More Signal. Less Noise.

V3 | Issue 1 | 1.4.21

NDAA passes, with cyber provisions. Cyberespionage and counterespionage.

Summary

By the CyberWire staff

At a glance.

Congress overrides NDAA veto; cyber provisions feature prominently in the legislation.
Cyberespionage: tactics and goals in the SolarWinds incident.
CISA's guidance on Solorigate response.

NDAA passes, bringing cyber changes.

Last week Congress overrode a presidential veto of the National Defense Authorization Act, a first for the body, as Federal News Network reports. US President Trump had objected to the absence of Section 230 revisions, renaming of military bases, and roadblocks to his goal of returning troops from Berlin and Kabul.

C4ISRNET describes the Act as “a sweeping piece of national cyber legislation with major revisions to government bureaucracy and structure.” As we’ve seen, the NDAA directs the Defense Department to conduct a cyber mission force structure assessment, which will likely result in an increase to the force’s resources. A CyberCom purchasing cap is lifted, and reporting rules surrounding “sensitive military cyber operations” are revised to allow initiatives against non-state actors without Congressional oversight. Hunt forward also apparently received a vote of confidence; the policy will be formalized with standardized roles and metrics.

Moscow’s MO.

The Wall Street Journal says Russia’s cyber operations have grown more sophisticated over the past decade as the country has shifted its attentions from former Soviet states to Western marks. Estonia, Ukraine, and Georgia took early hits in the 2000’s before France, Germany, and the US came under heavy fire. Cyber operations allow espionage and battlespace preparation on a budget, a necessity given that Moscow’s GDP is eclipsed by Rome’s. A Russian military journal published a fun fact at the turn of the decade: just 600 men and $100 million would be needed to achieve “complete destruction” of US (or Russian) “information infrastructures.” US warnings and sanctions have not curbed Russia’s cyber enthusiasm. As one Moscow scholar put it, “The Russian government says, ‘Yes we understand that you don’t like what we are doing, but we don’t really care.’”

US officials are still puzzling out Moscow’s motives for the latest operation, which at last count impacted roughly two-hundred-fifty organizations, according to the New York Times. Solorigate could be a straightforward espionage campaign, an attempt to backdoor critical infrastructure, or an effort to intimidate the next Administration. What is known is that NSA, DHS, and CyberCom intelligence and defenses were insufficient, and Washington failed to establish persuasive deterrents.

Solorigate directives.

In mid-December, the US Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive 21-01, requiring federal agencies to mitigate Solorigate’s threat by disconnecting infected software, resetting credentials, and eliminating persistence mechanisms. At the end of the month, BleepingComputer reported CISA’s supplemental guidance to “update the SolarWinds Orion platform to the latest version” following NSA’s assurance that the update was secure.

Selected Reading

10 Conflicts to Watch in 2021 (Foreign Policy) The world in 2021 will be haunted by the legacies of 2020: an ongoing pandemic, an economic crisis, Donald Trump’s divisive presidency—and new threats emanating…

Are China’s Cyber Espionage and Wolf-Warrior Diplomacy Worrisome for BND and BFV? (Modern Diplomacy) I have been living for quite some time in Germany, and as national security and counter terrorism Analyst, I have observed the socio-economic, political and security developments in the country. In order to get an exact posture of the Germany foreign policy objectives, I joined a couple of leading political parties and even endeavored to […]

India: A Growing Cybersecurity Threat (Dark Reading) Geopolitical tensions and a dramatic rise in offensive and defensive cyber capabilities lead India to join Iran, Russia, China, and North Korea as a top nation-state adversary.

3 Resolutions The Govt Should Make For India’s Cyberspace in 2021 (TheQuint) A genuine respect for data privacy should be on the government’s list of resolutions for 2021.

Turkey reveals its three-year cybersecurity plan (TRT World) The country hopes to defend its citizens from cyberattacks through a set of new measures.

Cyberspace: The new frontier in the Israeli-Iranian battleground (Arab News) There is hardly any respite in the broadening and intensification of the points of friction between Israel and Iran. The battle between these two major Middle Eastern powers is mainly indirect, but has many aspects and is threatening to slide dangerously into situations that could escalate into open hostilities — a situation neither side wants nor can afford.

Russia blacklists German military, intel officers as cyberattack tensions rise (Daily Sabah) Russia on Tuesday expanded its list of German citizens who will be denied entry to the country. The move came in response to the EU's decision to ban Russian citizens accused...

The Russians Have Issued a Wake Up Call (The Cipher Brief) Weeks after a massive cyber breach of U.S. government agencies and private sector companies was publicly announced, there is still not a clear response from the administration on who is responsible and what will be done about it. While the government has yet to officially name the nation-state that is believed to be behind the … Continue reading "The Russians Have Issued a Wake Up Call"

Russia’s global hacking efforts are going to unwind in 2021 (WIRED UK) “Skirmishes in cyberspace will intensify in 2021 with pre-planned ambushes on the side of the attackers”

National security is the defense industrial base’s responsibility too (Defense News) Contractors must embrace an unwavering commitment to implement security controls to effectively defend their IT infrastructures, a cybersecurity expert advises.

The Sunburst hack was massive and devastating – 5 observations from a cybersecurity expert (The Conversation) Cyberwarfare is more like cancer than bombs and bullets. Cybersecurity experts are just beginning to make their diagnosis of the Sunburst hack.

How Can the U.S. Rebuild After Shocking Series of Cyber Breaches (The Cipher Brief) President-Elect Joe Biden’s incoming national security adviser Jake Sullivan told NPR this week that the Defense Department hasn’t granted a meeting to the Biden transition team since Dec. 18. That – Sullivan tells NPR – is complicating the ability of the incoming administration of being read-in on the current administration’s response to what experts are … Continue reading "How Can the U.S. Rebuild After Shocking Series of Cyber Breaches"

Op-ed: What nobody else will say about the new cybersecurity crisis (CNBC) The culprit is said to be Russia, but equal responsibility lies much closer to home.

An 'Act of War?' Avoiding a Dangerous Crisis in Cyberspace (The Moscow Times) Opinion | Unlike in the nuclear sphere, there are no rules governing the increasingly intense rivalry between the U.S. and Russia in the cyber sphere.

Escalation in Cyberspace Raises Risk of Nuclear Attacks, Russia's General Staff Chief Says (Sputnik) The expansion of military confrontation to cyberspace and space increases risks of interference into control systems and use of nuclear weapons...

COMMENTARY: America must respond to cyber-Pearl Harbor attack (Fredericksburg.com) On December 7, 1941, America was attacked at Pearl Harbor. This month, America was hit with a cyberattack which was the virtual version of another Pearl Harbor. We have to

COLUMN: It's an act of espionage,not war (Sun Newspapers) WASHINGTON — One simple way to think about the threat posed by Russian intelligence in its “SolarWinds” hack is that it exposed the vulnerability of the vast store of supposedly

Everybody Spies in Cyberspace. The U.S. Must Plan Accordingly. (The Atlantic) Because all countries engage in espionage, intrusions like Russia’s latest data hack are devilishly hard to deter.  

Concern mounts over government cyber agency's struggle to respond to hack fallout (CNN) With Microsoft acknowledging for the first time this past week that suspected Russian hackers behind a massive government security breach also gained access to its source code, pressure is mounting on US officials and cybersecurity experts to explain how the attackers infiltrated various US computer networks, what they did once inside and the steps that are being taken to mitigate the damage.

SolarWinds: Cyber strategists are back to the drawing board (Hindustan Times) Cyber strategists are now back to the drawing board as even the most meticulously derived variables and equations of cyber power look like unfounded abstractions. It is a moment of reckoning for the neoliberal system which was the very foundation of the Internet.

SolarWinds cyberattack demands U.S. enact a long-overdue deterrent strategy (The Washington Times) The months-long cyberattack on SolarWinds’ Orion software, used by most U.S. government agencies and hundreds of U.S. companies, is the latest proof that our efforts to deter such attacks have failed.

Next-Generation Program Protection: The Next Federal Cybersecurity Challenge (Nextgov) As the government aims to buy more innovative products, we must make critical advancements in program protection.

Brazil looks for legal options to ban China's Huawei from 5G: Sources (ET Telecom) Brazilian President Jair Bolsonaro's government is looking for a legal way to exclude Chinese telecom equipment maker Huawei Technologies Co Ltd from ..

Trump administration declassifies unconfirmed intelligence on China bounties on US forces in Afghanistan: report (TheHill) The Trump administration is declassifying unconfirmed intelligence that indicates China paid nonstate actors in Afghanistan to attack U.S.

()

Intel on China bounties called ‘less' credible than Russia payments (POLITICO) "Very thin" and "rumors" are how one senior official described the intelligence report that Beijing is plotting to kill American troops in Afghanistan.

US investigating unconfirmed intel that China offered bounties on American troops (ABC News) President Donald Trump has been briefed about the uncorroborated intelligence, the official said.

How the U.S. Misread China’s Xi: Hoping for a Globalist, It Got an Autocrat (Wall Street Journal) Early hopes that Xi Jinping would want closer integration with the U.S.-led global order have become one of the biggest strategic miscalculations of the post-Cold War era. The Chinese president has pursued an expansive, hypernationalistic vision of the nation’s future.

Biden calls for modernizing US defenses following massive hack (TheHill) President-elect Joe Biden on Monday stressed the need to modernize U.S.

In a first, Congress overrides Trump veto of NDAA (Federal News Network) In an extraordinary New Year’s Day session, the Republican-controlled Senate easily turned aside Trump’s objections to the $740 billion bill.

House votes to override Trump’s veto of defense bill (Federal News Network) The Democratic-controlled House has voted to override President Donald Trump’s veto of a defense policy bill…

McConnell signals Senate has votes to override Trump's defense veto (TheHill) Senate Majority Leader Mitch McConnell (R-Ky.) is signaling lawmakers have the votes to override President Trump's veto of a mammoth defense policy bill as soon as Wednesday.

Which NDAA cyber provisions have the most impact for DoD? (C4ISRNET) Lawmakers make several changes impacting oversight of DoD cyber operations.

National cyber director role in the spotlight after SolarWinds hack (FedScoop) The compromise of at least seven federal agencies through the SolarWinds hack has technology experts stressing the importance of a national cyber director (NCD) role within the incoming Biden administration. President-elect Joe Biden is expected to appoint the first-ever NCD, a position the National Defense Authorization Act of 2021 will create, after taking office Jan. 20. The role could prove instrumental in …

U.S. helps countries build secure 5G networks (US Embassy in Georgia) Fifth-generation wireless technology is transformative and has the potential to reshape industries. From remote health care to self-driving cars, to critical services such as electrical grids and water systems, 5G has the potential to touch every part of our lives.

Networked security: 5G and supply chains (Observer Research Foundation) While the geopolitical contestation in emerging technologies will continue, the importance of strengthening policies towards network security cannot be ignored.

CFIUS Eyes A Laser Focus On Chinese Players In 2021 (Law360) The Committee on Foreign Investment in the United States is slated to ramp up its emphasis on inbound transactions that involve either Chinese companies or entities with significant ties to China, particularly when those inbound bets feature intellectual property or sensitive technology, even if the new administration's approach is quieter.

Split Up NSA and CYBERCOM (Defense One) And have the signals-intelligence agency report directly to the Director of National Intelligence.

Now is not the right time to split NSA and CYBERCOM (C4ISRNET) Military necessity, not politics, should guide the decision on whether to end the dual-hat arrangement, a cybersecurity researcher argues.

7 Reasons Why Silicon Valley Will Have a Tough Time With the Biden Administration (Foreign Policy) The coziness between Washington and Big Tech is over.

Anti-Facebook agitators see their moment under Biden (POLITICO) Joe Biden has said he’s no fan of Facebook. Now he has an opportunity to show it as he assumes landmark policy and legal battles against the company.

Can regulation solve businesses' IoT security woes? (Computing) IoT manufacturers are waking up to the fact that they have responsibilities - even if it hurts their bottom line

Brexit: Good News Regarding Transfers of Personal Data from the EEA to the UK (cyber/data/privacy insights) What has happened? The draft UK-EU post-Brexit Trade Deal provides that transfers of data to the UK from EU Member States will not be treated as “restricted transfers” to a non-EU country for a period of up to six months from January 1, 2021.This will also apply to transfers to the UK from EEA Me

Global Privacy Roundup: The World Beyond Europe and California (cyber/data/privacy insights) Since Europe’s General Data Protection Regulation took effect in May 2018, a growing number of legislatures around the world have introduced comprehensive data protection laws that emulate the GDPR or have updated existing laws to align with it. California became the first major non-European economy

Understanding Canadian Cybersecurity Laws: Measuring Up — Outlining Existing National Cybersecurity Legislation in Canada, the UK, Australia, and the US (Article 8) (IT World Canada) In this article, we will outline the relevant national privacy and cybersecurity-related laws currently in effect in the United Kingdom, Australia, and the United States, as fellow common law countries.

The year we gave up on privacy (Vox) Our lives moved online in 2020. Too bad privacy laws didn’t.

12 new state privacy and security laws explained: Is your business ready? (CSO Online) States from Maine to California have recently enacted privacy, data security, cybersecurity, and data breach notification laws. Let's break down what each of these laws entails and how businesses and consumers are affected.

New York Issues First-In-Nation Moratorium On Facial Recognition In Schools (Forbes) The state will conduct a study into whether facial recognition is appropriate in schools.

Local governments needn’t face ransomware streak alone, experts say (StateScoop) The Christmas ransomware attack against the small town of Cornelia, Georgia, marks just the latest incident in a trend experts said they expect to become worse still in 2021.