NIST resilience guidelines. US sanctions on Belarus? Cyber deterrence. Updates on the NSO scandals.

Summary

By the CyberWire staff

At a glance.

NIST resilience guidelines out for comment.
US preparing sanctions on Belarus?
Perspectives on cyber deterrence.
Updates on the NSO scandals.

NIST solicits comments on updated guidance for cyber resilience.

The National Institute of Standards and Technology (NIST) announced a call for comments, open through September 20, on a draft of Special Publication 800-160 Volume 2, Revision 1, “Developing Cyber-Resilient Systems: A Systems Security Engineering Approach.” The update “turns the traditional perimeter defense strategy on its head” by focusing on internal defense.

US readies Belarus sanctions.

US President Biden is preparing an Executive Order on and additional sanctions for Belarus, CNN reports, with potential cybersecurity ramifications. Belarus President Alexander Lukashenko has been under US sanction for fifteen years. US Ambassador to Belarus Julie Fisher said Washington remains concerned about “promoting accountability for those individuals and entities who are responsible for, or are complicit in the regime’s violent repression of civil society.” Belarusian opposition leader Sviatlana Tsikhanouskaya presented the Administration with a catalog of possible targets, businesses controlled by President Lukashenko and pals.

An industry perspective: defense is inadequate; look to deterrence.

A piece published by Yahoo outlines a three-pronged strategy for deterring ransomware attacks: hold companies liable for negligent cybersecurity, stage proportional counterattacks against gangs and their benefactors, and block hackers’ access to crypto profits. The authors don’t think much of sanctions, indictments, and privateering proposals.

Mandiant VP Ron Bushar also wants to prioritize deterrence, according to Breaking Defense. He’s not thrilled with the progress from existing defensive, diplomatic, and naming and shaming efforts. Accurate attribution, he said, will unlock the next steps in deterrence, though Washington will need to stay wary of escalation and revealing capacities.

Further developments in the NSO scandal.

The Hindustan Times says India’s Government is attempting to block a question raised in Parliament about Pegasus, using discretionary procedural rules that can bar inquiries pertaining to subjects under adjudication. The question sought details about the Government’s interactions with NSO Group and similar organizations. New Delhi has yet to confirm any relationship with NSO, but has denied performing “illegal surveillance.” The Hindu relates concerns from retired Indian law enforcement personnel about historical Government abuses of hacking and surveillance tools. ORF calls for an independent inquiry and updated data protection legislation.

The Jerusalem Post downplays Project Pegasus revelations, pointing to past reports of US-led spying, and noting lingering questions about the sourcing and meaning of the list of 50 thousand phone numbers. The Post posits the most likely sources of the list as Qatar, Iran, Palestinian activists, or a rival firm like Google or Microsoft. WhatsApp comes in for special attention, given its ongoing lawsuit against the company, and resultant uniquely detailed knowledge of NSO operations.

While acknowledging that Project Pegasus “broke the most damaging information yet to come to light” on NSO, the Post concludes that “there is almost nothing concrete to grab on to,” and the revelations merely fill out knowledge that NSO clients occasionally misuse Pegasus. The piece does recount skepticism about NSO’s claimed total ignorance of clients’ targets and actions and inability to target Americans’ phones, and repeats reports that the firm terminated Saudi and UAE contracts as a consequence of the scandal.

Amid some investor turmoil, NSO seems to have retained the support of Israel’s Defense Ministry, and now faces the “big question” of whether Jerusalem’s diplomatic strategy will pivot away from spyware as a pot-sweetener.

The Times of Israel says warnings about potential human rights abuses stemming from cyber exports were circulating the Defense Ministry in 2020; the Ministry denies the report.

Selected Reading

SP 800-160 Vol. 2 Rev. 1 (Draft), Developing Cyber-Resilient Systems: SSE Approach | CSRC (NIST Computer Security Resource Center) Cyber attacks are a reality. Sometimes even with the best protective measures in place, adversaries can breach perimeter defenses and find their way into systems.

Cybersecurity Is the New ‘Great Game’ (SDxCentral) Building a broad-based national cyber-defense plan took the center stage at this week’s Black Hat cybersecurity event.

Govt moves to disallow MP's question on Pegasus in Parliament (Hindustan Times) CPI MP Binoy Viswam says the government is misusing Rajya Sabha rules and taking an alien stand on truth

Pegasus attack has serious implications for rule of law, say senior retired police officers (The Hindu) Julio Ribeiro, Vikash Narain Rai, S.R. Darapuri voice concern on the impact of surveillance and planting of evidence

What does the NSO hacking scandal mean for Israel's cyber diplomacy? (The Jerusalem Post) SECURITY AFFAIRS: The 50,000-cellphones list itself never made any sense, considering that each client is usually limited to a dozen or a few dozen targets and NSO has just 60 clients.

Ex-ombudsman said to highlight human rights concerns about NSO Group last year (Times of Israel) Report says Yosef Shapira was among a group of former officials who warned the Defense Ministry that without greater oversight of cyber firms, 'this will blow up in Israel's face'

Pegasus in the Room: Law of surveillance and national security’s alibi (ORF) “Surveillance is not new, but technology has permitted surveillance in ways that are unimaginable,” noted Justice Sanjay Kishan Kaul

Iran ‘working systematically to build serious cyber-attack capabilities’ (Cleveland Jewish News) Revelations about malign plans by Tehran’s leaders serve as the latest confirmation of how seriously the Islamic Republic takes cyber warfare, said Professor Col. (res.) Gabi Siboni, an expert on

Imperatives of a safer cyberspace for Nigeria (Nation) The changing wind of global socio-economic atmosphere has brought with it the inevitability of transfer of most of human activities unto virtual networks – the internet and its technological accompaniments.

Biden administration expected to unveil new Belarus sanctions (CNN) The Biden administration is expected to unveil new Belarus sanctions and a new executive order amid continued crackdowns by the regime of strongman leader Alexander Lukashenko.

Mandiant CTO: Cyber Attribution, Deterrence More Vital Than Defense (Breaking Defense) "We're on the defense," Ron Bushar, senior vice president at Mandiant says. "I don't think we've hit a real deterrence level in this space yet. And that's going to be key to thinking through our strategy over the next few years."

Second Opinion: How the U.S. can deter ransomware attacks (Yahoo) To discourage cyber hackers, the U.S. must make it harder for them to profit — and signal that the country is ready and willing to retaliate.

PM appoints cybersecurity expert to lead vaccine certification (iPolitics) The federal government took another step on Friday toward vaccine certification for Canadians wishing to travel outside the country when restrictions ease. In addition to a negative polymerase chain reaction (PCR) test — the PCR test is considered the “gold standard” for detecting active COVID-19 infections — before departure, many countries also require proof of […]

Black Hat: This is how a naive NSA staffer helped build an offensive UAE security branch (ZDNet) If that job offer looks too good to be true, something else may be afoot.

Deepfake Task Force: The danger of disinformation needs a new collaboration (TheHill) An empowered consumer base could identify disinformation based on the characteristics of the content before it spreads.

SLGs, Utilities Win Big Cyber Funding in Infrastructure Bill (MeriTalk) The much-anticipated $1 trillion Senate bipartisan infrastructure bill unveiled on August 1 shows big cybersecurity funding wins for state and local governments with a $1 billion for a cybersecurity grant program, and electric utilities that will be receiving $1.25 billion through a cybersecurity grant program to protect the electric grid.

How cryptocurrency became a powerful force in Washington (Washington Post) The infrastructure bill is in part stalled as negotiations proceed on how closely to regulate the crypto industry

Gov. Little forms cybersecurity task force (Idaho State Journal) Idaho is forming a cybersecurity task force to combat the ever-growing threat of cyberattacks to public and private sectors in the state.