The CyberWire Pro Policy Briefing for 1.15.20

Summary

By the CyberWire staff

US-Iranian tensions may not have abated, but they appear at least not to have escalated. Observers see Washington's "maximum pressure" policy toward Tehran as entering a crucial phase (see, for example, this Washington Examiner op-ed), and most continue to expect a significant part of the conflict to play out in cyberspace. Congress is engaged in one of its periodic phases of asserting its Constitutional war powers, and in doing so it's being advised, WHBQ reports, to calculate cyber effects and consequences closely and carefully.

The Washington Post sees NSA’s disclosure of a flaw in Windows' CryptoAPI as representing a departure in policy. The Agency’s Cybersecurity Directorate head, Anne Neuberger, did say that it was a “change in approach,” even as she suggested that such disclosures should now be regarded as a matter of routine policy. While some observers have seen NSA as changing its ways to play nicely by disclosing bugs instead of weaponizing them, the real change was NSA’s decision to allow its disclosure to be made public. Fort Meade had disclosed vulnerabilities before, but there’s a new openness to the process now. And, of course, should there be grave reasons to do so, the Agency could move to retain its discoveries if its mission required it to do so.

The Department of Homeland Security’s Cybersecurity and Infrastructure Security Directorate (CISA) also issued Emergency Directive 20-02, which requires the agencies whose security CISA oversees (basically the dot-gov domain, minus certain "national-security systems") to apply the January patch within ten days. CISA also encourages state and local governments, private sector organizations, and the general public to do the same.

The Guardian reports that the British government is largely unmoved by the latest push from its American cousins to exclude Huawei from the UK's coming 5G build-out. A decision has yet to be reached, but it seems likely that the British government will decide that the risks Huawei kit poses are manageable, and that it can handle them without jeopardizing trans-Atlantic intelligence sharing.

In the US, the Federal Communications Commission seems ready to expand its ban on both Huawei and ZTE gear, JDSupra reports. According to CNBC, the US Commerce Department is considering stronger supply-side measures against the Chinese firms, with tighter export controls against them under consideration. Such controls would have an impact on third-countries as well. And a bipartisan group of Senators is, Florida Daily reports, introducing the “Utilizing Strategic Allied (USA) Telecommunications Act,” which would provide more than $1 billion to Western companies developing alternatives to Chinese 5G hardware.

Estonia and the US are cooperating more closely on cyber defense, as joint development of a cyber collaboration platform is announced.

Selected Reading

Trump slams Apple for refusing to unlock iPhones of suspected criminals (CNBC) "We are helping Apple all of the time on TRADE and so many other issues, and yet they refuse to unlock phones used by killers, drug dealers and other violent criminal elements," Trump tweeted.

CISA Releases Emergency Directive and Activity Alert on Critical Microsoft Vulnerabilities (CISA) The Cybersecurity and Infrastructure Security Agency (CISA) has released an Emergency Directive and Activity Alert addressing critical vulnerabilities affecting Windows CryptoAPI and Windows Remote Desktop Protocol (RDP) server and client. A remote attacker could exploit these vulnerabilities to decrypt, modify, or inject data on user connections.

Critical Vulnerabilities in Microsoft Windows Operating Systems (CISA) New vulnerabilities are continually emerging, but the best defense against attackers exploiting patched vulnerabilities is simple: keep software up to date. Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats.

Where did the NSA find a cybersecurity vulnerability? (Government Technology) Answer: In Windows 10.

Microsoft, NSA say security bug affects millions of Windows 10 computers (TechCrunch) Microsoft has released a security patch for a dangerous vulnerability affecting hundreds of millions of computers running Windows 10. The vulnerability is found in a decades-old Windows cryptographic component, known as CryptoAPI. The component has a range of functions, one of which allows develope…

Estonia and the US to build joint cyber threat intelligence platform (ERR) A joint platform for sharing cyber threat intelligence will be built by Estonia and the United States to enhance the cyber defence capabilities of both countries and exchange information.

NSA found a dangerous Microsoft software flaw and alerted the firm — rather than weaponize it (Washington Post) The National Security Agency recently discovered a major flaw in Microsoft’s Windows operating system — one that could potentially expose computer users to significant breaches or surveillance — and alerted the firm of the problem rather than turn it into a hacking weapon, according to people familiar with the matter.

The Cybersecurity 202: Intelligence official pledges heightened transparency on election threats (Washington Post) The U.S. intelligence community will share all the information it can about hacking threats against the 2020 election following the last presidential race that saw substantial interference from Russia.

After Soleimani, 'maximum pressure' campaign against Iran has entered a critical phase (Washington Examiner) Less than 24 hours after Defense Secretary Mark Esper warned of possible preemptive action against Iran, a historic strike killed Quds Force leader Qassem Soleimani, Iranian proxy militia commander Abu Mahdi al Muhandis, and other Islamic Revolutionary Guard Corps officers. These individuals, and…

Cyber security expert says U.S. response needs “careful calculation” (WHBQ) Cyber security expert says U.S. response needs “careful calculation” if Iran carries out cyber attack

Why we’re introducing a resolution on war with Iran (Washington Post) For more than 40 years, the United States and Iran have had a troubled relationship. Because of the Iranian regime’s insistence on spreading terror throughout the region and its efforts to develop nuclear weapons, multiple administrations have considered a broad range of options — both military and diplomatic — to counter these threats.

Senate Cybersecurity Co-Chairman to Pompeo: How Is State Dept. Protecting Systems from Iran? (Homeland Security Today) Warner cites two separate reports by the Department of State’s Office of the Inspector General (OIG) that detail a number of cybersecurity risks presented by the structure of the Department of State and by hiring freezes affecting the department.

Sen. Warner presses State Department for plan to address Iranian cyber threats (13newsnow.com) Senator Warner is looking for answers on how the U.S. State Department plans to defend its information security systems.

As the UK nears a decision on Huawei, what’s the story so far? (The Telegraph) After more than a year of debate and intense lobbying, the UK is finally nearing a decision on whether to allow China's Huawei to supply parts the its 5G network.

UK rebuffs US presentation on Huawei security risks (the Guardian) A source said the threat outlined by US officials had already been ‘factored into our planning’

Huawei 5G: the UK has been warned not to allow parts of the network's service – here's what to do if you have a Huawei phone (Scotsman) It "would be madness" to use technology provided by Huawei to help build the UK's 5G network, the British government has been warned by the US.

Trump’s Most Critical Huawei Threat Just Confirmed In ‘Surprisingly Outspoken’ Interview (Forbes) There can be no doubt now as to the seriousness of U.S. threats against the U.K. over Huawei—threats with serious implications for global security.

Ben Wallace interview: We can’t rely on US (Times) Britain must prepare to fight wars without America, the defence secretary has warned, amid concerns that President Donald Trump will pursue an ever more isolationist foreign policy.In an interview

Trump administration moves toward blocking more sales to Huawei, sources say (CNBC) The U.S. government is nearing publication of a rule that would vastly expand its powers to block shipments of foreign-made goods to China's Huawei, as it seeks to squeeze the blacklisted telecoms company, two sources said.

FCC Signals It May Be Prepared to Greatly Expand Its Proposed Ban on Huawei and ZTE Equipment (JD Supra) As previously reported, the FCC’s ban of Huawei and ZTE equipment and services from projects subsidized by the FCC’s Universal Service Fund (USF)...

Marco Rubio: US Needs to Create 5G Alternative to Chinese Backed Huawei, ZTE (Florida Daily) U.S. Sen. Marco Rubio, R-Fla., is pushing on Capitol Hill for Western alternatives to Chinese companies like Huawei and ZTE in order to develop 5G communications.

'We want to win the next war': US Army will revamp cyber operations to counter Russia and China (Washington Examiner) As warfare continues to enter the digital realm, the Army plans to transform its cyber operations branch into a full-scale information warfare command, according to a top U.S. general.

3-Star: We Must Combat Russian Attempts to Influence Troops Online (Military.com) Russian misinformation efforts are reaching into the military ranks.

How one official wants to increase DHS cyber efficiency (Fifth Domain) The new Cybersecurity and Infrastructure Security Agency assistant director shared that adversaries switching up tactics are challenging CISA, which is looking to evolve how it collects and shares threat indicators.

Census Bureau kicks off 2020 ad campaign amid fears around privacy and hacking (Washington Post) The Census Bureau on Tuesday unveiled an ad campaign to persuade every household in America to fill out the once-a-decade survey, which begins next week in remote parts of Alaska.

As digital reliance grows, agencies brace for cyber attacks (Carolina Coast Online) Most computer- and internet-literate people have probably heard of scams and cyber attacks on individuals, but computer criminals also go after bigger targets, like local governments.