Implementing the Cyberspace Solarium. Securing elections. Telework TTPs.

Summary

By the CyberWire staff

At a glance.

The National Defense Authorization Act as a vehicle for Cyberspace Solarium recommendations.
Risks to elections, and the cost of securing them.
Policies for telework: advice from CISA and NSA.

Implementing Cyberspace Solarium recommendations.

One of the co-chairs of the Cyberspace Solarium Commission, Representative Mike Gallagher (Republican, Wisconsin 8th), thinks that the National Defense Authorization Act is the right place to begin implementing the recommendations the Commission reported. Defense News quotes Representative Gallagher as saying, "We think there's probably about 30% of our recommendations that could be put into the NDAA process." The chair of the House Armed Services Committee, Representative Adam Smith (Democrat, Washington 9th), chairman of the House Armed Services Committee said that the NDAA would be “a logical vehicle” for the recommendations Congress can agree on.

Risks to elections, and the cost of securing them.

The Brennan Center has released a report on election security that advocates increased Federal funding for state election authorities. They examined five states, concluded that they all needed significant help, and that the other states are probably in the same boat as well. The report highlighted four areas the researchers believe should be adddressed:

"developing the infrastructure necessary to support changed voter behavior (e.g., more voters choosing to register online or to vote by mail)"
"protecting voters and election workers during elections (e.g., giving poll workers PPE, allowing curbside voting, cleaning polling places, and ensuring that election staff can work off-site as needed without exposing election offices to cyberattacks)"
"educating the public about changes made to election procedures and polling locations (including notice of changed elections, moved polling sites, and new voting options to reduce density at in-person locations)"

The study offers a detailed breakdown of the cost of addressing these issues in each of the states, and the security enhancements won't come cheap.

Telework in the agencies: advice from CISA and NSA.

As Federal agencies conduct as much of their business online as possible during the COVID-19 pandemic emergency, both CISA and NSA have offered detailed guidance on how to do so securely and effectively.

CISA's recommendations focus specifically on Microsoft Office 360. Because of the haste with which many agencies are deploying the Office 360, CISA thinks it all too likely that sound deployment and configuration practices may be overlooked. They recommend that admins pay particular attention to six best practices:

"Use multi-factor authentication. This is the best mitigation technique to protect against credential theft for O365 administrators and users."
"Protect Global Admins from compromise and use the principle of 'Least Privilege.'"
"Enable unified audit logging in the Security and Compliance Center."
"Enable Alerting capabilities."
"Integrate with organizational SIEM solutions."
"Disable legacy email protocols, if not required, or limit their use to specific users."

NSA's advice, "Selecting and Safely Using Collaboration Services for Telework," after providing considerations to bear in mind when selecting a telework service, offers these high-level recommendations on how to use it:

"If possible, use government furnished equipment (GFE) that is managed and intended for government use only and secure services designed for government use."
"If you download a collaboration service app, be sure you know where it came from."
"Ensure that encryption is enabled when initiating a collaboration session."
"Use the most secure means possible for meeting invitations."
"Verify that only intended invitees are participating before beginning, and throughout, each session."
"Ensure that any information shared is appropriate for the participants."
"Ensure that your physical environment does not provide unintentional access to voice, video, or data during collaboration sessions."

Selected Reading

National Security Agency Releases Cybersecurity Guidance for Remote Workers (Security Magazine) The U.S. National Security Agency (NSA) has released cybersecurity guidance, containing a snapshot of current, commercially-available collaboration tools available for telework use, along with a list of security criteria to consider when selecting which capability to leverage.

How telework has changed two agencies’ IT practices (Federal Times) Top IT officials from the Small Business Administration and General Services Administration discussed how coronavirus has changed IT at their agencies.

Microsoft Office 365: US issues security alert over rushed remote deployments (ZDNet) CISA is concerned hasty deployments of Office 365 and Teams may lead to missed key security configurations.

US govt updates Microsoft Office 365 security best practices (BleepingComputer) The Cybersecurity and Infrastructure Security Agency (CISA) today issued an update to its Microsoft Office 365 security best practices as part of an alert distributed via the US National Cyber Awareness System.

The Department of Defense Should Not Wage Cyber War Against Criminal Hackers During the Coronavirus Crisis (Council on Foreign Relations) Some have called for the Department of Defense to "defend forward" against cybercrime that exploits the coronavirus pandemic. However, doing so would strain the department's already limited resources and put democratic values at risk.

Ensuring Safe Elections (Brennan Center for Justice) Federal Funding Needs for State and Local Governments During the Pandemic

Pentagon Wary Of Adversaries Buying Defense Firms Amid Economic Crisis (Breaking Defense) DoD officials are working with Congress to come up with new ways to keep foreign governments out of the US military industrial base.

Analysts: U.S., China should tread carefully in case of North Korea collapse (UPI) China plays an outsize role in North Korea's economy, but its clout in the region doesn't mean Beijing can easily intervene in the event of North Korea instability, U.S. analysts say.

China wasn’t wild about Mike Pompeo before the virus. It’s really gunning for him now. (Washington Post) Beijing has unleashed a wave of vitriol against Pompeo over unsupported claims that the virus could have leaked from a Wuhan lab.

China Issued the Measures for Cybersecurity Review (The National Law Review) The Cyberspace Administration of China (&ldquo;CAC&rdquo;), together with 11 other authorities, has jointly issued the Measures for Cybersecurity Review (the &ldquo;Measures&rdquo;), which will take e

Washington’s Anti-Huawei Tactics Need a Reboot In Europe (Foreign Policy) Efforts to convince allies of the Chinese threat in 5G have floundered.

Republicans to introduce bill to ban government employees from using Huawei, ZTE products (TheHill) Republican Sens. Ted Cruz (Texas) and Josh Hawley (Mo.) announced their intention on Thursday to introduce a bill that would ban U.S.

()

National Security Surveillance on U.S. Soil Fell Amid Scrutiny of Russia Inquiry (New York Times) But overseas targets of the government’s warrantless surveillance program continued to soar in 2019, a new report disclosed.