The CyberWire Daily Briefing, 4.2.20

Special Section

News for the cybersecurity community during the COVID-19 emergency

Obfuscation and misdirection.

One of the difficulties of assessing the COVID-19 pandemic in ways that might usefully inform effective disease-control policies has been the challenge of understanding the pandemic’s extent and the course infection takes in its sufferers. Chinese information control practices haven’t helped. The US Intelligence Community last week delivered a classified study to the White House that concluded, according to Bloomberg, that “China’s public reporting on cases and deaths is intentionally incomplete.”

Others with fewer or at least different dogs in this particular fight have reached the same conclusion. Vice summarizes Beijing’s policy with respect to information about the coronavirus, and it finds a comprehensive program of censorship and disinformation directed at both domestic and international audiences. Stanford University’s Internet Observatory says that deliberate misdirection and obfuscation (false suggestion and suppression of truth) have been in progress since January.

The pandemic's economic toll.

Lockdowns, illness, self-isolation, enforced closures, and the attendant throttling of commerce have taken a toll on all sectors. CNBC, in a non-rigorous but informative look at start-ups, concludes that more than thirty-five-hundred jobs were eliminated during March at some forty companies who’d collectively raised more than $14 billion in capital. The New York Times calls the job destruction “the great unwinding.” The tech sector and its security subsector have been less heavily affected than some others, but they’ve by no means been immune.

The case of Zoom.

Zoom has had a remarkable, wild, and decidedly mixed ride over the course of the pandemic. The remote conferencing service (listed on the Nasdaq as ZM) had between October and the end of January traded between $60 and $80. On February 3rd (three days after the US banned travel from China and the day after the first death outside China from COVID-19 was reported) the company’s shares rose to $87.66. They peaked at $159.56 on March 23rd (the day the UK’s lockdown began, six days after France imposed a nationwide lockdown and eight days after the US Centers for Disease Control recommended social isolation). It’s a telework-driven surge: as of last week, MarketWatch marveled, Zoom’s daily active user count was up 378% from where it was a year ago.

Zoom has since fallen off those highs, closing yesterday at $137.00. Problems with security and privacy have made for what Axios calls a “tarnished moment of glory.” WIRED thinks the issues--data-sharing that’s prompted a class action lawsuit, oversharing of user data, the relative ease with which skids and others have been able to intrude into sessions (“Zoombombing”), and two new zero days--collectively mean that “the Zoom privacy backlash is only getting started.”

Zoom itself (which Forbes credits with having at least as much transparency as to render the company relatively journalist-friendly) is working to fix its privacy and security issues. CEO Eric Yuan blogged that the company has frozen all updates other than those designed to enhance security. He’s also announced a variety of training and support initiatives, and has offered clarification (and where appropriate apologies) about certain Zoom features, notably its encryption, which turns out to have been less rigorous than marketing claims may have led users to believe.

The difficulties Zoom is experiencing are no doubt connected with its success: a sudden transformation from a reliable and user-friendly conferencing service to what amounts almost to a public utility. That’s Zoom’s view. As CEO Yuan wrote, “We did not design the product with the foresight that, in a matter of weeks, every person in the world would suddenly be working, studying, and socializing from home. We now have a much broader set of users who are utilizing our product in a myriad of unexpected ways, presenting us with challenges we did not anticipate when the platform was conceived.”

Axios offers a speculative but plausible explanation of what’s happening: “The same design choices and default settings that made Zoom so easy to install and use are the ones that make it vulnerable. The level of trust that users within a large company assume as they work together breaks down among more heterogeneous groups in public environments.” And it's so easy to use that it almost constitutes an attractive nuisance, as a Wall Street Journal story about virtual happy hours suggests.

What's become of cybersecurity conferences?

They're either being cancelled, postponed, or moved online. Three familiar names in the cybersecurity event space have announced plans to hold their events in virtual form. Suits and Spooks has announced its pleasantly named Safe House project, whose inaugural session will kick off on May 7th. SecurityWeek will run a full series of virtual summits, with seven scheduled so far. And Billington Cybersecurity, as it prepares to take its well-known summits online, is interested in hearing from the community about the topics and speakers they'd most like to engage. Sure, distributing swag will be a challenge, but it will be interesting to see how security conferences and the community they serve adapt to the challenges the current emergency poses.

Summary

By the CyberWire staff

Reuters reports that attempts to compromise the email accounts of World Health Organization staffers may be the work of Iranian operators. Anonymous sources close to the UN organization said the attacks seem connected to Tehran. Prevailion told Reuters that they saw significant circumstantial evidence suggesting an Iranian campaign. The cyberattacks on WHO have sometimes been linked to the DarkHotel APT, whose provenance is itself unclear.

Bitdefender has offered ZDNet an update on the Mandrake strain of Android malware discovered early this year. Mandrake focuses on Australian Android users, eschewing mass automated attacks in favor of human-run operations against selected targets. Mandrake appears to be a patient criminal attempt at what Bitdefender characterizes as “credential stealing, information exfiltration to money transfers, and blackmailing.”

Guardicore reports a long-running criminal campaign targeting MS-SQL servers. They call it “Vollgar” a portmanteau of “Vollar” (the cryptocurrency the campaign mines) and “vulgar” (which is how Guardicore views the criminals’ behavior). The servers make attractive targets not only for their computational power, but also for the large amount of sensitive data they hold.

Microsoft warns hospitals to expect a surge in ransomware attacks, and advises them on defense. Gangs using the REvil (a.k.a. Sodinokibi) ransomware strain have been especially active against healthcare targets.

Other cybercriminals have exhibited little of the restraint some gangs piously promised early in the pandemic: yesterday Italy’s INPS social security agency was taken offline by unspecified attacks (Reuters calls them simply “hackers”) as it was preparing to help citizens with COVID-19-related unemployment claims.

Mandiant FireEye M-Trends 2020 Report: Insights from the Front Lines

Notes.

Today's issue includes events affecting China, France, Germany, India, Iran, Italy, Malta, Russia, Ukraine, United Kingdom, United Nations, and United States.

Bring your own context.

We're pretty sure we heard our smart refrigerator ask Alexa how to give someone food poisoning. The refrigerator said it was "asking for a friend"—we think the toaster—but something seems off here. What should we do?

"I think the basic steps are network visibility, so visibility into the devices that you have that are connected into your network. That's the basic security control on top of which you can build other things. So you just need to know everything that's connected to your network and to be able to monitor. So network visibility and network monitoring are definitely the basis and then, on top of that, implementing proper segmentation, proper control of these devices, manageability on the devices that you can manage. Now, there is a whole problem with IOT devices that cannot be managed, but at least on those, you can also have monitoring, and segmentation and so on."

—Daniel dos Santos, security research lead at Forescout, on the CyberWire Daily Podcast, 3 .30.20.

OK, we're making a list...refrigerator, toaster, TV, Alexa, Fitbit...say, you following this, Siri?

CyberWire Pro delivers timely briefings about developing news.

Take a look at CyberWire Pro, our new subscription program designed for security professionals and all others who want to stay abreast of cybersecurity news. CyberWire Pro is a premium service that will save you time and keep you informed.

Aerospace news worthy of attention.

If you're interested in space and communications (technology, policy, business, and operations), take a look at Cosmic AES Signals & Space. Produced in partnership with the CyberWire, Signals & Space offers a monthly overview of news in this sector.

Transition your enterprise to a secured, remote work environment with McAfee.

Most companies aren’t prepared to secure data and assets for a surge of remote employees. Whether your VPN is over capacity, new cloud services are coming on-board, or new devices need protection, we have you covered during this critical time. McAfee is offering 3-month subscriptions for Endpoint Protection, Unified Cloud Edge, and CASB to help you scale security to your remote employees. Learn more about these offers at mcafee.com/workfromhome.

Podcast Summary

What easier way to stay informed is there, we ask you, friend, than to settle down with a podcast? Like today's CyberWire Daily Podcast, out as usual later this afternoon. We'll be speaking with our partners at Virtru, as Andrea Little Limbago describes the global battle for information control. Our guest is Perry Carpenter from KnowBe4, with observations on security awareness.

And Hacking Humans is up. In this episode, "Shedding light on the human element," Joe has the story of what might be called a very exposing scam. Dave has the scoop on a rare BadUSB attack. The Catch of the Day is a "lame scammer who needs to get a life," and we chat with Tom Miller from ClearForce about continuous discovery in the workplace and the human side of protecting your business.

— The cybersecurity community during the COVID-19 emergency

Pandemic impact report: Security leaders weigh in (CSO Online) A new survey of security and IT leaders sheds light on how organizations across industries are dealing with the COVID-19 crisis, how prepared they were, how vulnerable they are, and what the long-term impact may be.

Start-Ups Are Pummeled in the ‘Great Unwinding’ (New York Times) Dozens have laid off thousands, slashed costs and changed their businesses to try to survive the pandemic. All that may not work.

Start-ups cut nearly 4,000 jobs in March as coronavirus impact ripples through tech (CNBC) The layoffs, compiled by CNBC based on media reports, spanned more than 40 companies that have collectively raised nearly $15 billion.

Webcast: Pandemic Paradigm Shift: Remote Working is the New Normal (Black Hills Information Security) What does it mean to work from home across your corporate VPN? What exactly is VPN? Is your home office prepared? How can you improve and better secure your home network? Is your corporate network ready for the change in IT environment network access? Join us to explore these topics, and describe some potential actions …

Zoom Just Made These Powerful COVID-19 Security And Privacy Moves Following Outcry (Forbes) The COVID-19 crisis gave Zoom a huge surge in users, along with an outcry over security and privacy. But now the firm is aiming to put things right with a series of powerful moves...

A Feature on Zoom Secretly Displayed Data From People’s LinkedIn Profiles (New York Times) After an inquiry from Times reporters, Zoom said it would disable a data-mining feature that could be used to snoop on participants during meetings without their knowledge.

Zoom Video's active users soar as data privacy concerns grow (CRN Australia) FBI received multiple reports of disrupted conferences.

Zoom's 'Company Directory' feature exposes personal data of thousands (iMore) In another damning indictment of its security and privacy shortcomings, Zoom's Company Directory feature has shared the personal information of users with thousands of strangers who signed up using personal email addresses.

The Zoom Privacy Backlash Is Only Getting Started (Wired) A class action lawsuit. Rampant zoombombing. And as of today, two new zero-day vulnerabilities.

Palantir in Talks With Germany, France for Virus-Fighting Tool (Bloomberg) Data-mining firm has an agreement to provide analytics to U.K. Firm is also in talks with Austria, Switzerland for software.

FireEye: Managing email phishing risks during the quarantine (AMEInfo) Crime never sleeps: A global pandemic and quarantine have not prevented threat actors from waging attacks on unsuspecting users and businesses.

Coronavirus/COVID-19 Payment Lures on the Rise (Proofpoint) As the threat landscape continues to be dominated by coronavirus-related activity, Proofpoint researchers have observed an emerging trend of social engineering lures around financial relief.

Keep Calm and Carry On: 5 Data Security Do’s and Don’ts for Everyone (JD Supra) Cyber criminals see opportunity in the pandemic. Some exploit security vulnerabilities in remote working. Others prey on people’s fears by crafting...

Security And Privacy In A Brave New Work From Home World (Techdirt.) We have moved to a radically remote posture, leaving a lot of empty real-estate in corporate offices and abandoning the final protections of the digital perimeter. For years, we’ve heard that the perimeter is dead and there are no borders in...

Six Ways to Protect Yourself From COVID-19 Payment Fraud Attempts (Proofpoint) Threat actors continue to use coronavirus-related email lures at a staggering rate—currently more than 80 percent of the threat landscape is using the theme in some way.

Rajant's Globally Available Emergency Response Rapid Deployment Kit (Rajant Corporation) In light of the COVID-19 worldwide health crisis, Rajant Corporation and its global distribution and integration partners have made immediately available a private wireless network for mobile field hospitals and pop-up, health treatment shelters. Rajant’s “Emergency Response Rapid Deployment Kit” is the connectivity solution for facility-strapped healthcare, running out of medical space and patient beds…

First Orion's COVID-19 Fund Helps Essential Service Providers (First Orion Corp.) To aid essential businesses and service providers, we are providing our Inform for a period of time during the COVID-19 pandemic.

Intelligence agency contractors often can't work from home. Here's where that leaves them in a pandemic. (Washington Business Journal) Contractors doing classified work face an increasingly unpredictable environment amid the coronavirus pandemic. Here's how some of them are approaching it.

Cyber Attacks, Threats, and Vulnerabilities

Exclusive: Hackers linked to Iran target WHO staff emails during coronavirus - sources (Reuters) Hackers working in the interests of the Iranian government have attempted to break into the personal email accounts of staff at the World Health Organization during the coronavirus outbreak, four people with knowledge of the matter told Reuters.

Bitdefender reveals Mandrake spyware targeting Aussie Android users (ZDNet) Mandrake has been found subverting Google Chrome, Gmail, ANZ Australia, Commonwealth Bank of Australia, Bank of Melbourne Mobile Banking, Bank of SA, Australian Super, and PayPal apps.

The Vollgar Campaign: MS-SQL Servers Under Attack (Guardicore Labs) Guardicore Labs uncovers an attack campaign that’s been under the radar for almost two years, breaching MS-SQL servers and infecting them with remote-access tools and cryptominers.

WARNING: Hackers Install Secret Backdoor on Thousands of Microsoft SQL Servers (The Hacker News) Cyberattack Warning: Hackers Install Secret Backdoor and cryptocurrency malware on Thousands of Microsoft SQL Servers.

Hackers mining Monero on Microsoft SQL databases for last 2 years (HackRead) Microsoft has been doing a tremendous job in tackling cybercrime but lately, it has been facing large scale cyber attacks which is understandable since it’s a technology giant.

There's now COVID-19 malware that will wipe your PC and rewrite your MBR (ZDNet) Security researchers have discovered coronavirus-themed malware created to destroy users' computers.

Trojanized Zoom Apps Target Remote Workers (SecurityWeek) Malicious, re-packaged versions of the Zoom video conferencing application are targeting work-from-home Android users with adware and Trojans

Italy's social security website hit by hacker attack (Reuters) Computer hackers have attacked Italy's social security website, forcing it to shut down on Wednesday just as people were starting to apply for coronavirus benefits, the head of the welfare agency said.

Coronavirus: Microsoft directly warns hospitals, 'Fix your vulnerable VPN appliances' (ZDNet) Microsoft issues its first-ever targeted ransomware alert to hospitals over their vulnerable VPN appliances.

Microsoft warns hospitals of sophisticated ransomware attacks targeting remote workforce (FierceHealthcare) Microsoft is warning hospitals that sophisticated ransomware attacks are trying to exploit remote workers to gain access to their networks. The tech giant recommends immediate actions hospitals should take to reduce the risk of an attack.

Hackers ‘without conscience’ demand ransom from health providers (The Malaysian Reserve) When hackers broke into computers at Hammersmith Medicines Research Ltd, a London-based company that carries out clinical trials for new medicines, it was a nightmare scenario for MD Malcolm Boyce

LimeRAT malware is being spread through VelvetSweatshop Excel encryption technique (ZDNet) The old tactic is proving fruitful in a new campaign.

Critical Flaw in SEO Plugin Exposed Many WordPress Sites to Attacks (SecurityWeek) A critical vulnerability in the Rank Math SEO plugin for WordPress could allow attackers to lock administrators out of their own websites

Flaw in WordPress plug-in turns hackers into admins (SC Magazine) Wordfence discovers flaw that could grant or revoke admin rights to any registered user, another allows attacker to control website navigation

SMBGhost Vulnerability Allows Privilege Escalation on Windows Systems (SecurityWeek) Researchers have released PoC exploits to demonstrate that the Windows vulnerability tracked as SMBGhost and CVE-2020-0796 can be exploited for privilege escalation

Watering hole attack uses Adobe Flash update warnings (SC Magazine) Kaspersky discovered watering hole websites targeting Asian ethnic group; preferred method for toppers in ATP Who’s Who, said CYFIRMA researchers

QR code generator scam steals thousands in Bitcoin (Naked Security) Every once in a while an attack comes along that is so simple to set up, and yet so effective, that it makes your jaw drop. Here’s one.

Cyber attackers target children at home (Information Age) Kids more likely to click on links and download malware.

Phish of GoDaddy Employee Jeopardized Escrow.com, Among Others (KrebsOnSecurity) A spear-phishing attack this week hooked a customer service employee at GoDaddy.com, the world’s largest domain name registrar, KrebsOnSecurity has learned.

Voter list in huge data breach was compiled by the Labour Party (Times of Malta) A massive cache of data which was leaked online is understood to have originated from the Labour Party and shows the voting preferences of a majority of the population. The personal information on some 337,384 people includes names, addresses,ID card details, phone numbers and whether they are...

Most smartphone apps have ‘backdoor secrets’ for hackers (Express Computer) Cybersecurity researchers have discovered that a large number of mobile phone applications contain hardcoded ‘backdoor secrets’ allowing hackers to access private data or block content provided by users

Security Patches, Mitigations, and Software Updates

Patch Released for Linux Kernel Vulnerability Disclosed at Hacking Contest (SecurityWeek) A patch has been released for a Linux kernel vulnerability that a researcher exploited at the Pwn2Own 2020 competition to escalate privileges to root on Ubuntu Desktop

Cyber Trends

Increased Data Recovery and Ransom Payments Are Stimulating the Ransomware Industry, Finds ‘2020 Cyberthreat Defense Report’ (BusinessWire) CyberEdge Group today announced the availability of its seventh annual Cyberthreat Defense Report. Findings include record-setting cyberattacks.

CISOs Suffering From Increasingly Complex Workload: Cisco (SecurityWeek) Cisco's annual CISO benchmark report examines what it means to be a CISO today by surveying 2,800 IT decision makers, and discussing issues with a panel of CISOs.

CISO Conversations: Verizon, AT&T CISOs Talk Communications Sector Security (SecurityWeek) SecurityWeek talks to Chandra McMahon (CISO at Verizon) and Bill O’Hern (CSO at AT&T) to discuss the role of CISO and what it takes to be a successful CISO.

28% of parents in the Middle East worry about harmful online content, proving the importance of reliable parental control software (Zawya) Harmful content can be found everywhere on the internet, even in-app advertising, where the producer of such materials can profit from applications

Marketplace

Axonius nabs $58M for its cybersecurity-focused network asset management platform (TechCrunch) As companies get to grips with a wider (and, lately, more enforced) model of remote working, a startup that provides a platform to help track and manage all the devices that are accessing networked services — an essential component of cybersecurity policy — has raised a large round of g…

Collibra Raises $112.5M to Help Businesses Make Data-Driven Decisions (PR Newswire) Collibra, the Data Intelligence company, today announced $112.5 million in funding at a post-money valuation of $2.3 billion, bringing the...

BlackBerry CEO: How Cylance Differentiates In Unified Endpoint Security (MSSP Alert) BlackBerry CEO describes how Cylance differentiates in unified endpoint security (UES) market. Plus, COVID-19 reality check & integrations with Microsoft Intune & VMware AirWatch.

KnowBe4’s Year-Over-Year Sales Increase 40% Q1 2020 Compared to Q1 2019 (Globe Newswire) KnowBe4 named a leader in security awareness and training evaluation, appointed a new board member and won numerous awards

Forcepoint shakes up local leadership (CRN Australia) Adds four new names to regional leadership team.

Nutanix appoints ANZ boss out of NetSuite (CRN Australia) Lee Thompson replaces Jamie Humphrey.

Products, Services, and Solutions

IRONSCALES Themis™ Emerges as World’s First Fully Autonomous AI Email (PRWeb) IRONSCALES, the pioneer of self-learning email security, today announced that Themis, its AI-driven virtual security analyst, now has the ability...

enclayve Launches Private Communications Network for Consumers (PR Newswire) enclayve Group has launched the enclayve Block, a social media product that you own. It addresses the crucial problem of privacy and data...

Enzoic Helps Organizations Reduce The Threat of Insider Risks From Poor Password Hygiene in Active Directory (BusinessWire) Enzoic helps organizations reduce the threat of insider risks from poor password hygiene in Active Directory.

Panther Labs Launches Open-Source Cloud-Native SIEM (SecurityWeek) San Francisco-based cloud security startup Panther Labs has launched the first stable version of its open-source security information and event management (SIEM) solution, Panther

Flexera Launches Patch Automation for Software Vulnerability Manager (Globe Newswire) Manage more with existing resources thanks to intelligent automation

EPFL software to enable secure data-sharing for hospitals (Mirage News) The MedCo system aims to facilitate medical research on pathologies - such as cancer and infectious diseases - by enabling secure computations on...

Amazon Detective: AWS Cloud Security Service Launches (MSSP Alert) Amazon Detective, and AWS cloud security service, launches to help organizations investigate security incidents across their AWS workloads.

Blue Prism Teams Up with SailPoint to Deliver New Governance and Security Capabilities (PR Wire) Looking to extend its industry leading security capabilities, Blue Prism (AIM: PRSM) today announced a partnership with SailPoint, a market leader in enterprise...

Okta Partners with VMware, CrowdStrike to Boost Log-In Security (Yahoo) Okta Inc., a maker of identity management software, unveiled three cybersecurity partnerships meant to help safeguard corporate networks while millions of employees have been forced to work remotely.Okta announced the agreements Wednesday with VMware Inc.’s Carbon Black unit, CrowdStrike

Obsidian Partners with Snowflake to Consolidate Security Visibility at Scale (Odessa American) Obsidian Security, the Cloud Detection and Response company, and Snowflake, the cloud data platform, today announced a partnership to deliver unified operational visibility of cloud applications, networks, and endpoints.

Technologies, Techniques, and Standards

North American utilities drill 'GridEx' brings record turnout — except from supply chain vendors - CyberScoop (CyberScoop) A November drill involving electric utilities across North America mimicked the disruptive malware used to cut power in Ukraine in 2016, testing operators’ ability to expunge the malicious code from their systems.

The Swiss version of the GCA Cybersecurity Toolkit supplements the new edition of the Cybersecurity quick check for SME (PR Newswire) Today the Global Cyber Alliance (GCA) in partnership with ICTswitzerland and the Swiss Academy of Engineering Sciences (SATW) is launching the...

How can you strengthen an enterprise third-party risk management program? (Help Net Security) Sean Cronin, CEO of ProcessUnity, explores the challenges related to enterprise third-party risk today and in the future.

Creating the optimal cloud defense strategy (ITP.net) | Cloud, F5 Networks, Security, Hybrid Cloud, Back in the day, the theft and loss of backup tapes and laptops were a primary cause of data breaches. That all changed when systems were redesigned and data at rest was encrypted on portable News

Coronavirus doesn't stop Indian Army from carrying out its annual cyber security exercise (ThePrint) Army had earlier issued advisory claiming India's adversaries were launching coronavirus-themed campaigns to infect official or personal IT assets of defence personnel.

Colorado National Guard Practicing ‘Muscle Memory’ Cybersecurity (MeriTalk) The Colorado National Guard is ramping up its cybersecurity awareness, starting with a cultural change to normalize cyber practices and the introduction of a cyber mascot, CIO Col. Isaac Martinez shared at a March 31 Cybersmart webinar.

Research and Development

Shift5, Inc., Awarded Cooperative Research and Development Agreement (CRADA) with US Army (PR Newswire) Shift5, Inc., a cybersecurity company, announces its Cooperative Research and Development Agreement (CRADA) with the US Army Combat...

Academia

Mass school closures in the wake of the coronavirus are driving a new wave of student surveillance (Washington Post) Colleges are racing to sign deals with “online proctor” companies that watch students through their webcams while they take exams. But education advocates say the surveillance software forces students to choose between privacy and their grades.

A guide to the UK's top universities for cyber-security (SC Magazine) SC's table (enclosed) looks at UK educational institutions catering for cyber-security, whether that be dedicated cyber MScs or MBAs, more niche digital forensic or broader courses in computer science.

Legislation, Policy, and Regulation

Chinese COVID-19 disinformation campaigns commenced as early as January: Stanford (ZDNet) This culminated in a Chinese government official accusing the US military of starting the outbreak on social media.

Russia's Planned Coronavirus App Is a State-Run Security Nightmare (Gizmodo) Like other countries, COVID-19 rocked both Russia and its neighbors, with recent numbers pointing to a collective 4,375 residents across the post-Soviet states being infected by the virus. And while some of these territories are seemingly less than worried about the pandemic, Russia’s spent the bulk of this week rolling out a series of initiatives to surveil its citizens that are putting experts on edge.

The Sinicization of Russia’s Cyber Sovereignty Model (Council on Foreign Relations) In recent years, Russia has mimicked China's model of cyber sovereignty. This will likely harm Russian domestic security and influence in its near-abroad.

National Strategy to Secure 5G Addresses Infrastructure Risk Posed by Adversarial Foreign Vendors (Homeland Security Today) 5G infrastructure

'New IP' is an actual Huawei threat to networks (Light Reading) A new system for the Internet is a far greater threat to the West than Huawei's role in 5G networks.

Agencies to get more insight into their cybersecurity posture this month (Fifth Domain) The new Continuous Diagnostics and Mitigation dashboard is set to be deployed this month.

()

Cybersecurity Decision Making Demands Guidance (SIGNAL Magazine) An organization’s cybersecurity stance also involves a combination of technology and solid decision making at an organization’s highest levels.

Former DHS secretaries to propose major reforms streamlining resources for cybersecurity, coronavirus threats (FedScoop) A bipartisan group including former Department of Homeland Security secretaries plans to recommend major reforms in July to improve the department’s response to emerging threats, including cyberthreats. When President Trump ordered incoming flights from Europe to be screened for COVID-19 starting March 14, DHS couldn’t access the doctors, supplies or facilities needed to do that efficiently, …

FCC requires anti-robocall tech after “voluntary” plan didn’t work out [Updated] (Ars Technica) Pai follows Congress' orders, requires carriers to verify Caller ID accuracy.

Senators slam 'reckless' House over surveillance debacle (POLITICO) Senators were livid after House lawmakers left Washington without temporarily extending FISA provisions.

Federal officials scramble to ensure tech glitches, bureaucracy don’t delay $1,200 coronavirus checks (Washington Post) The $2 trillion law signed by the president last week calls for payments to be made "as rapidly as possible," as the Trump administration looks to put much-needed cash in the hands of an estimated 150 million Americans. But the Treasury Department's ability to meet that congressional mandate hinges on a series of systems it is still bringing online.

Analysis | The Cybersecurity 202: States plan to expand mobile voting amid coronavirus pandemic, despite security concerns (Washington Post) States weigh increasing access to voting during a crisis with cybersecurity risks.

Australian state will install home surveillance hardware to make sure if you're in virus isolation, you stay there (Register) Could be a wearable, could be wired. Backed by big fines and jail

Microsoft president calls Washington state’s new facial recognition law ‘a significant breakthrough’ (GeekWire) Microsoft President Brad Smith took a break from responding to the COVID-19 outbreak Tuesday to praise Washington state’s landmark facial recognition regulations. Washington Gov. Jay Inslee signed a…

Litigation, Investigation, and Law Enforcement

Infosec Reviews Not Good for Small Business Administration, Veterans Affairs Department (Nextgov.com) Audits note poor posture and highlight weaknesses related to remote work and contractor oversight.

Zelensky: Over 100 perpetrators spinning coronavirus disinformation exposed (UNIAN) The president urged citizens to remain vigilant and trust official information sources only.

Facebook, Chamber Back Bid To Strike TCPA Autodialer Ban (Law360) Facebook, the U.S. Chamber of Commerce and more than a half-dozen others have joined the push to convince the U.S. Supreme Court to invalidate the Telephone Consumer Protection Act's autodialer ban, arguing that axing the entire speech-abridging provision is the only way to properly remedy First Amendment deficiencies.

Preparing For Private Right Of Action Under Calif. Privacy Law (Law360) While enforcement of the California Consumer Privacy Act won’t begin until July, the private right of action created by the CCPA is available to consumers now, and companies assessing their litigation risk should evaluate three open questions, say Amanda Lawrence and Michael Rome at Buckley.

UK Supreme Court rules that Morrisons can't be held responsible for 2014 data breach (Computing) The company was facing compensation claims from thousands of former and current employees over the security incident

Industry Events

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

National Cyber League (NCL) Spring Season (Various locations, Mar 19 - May 15, 2020) The National Cyber League (NCL) is a defensive and offensive puzzle-based, capture-the-flag style cybersecurity competition. Its virtual training ground helps high school and college students prepare and test themselves against cybersecurity challenges that they will likely face in the workforce. All participants play the games simultaneously during Preseason, Individual Game and Team Game. NCL allows players of all levels to enter. Between easy, medium and hard challenges, students have multiple opportunities to really shine in areas as they excel. Registration for the Spring Season closes March 20, 2020.

InfoSec World (Lake Buena Vista, Florida, USA, Mar 30 - Apr 3, 2020) Join your peers and our experts at InfoSec World 2020 Conference & Expo on March 30 – April 1 to not only address the disruptive technologies and threats on the horizon, but to create a plan for managing the people, processes and tools for how your organizations react and cope with these intrusive circumstances.

4th Annual Denver Cyber Security Summit (Denver, Colorado, USA, Apr 2, 2020) C-Suite & Senior Level Executives: Register with Promo Code CYBERWIRE95 to receive $95 Admission (Standard Price is $350). Learn from renowned experts from the U.S. Dept. of Homeland Security, U.S. Dept. of Justice, Cisco, Darktrace, ExtraHop, and more about the latest threats facing your company.

SINET ITSEF 2020 (Mountain View, California, USA, Apr 2, 2020) Bridging the Gap Between Silicon Valley and the Beltway. SINET – Silicon Valley provides a venue where entrepreneurs can meet and interact directly with leaders of government, business and the investment community in an open, collaborative environment focused on identifying solutions to Cybersecurity challenges.

CMMC Forum 2020 (Falls Church, Virginia, USA, Apr 2, 2020) During Potomac Officers Club’s CMMC Forum 2020 on April 2nd, some of the top executives from the federal government and industry will explore the impact DoD’s CMMC will have on cybersecurity practices, supply chain security and other aspects of the federal market. The forum will feature Katie Arrington, chief information security officer at the Office of the Assistant Secretary of Defense for Acquisition and a 2020 Wash100 Award recipient, as a keynote speaker. She will address the CMMC’s timeline, how the certification process could change and will provide a memorandum of understanding with a newly established CMMC accrediting body.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

WHO attacks linked to Iran? Mandrake active in Australia. Vollgar vs. MS-SQL servers. COVID-19 and the cyber sector.