At a glance.
- US House bill aims to improve small business cybersecurity.
- US State Department announces reward for information about leaders of the DarkSide ransomware gang.
- US Justice Department discusses its ongoing crackdown on cybercrime.
- BOD 22-01 will put pressure on legacy Federal computer systems.
House bill concentrates on the cybersecurity needs of small businesses.
This week the US House of Representatives passed two bills focused on improving the cybersecurity of small businesses, Security Week reports. The Small Business Administration (SBA) Cyber Awareness Act will require small businesses to regularly report to Congress about any incidents, the status of their cybersecurity infrastructure, any improvement plans, and notably, the use of any Chinese-manufactured equipment. Representative Young Kim (Republican, California 39th), who introduced the bill, explains that by increasing transparency, the bill can help the SBA better support small businesses recover from the pandemic, which exacerbated the businesses’ struggles. “We must address this issue now and secure our systems so small business owners can safely utilize SBA’s resources as they work to recover from the pandemic, hire workers and adjust to rising costs of supplies,” she explained. In keeping with this, the Small Business Development Center Cyber Training Act aims to empower small businesses to fight cyberthreats by authorizing the SBA to reimburse Small Business Development Centers (SBDCs) for employee certification costs up to $350,000 a year. “If we aren’t protecting our small businesses, then we’re not protecting our economy,” explained Representative Chrissy Houlahan (Democrat, Pennsylvania 6th), one of the bill’s proponents.
Wanted: members of the DarkSide ransomware group.
Security Week reports that the US Department of State is offering a $10 million bounty for information on members of the DarkSide threat group, the gang behind this year’s crippling ransomware attack on the Colonial Pipeline. To sweeten the pot, there’s also an award of up to $5 million for info that leads to the arrest or conviction “of any individual conspiring to participate in or attempting to participate in a DarkSide variant ransomware incident.” The rewards, offered under the Department of State’s Transnational Organized Crime Rewards Program, underline the US’s focus on being more aggressive when it comes to preventing attacks on US critical infrastructure and come on the heels of a law enforcement operation against the REvil ransomware group carried out by a foreign partner of the US that resulted in the successful seizure of the hackers’ servers.
US Justice Department cracks down on cybercrime.
AP News spoke with US Deputy Attorney General Lisa Monaco about the Justice Department’s heightened efforts to stomp out ransomware and other cyberattacks through a very straightforward method of enforcement: arrests. Monaco threatened, “If you come for us, we’re going to come for you,” but she didn’t go into detail about who might be prosecuted. The US has stepped up its war on cybercrime in recent months, notably extraditing a suspected Russian hacker to the US and seizing $2.3 million in cryptocurrency paid to cybercriminals, and Monaco’s announcement underlines these efforts: “We’re going to continue to press forward to hold accountable those who seek to go after our industries, to hold our data hostage and threaten national security, economic security and personal security.”
On a more optimistic note, during a House Homeland Security Committee hearing this week National Cyber Director Chris Inglis stated the US has seen a “discernible decrease” in Russian attacks, the Hill reports. “It’s too soon to tell whether that is because of the material efforts undertaken by the Russians or the Russian leadership,” Inglis stated, explaining that threat actors might simply be laying low because it’s clear the US is on the hunt. But, he said, if that’s the case, the government must maintain its efforts.
Ancient computer equipment plagues the US executive branch.
The Wall Street Journal unpacks the ramifications of a White House directive issued this week aimed at tackling the US executive-branch agencies’ plague of outdated computer systems, left in place due to budgetary constraints and worsened by years of neglect. The directive lists nearly three hundred security flaws identified by cybersecurity experts as carrying “significant risk to the federal enterprise,” and while many are new issues, some have been known vulnerabilities for years. The Government Accountability Office estimates that, on average, federal government software is about seven years old, with an approximately 50-year-old Education Department student loan system being one of the oldest. Daniel Castro, vice president of the think tank Information Technology and Innovation Foundation, commented, “It’s a bit shocking that this is even a directive. It’s literally telling the federal government’s cybersecurity staff that they should patch IT systems with known vulnerabilities. Of course they should.” Agencies have until November 17th to address the most serious flaws, and until May 2022 for the less severe issues.