecure form of multi-factor authentication, it is still better than nothing, Rachel Tobac, chief executive officer of SocialProof Security, told me. Drawing on Twitter’s own transparency statistics, Tobac pointed out that while just 2.6% of the site’s users employ anything beyond a password, 74% of those users rely on SMS. That means many users could soon be nudged to downgrade their security — and worse, some may not even realize they’ve lost the protections they once had. “This is like you’re driving down the road, and on March 20th your seatbelt is unbuckled for you,” said Tobac, who was echoing CISA Director Jen Easterly in likening account security to automobile safety. “That’s the opposite of what we’re going for in security.” It’s about money — For his part, Musk was transparent that the move was about money, claiming in a Tweet that the change would save the company $60 million each year from scammers abusing fraudulent two-factor alerts. Known as SMS pumping, the caper involves registering premium telephone numbers at shady telecom companies and then triggering log-in attempts so the conspirators can rack up hefty bills from large services like Twitter. Real problem, wrong solution — Armin Ronacher, principal architect at application monitoring company Sentry, told MC over the weekend that SMS pumping can be a significant problem for businesses. Ronacher said Sentry decided to end its support for two-factor authentication because the scam brought the firm a huge bill — and Sentry thought SMS was too insecure anyway. But according to Ronacher, Sentry did something Twitter didn’t: phase out SMS-based two-factor slowly, in part by allowing existing users to continue using the feature “The problem is real,” said Ronacher. “But the Twitter thing is ridiculous because the site is also trying to sell Blue [the name of Twitter’s premium account service] on top of it.”
| | | FIRST IN MC: NEW CYBER INSURANCE BILL — A bipartisan pair of Senate lawmakers is introducing a bill to provide small businesses with better information on a growing but often convoluted tool for mitigating digital risk: cyber insurance. Co-sponsored by Sen. John Hickenlooper (D-Colo.) and Sen. Shelley Moore Capito (R-W.V.), the Insure Cybersecurity Act would require a new, interagency working group to study common sources of misunderstanding and friction between insurers and insureds, and produce guidance for the market. “Small businesses need to be able to count on cyber insurance policies to protect them. But policies can be confusing or unclear about coverage, leaving many businesses at more risk than they think,” reads a Hickenlooper press release shared first with MC. “That’s why we’re making more cyber insurance resources available and policy information easier to understand.” Team effort — The legislation would put the Commerce Department’s assistant secretary of Commerce for communications and information in charge of the task force, which would include representatives from CISA and NIST and the Departments of Justice and Treasury. Key questions — The interagency working group would have a year to produce guidance or recommendations on a range of both hot-button cyber insurance issues and more mundane challenges for the market. For example, the bill directs the task force to analyze and develop recommendations for policies relating to ransomware or ransom payments, and the “terminology used in policies to include or exclude losses” due to cyber terrorism or acts of war. It also wants the task force to study how insurers might improve what coverage they offer, such as exploring ways to better study and predict enterprise cyber risk. Chance of passage? — You’d need some remarkable actuarial tables to make a confident judgment at so early a juncture, but there’s a simple reason to believe the bill has legs. Hickenlooper is the new chair of the Commerce Committee’s Subcommittee on Consumer Protection, Product Safety, and Data Security, meaning the bill has an inside edge on its (possible) journey to the Senate floor and beyond.
| | | TELECOM BOARD TO MEET — An independent White House advisory panel will meet today to discuss ways to prevent hackers from abusing U.S. cloud computing services and vote on sending a draft report on telecommunications security to the White House. The meeting of the President’s National Security Telecommunications Advisory Board marks the first gathering to include the board’s 12 newest members, who President Joe Biden selected earlier this month and who overwhelmingly represent the cybersecurity industry. Taking advantage — Top executives from Amazon Web Services and Broadcom will kick off the substantive portion of the meeting with an update on their work studying how to prevent foreign spooks and crooks from staging their keyboard capers on U.S. servers. That’s a problem that the tech industry has struggled with for years. But expect it to assume new dimensions today, since it's coming amid a government push to require cloud companies to enforce stricter identity verification requirements on their customers. Herding cats —The 27-page report that the board is expected to send on to the president features seven recommendations for ensuring “internet resilience,” and among them lies a clear theme: NSTAC wants the White House to coax, cajole and needle agencies toward consistent, or “harmonized,” cybersecurity regulations. Coming from an industry-dominant group, that’s no surprise. But the idea has drawn support across the Biden administration, too, meaning the feds may find value in something like NSTAC's idea for a new Office of Cybersecurity Regulatory Harmonization within CISA.
| | | Dave Weinstein is now global CISO of Standard Industries. He previously served as the CISO and CTO for the State of New Jersey.
| | | CISA Director Jen Easterly weighed in on the Twitter two-factor kerfuffle over the weekend. It’s worth a read:
| 
Twitter | | | | — Joe Slowik, who has since written several highly-regarded studies of Russian cyber operations, has a terrific essay on the cyber lessons learned from the first year in Ukraine.
| | | — CyberScoop takes a deeper look at the NSA surveillance case the Supreme Court will decide today whether to hear. — The president of Moldova wants help from the West in fending off an alleged Russia coup plan that includes cyberattacks. (The Record) — A top NATO official wants the alliance to build “structural cooperation” with Google and Microsoft. (The Record) — Investigative journalists at nonprofit Forbidden Stories have found evidence of an “open source intelligence firm” that helps militaries spy on journalists and activists. Chat soon. Stay in touch with the whole team: Maggie Miller (mmiller@politico.com); John Sakellariadis (jsakellariadis@politico.com); and Heidi Vogt (hvogt@politico.com). ~~~~~
| | | | JOIN POLITICO ON 3/1 TO DISCUSS AMERICAN PRIVACY LAWS: Americans have fewer privacy rights than Europeans, and companies continue to face a minefield of competing state and foreign legislation. There is strong bipartisan support for a federal privacy bill, but it has yet to materialize. Join POLITICO on 3/1 to discuss what it will take to get a federal privacy law on the books, potential designs for how this type of legislation could protect consumers and innovators, and more. REGISTER HERE. | | | | | | | | | Follow us on Twitter | | | | Follow us | | | | |
Comments
Post a Comment