Articles

Time running out to protect US November elections

lead centered=”no”
Experts say it’s too late for significant legislative action to better protect voting this fall, but meaningful changes are still possible.
/lead

Four years have passed since the 2016 presidential election when revelations of Russian hacking of the DNC threw political contests into turmoil. In the aftermath, the Mueller investigation, Justice Department indictments and other efforts made clear that the US election and voting systems themselves were the targets of cyberattacks. The subsequent Mueller probe and DOJ indictments also revealed massive Russian digital disinformation campaigns that permeated the election.

Now, as the country heads into the next presidential campaign weakened by a pandemic and laboring under a collapsed economy, little has happened over the past four years to substantially shore up voting, campaign or election security, with only marginal improvements made around the edges. There is time, though, to implement last-minute security measures that could substantially improve election integrity, experts say.

This article appeared in CSO Online. To read the rest of the article please visit here.

Articles

New DOE document names China, Russia as threats to…

lead centered=”no”
A US Department of Energy RFI seeks information on energy industry’s supply chain security practices following executive order to develop industry regulations.
/lead

On May 1, the Trump Administration issued an Executive Order on Securing the United States Bulk Power System that seeks to remove from the power grid crucial electric equipment supplied by vendors from foreign adversarial nations. Yesterday, the Department of Energy (DOE), Office of Electricity issued a request for information (RFI) “seeking information to understand the energy industry’s current practices to identify and mitigate vulnerabilities in the supply chain for components of the bulk-power system (BPS).”

The RFI is a follow-on to the executive order (EO), which directs the Energy Department, in consultation with other agencies, to develop regulations implementing its goals through a rulemaking process. The EO defines electric equipment as items used in substations, control rooms and power generating stations, including reactors, capacitors, substation transformers, large generators, voltage regulators, along with several other defined pieces of electrical equipment.

This article appeared in CSO Online. To read the rest of the article please visit here.

5G

Domestic 5G development at core of US communications security…

lead centered=”no”
New NTIA document outlines White House 5G security goals, which promote home-grown R&D and call for continuous risk assessment and management.
/lead

In late March, during the first phase of the coronavirus lockdown, the White House issued a little-noticed document entitled The National Strategy to Secure 5G of the United States, which articulates a “vision for America to lead the development, deployment, and management of secure and reliable 5G communications infrastructure worldwide, arm-in-arm with our closest partners and allies.” The document was the White House’s effort to comply with the Secure 5G and Beyond Act, which required the president to” develop a strategy to ensure the security of next generation mobile telecommunications systems and infrastructure in the United States.”

The Act also required the president to submit within 180 days an implementation plan developed in consultation with a host of government departments and agencies. In May, the Commerce Department’s National Telecommunications and Information Administration (NTIA) began a proceeding to receive comments on how it might implement the vision of the White House Strategy, with the comment period ending on June 25. Early this week, NTIA posted the comments it received from 80 organizations, corporations and interested individuals.

This article appeared in CSO Online. To read the rest of the article please visit here.

Articles

Bipartisan bill could bring back the White House national…

lead centered=”no”
Cyberspace Solarium Commission leaders introduce the National Cyber Director Act to reintroduce cybersecurity expertise into the White House.
/lead

Last week a bipartisan group of US House of Representatives legislators introduced the National Cyber Director Act to create the position of a national cyber director within the White House. The creation of this role is one of the chief recommendations of an increasingly influential intergovernmental group known as the Cyberspace Solarium Commission.

The commission issued its report — the product of months-long deliberations by four members from congress, four senior executive agency leaders and six experts from outside of government – just as the coronavirus pandemic quarantine kicked in during March. Nevertheless, the commission’s 80 recommendations, such as creating a national cyber director, are quickly being translated into actionable legislation on Capitol Hill.

Two of the commission’s leaders, Cyberspace Solarium Chair Congressman Jim Langevin (D-RI) and Solarium Co-Chair Congressman Mike Gallagher (R-WI), introduced the bill. Other legislators backing the bill include House Oversight and Reform Committee Chairwoman Carolyn Maloney (D-NY), Ranking Member of the Committee on Homeland Security’s Subcommittee on Cybersecurity, Infrastructure and Innovation John Katko (R-NY), former Ranking Member of the House Intelligence Committee C. A. Dutch Ruppersberger (D-MD), and Ranking Member of the House Intelligence Committee’s Subcommittee on Intelligence Modernization and Readiness Will Hurd (R-TX).

This article appeared in CSO Online. To read the rest of the article please visit here.

Articles

New Republican bill latest in long line to force…

lead centered=”no”
Here we go again. Senate Republicans push a new bill to mandate “lawful access” to encrypted devices and data. It won’t end until law enforcement has better cyber forensics capabilities./lead

In what seems like Groundhog Day when it comes to encrypted communications, a group of Republican senators last week introduced the Lawful Access to Encrypted Data Act, which aims to end the use of so-called “warrant-proof” encrypted technology by terrorists and criminals. Senate Judiciary Committee Chairman Lindsey Graham (R-SC), Tom Cotton (R-AR) and Marsha Blackburn (R-TN) introduced this latest measure to find a way for law enforcement to gain access to devices and data that are protected by unbreakable encryption methods.

“The Lawful Access to Encrypted Data Act is a balanced solution that keeps in mind the constitutional rights afforded to all Americans while providing law enforcement the tools needed to protect the public from everyday violent crime and threats to our national security,” the Senators said in a statement.

Although the bill’s proponents don’t say so explicitly, the “lawful access” it seeks to establish mirrors a long string of potentially damaging efforts by the federal government to install backdoors into encrypted communications, according to critics. Virtually all cybersecurity and cryptography experts insist that any break in the encryption chain will break security and protection altogether, leaving criminals and adversarial nation-states with even more power to hack into users’ devices and communications for nefarious purposes.

This article appeared in CSO Online. To read the rest of the article please visit here.

Articles

Data security risks threaten approval of Chinese undersea cable…

lead centered=”no”The US government’s “Team Telecom” wants to partially deny a proposed undersea cable connection between the US and Hong Kong over surveillance, data theft concerns./lead

On June 17, the intergovernmental group known as Team Telecom filed on behalf of the Executive Branch a recommendation to the Federal Communications Commission (FCC) to partially deny an undersea cable system application by a Chinese company called Pacific Light Cable Network (PLCN). Team Telecom (recently renamed as the Committee for the Assessment of Foreign Participation in the United States Telecommunications Services Sector) consists of the Department of Homeland Security )DOH) and the Department of Defense (DOD) led by the Department of Justice’s National Security Division, Foreign Investment Review Section. In its filing Team Telecom specifically urged the commission to reject that part of the application that involves a direct connection between the US and Hong Kong.

The rationale for the recommended rejection echoes similar recent moves by the Trump Administration to push Chinese technology out of the US telecommunications system and power grid supply chains. The White House, along with Team Telecom, has stepped up its arguments that China poses a digital and technology security threat, a contention that is occurring against a backdrop of soured trade negotiations and a politically deteriorating relationship between the US and China.

This article appeared in CSO Online. To read the rest of the article please visit here.

Articles

Revised DOJ compliance guidance offers risk-management lessons for cybersecurity…

lead centered=”no”
Prosecutors use this guidance to assess criminal liability in a compliance breach, so it behooves business and security leaders to understand the expectations.
/lead

In February 2017, the Criminal Division of the US Justice Department (DOJ) issued its first-ever guidance for prosecutors of white-collar crime to use when assessing whether a company complied with its own risk management program. The document urged prosecutors to consider whether a company’s compliance program is appropriately “designed to detect the particular types of misconduct most likely to occur in a particular corporation’s line of business” and “complex regulatory environment.” That guidance was updated in April 2019 into a formal document called “The Evaluation of Corporate Compliance Programs.”

Both documents aim to give prosecutors criteria to consider when bringing criminal charges. The three fundamental questions prosecutors are urged to answer when assessing whether the compliance programs are helping to “promote corporate behaviors that benefit the American public” are:

  1. Is the program well-designed?
  2. Is the program effectively implemented?
  3. Does the compliance program work in practice?

On June 1, the DOJ issued yet another update to its compliance guidance, this time weaving in new language to make sure compliance programs aren’t merely one-and-done snapshots, but are instead dynamic programs that get updated to fit changing circumstances. The new guidance also asks prosecutors to make sure compliance programs are adequately resourced within organizations.

This article appeared in CSO Online. To read the rest of the article please visit here.

Articles

Senate subcommittee blasts FCC and Team Telecom approach to…

lead centered=”no”
A report claims that oversight of Chinese telecoms for security threats to the US communications supply chain is lacking and without adequate authority.
/lead

The Senate Permanent Subcommittee on Investigations released on Tuesday a report, “Threats to US Networks: Oversight of Chinese Government-owned Carriers.” The document slams the current government review process that oversees how Chinese telecom companies operate in the United States for not rigorously monitoring Chinese tech providers. It outlines a Senate investigation that began shortly after the Federal Communications Commission (FCC) in May 2019 denied a China Mobile USA application to provide international telecom services.

The subcommittee said it reviewed more than 6,400 pages of documents and conducted more than ten interviews, including interviews with representatives from the FCC, Department of Justice (DOJ), Department of Homeland Security (DHS), China Telecom Americas, China Unicom Americas, ComNet, AT&T, Verizon and CenturyLink. The subcommittee also said it met with researchers who analyzed the Chinese government’s use of telecommunications carriers to hijack communications.

The subcommittee’s investigation found that the FCC and “Team Telecom,” a formerly informal group composed of representatives from the DOJ, DHS and Department of Defense, have failed to adequately monitor three Chinese government-owned carriers, China Telecom Americas, China Unicom Americas, and ComNet since they began operating in the United States in the early 2000s.

This article appeared in CSO Online. To read the rest of the article please visit here.

Articles

New cybersecurity recommendations for US government target IoT, social…

lead centered=”no”
The COVID-19 pandemic spurs the Cyberspace Solarium Commission policy initiative to issue a set of four security recommendations for the federal government in the wake of the crisis.
/lead

The Cyberspace Solarium Commission is a unique policy initiative created in 2019 to cut through the complexity of the vast and dense cybersecurity challenges facing the country. It is composed of lawmakers and government officials from across several agencies who, working with outside experts, are devising “a strategic approach to defending the United States in cyberspace against cyberattacks of significant consequences.” The high-profile focal point group came out this spring with an ambitious report that offered 75 recommendations to keep the country safe from digital threats.

Last week, the commission took its prerogative one step further. It came out with its first white paper, Lessons from the Pandemic, a timely document articulating the changes the COVID-19 crisis creates for cybersecurity. The pandemic “illustrates the challenges of ensuring resilience and continuity in a connected world,” co-chairs Senator Angus King (I-ME) and Representative Mike Gallagher (R-WI), wrote in their executive summary of the white paper.

The white paper contains observations about the parallel connections between cybersecurity and the pandemic. It stresses 32 of the commission’s original recommendations, which King and Gallagher said have attained “renewed importance” in light of the coronavirus crisis.

This article appeared in CSO Online. To read the rest of the article please visit here.

Articles

Cyber LEAP Act aims for innovations through Cybersecurity Grand…

lead centered=”no”New bill seeks to set up competitions across the US to spur security breakthroughs./lead

The Senate Commerce Committee approved last week what could prove to be an essential piece of legislation for cybersecurity researchers: The Cybersecurity Competitions to Yield Better Efforts to Research the Latest Exceptionally Advanced Problems, or Cyber LEAP Act of 2020. Sponsored by Commerce Committee Chairman Roger Wicker (R-MS) and Senators Cory Gardner (R-CO) and Jacky Rosen (D-NV), the bill establishes a national series of Cybersecurity Grand Challenges so that the country can “achieve high-priority breakthroughs in cybersecurity by 2028.”

The challenges set up under the legislation will offer prizes, including cash and non-cash prizes, to competition winners, although the prizes aren’t yet spelled out. The legislation directs the secretary of commerce to set up the competitions in six key areas:

Economics of a cyber attack, focused on building more resilient systems while raising the costs for adversaries
Cyber training, to give Americans digital security literacy and boost the skills of the cyber workforce
Emerging technology, to advance cybersecurity knowledge in emerging technologies such as artificial intelligence
Reimagining digital identity, aimed at protecting the digital identities of US internet users
Federal agency resilience, to reduce cybersecurity risks to federal networks and improve the federal response to cyberattacks
Other challenges as determined by the secretary of commerce

This article appeared in CSO Online. To read the rest of the article please visit here.