GCHQ calls for more UK investment in cybersecurity. US Senate considering information-sharing bill. CISA and NIST offer supply chain security guidance.

Summary

By the CyberWire staff

At a glance.

GCHQ chief calls for more British investment in cybersecurity.
Report: US Senate may soon take up a bill that would make information-sharing mandatory.
CISA and NIST offer guidance on supply chain security (as supply chain security month wraps up).

GCHQ calls for UK investment in cybersecurity.

ComputerWeekly reports that UK Government Communications Headquarters (GCHQ) Director Jeremy Fleming stressed the importance of investing in cyber technologies, standards, labor, and defenses in an address last Friday. Given the growing threats posed by Moscow and Beijing to allied ideals, he said, Britain must regularly remake its strategic advantage to guard values like liberty and security. Fleming supports Her Majesty’s Government’s “whole-of-society” drive to advance security priorities, a plan aimed in part at nurturing cyber markets.

US Senate expects to take up information sharing.

Senate Intelligence Committee Chairman Mark Warner (Democrat of Virginia) said Congress is putting together a bill that could mandate incident reporting and threat intelligence sharing, according to Breaking Defense. As we’ve seen, the private sector is wary of regulation that could jeopardize companies’ reputations, revenue, and legal protections. Mentioning carrots like privacy, anonymity, legal shields, and incentives, Warner expressed a desire for a compulsory “early warning system” in light of the shortcomings of voluntary reporting.

CISA and NIST offer new guidance on software supply chain attacks.

In collaboration with the US National Institute of Standards and Technology (NIST), the Cybersecurity and Infrastructure Security Agency (CISA) published a new resource titled “Defending Against Software Supply Chain Attacks.” SecurityWeek says the document covers the risks of supply chain attacks along with prevention and mitigation measures. Recalling recent hacks involving SolarWinds, CCleaner, MeDoc, Windows 7, Kaspersky Lab tools, and Operation ShadowHammer, SecurityWeek notes that supply chain hackers typically meddle with code signing, open-source code, and updates to accomplish their aims.

CISA and NIST recommend following a Cyber Supply Chain Risk Management (C-SCRM) method to mitigate research, design, development, manufacturing, acquisition, distribution, delivery, deployment, integration, operations, maintenance, destruction, and disposal risks. The resource also advises software vendors to heed software development life cycle (SDLC) and secure software development framework (SSDF) best practices.

Supply Chain Integrity Month wraps up.

NIST and CISA’s resource arrives at the close of National Supply Chain Integrity Month. The collaborative initiative highlighted resilience measures, information and communication technology security, supply chain threats, and supply chain basics.

Selected Reading

Ghostwriter Update: Cyber Espionage Group UNC1151 Likely Conducts Ghostwriter Influence Activity (FireEye) New evidence allows us to assess that UNC1151, a suspected state-sponsored cyber espionage actor, conducts at least some components of Ghostwriter influence activity.

Russian defense chief scoffs at Western warnings on Ukraine (Military Times) Defense Minister Sergei Shoigu said Moscow was closely monitoring the deployment of U.S. troops and weapons in Europe as part of NATO’s Defender Europe 2021 drills.

US SolarWinds Response Unlikely to Change Russia’s Behavior, Highlights Need for Improved Cyber Defense (Russia Matters) The United States has unveiled its overt response to Russia’s SolarWinds cyber operation—the expulsion of 10 Russian Embassy personnel from Washington, along with new sanctions on Russian sovereign debt and on Russian IT firms that support Moscow’s cyber intelligence operations.

GCHQ: Cyber investment a guarantor of UK’s global status (ComputerWeekly) GCHQ director Jeremy Fleming sets out a vision for the UK’s cyber security future.

Technologie – «L’Europe creuse son retard dans le domaine digital» (Tribune de Genève) Ancien directeur R&D chez Bobst, Alexandre Pauchard a repris en janvier les rênes du CSEM, à Neuchâtel. Il livre son constat sur certains enjeux importants liés à la recherche et l’industrie.

Analysis | The Cybersecurity 202: Lawmakers want to create a reserve corps of cybersecurity experts to respond to the next SolarWinds (Washington Post) The reserve would provide backup talent to the Department of Defense and Department of Homeland Security.

Portman, Peters Debut Bill to Create $20M Cyber Incident Response Fund (Meritalk) Sens. Rob Portman, R-Ohio, and Gary Peters, D-Mich., introduced the Cyber Response and Recovery Act, which would authorize $20 million of spending to support Federal and non-Federal entities impacted by major cyber events, according to an April 23 press release.

‘Mandatory’ Cyber Info Sharing Bill Coming, Says Senate Intel Chair Warner (Breaking Defense) "My hope is that we can create this structure... to get an early warning system," the Senate Intel Committee chair said. "Voluntary sharing is no longer effective."

Senator Pitches Hack Reporting Requirements to Business Group (Wall Street Journal) Sen. Mark Warner said he is crafting legislation that would compel federal contractors and other businesses seen as critical to national security to share information about ongoing threats with federal officials.

Lawmakers start a push for new breach notification rules after SolarWinds attack (The Record by Recorded Future) “There was a ‘holy heck’ moment with SolarWinds,” Sen. Mark Warner told members of the U.S. Chamber of Commerce on Tuesday.

House Solarium Commission Members Press for More CISA Funding (Nextgov) “Congress was right to give the agency new authorities that allow it to better defend our interests in cyberspace, but without requisite funding, we’re setting CISA up for failure," the lawmakers wrote.

U.S. FCC commissioner urges tougher steps on China's Huawei, ZTE (ETTelecom.com) The FCC last year adopted rules requiring U.S. telecom carriers to remove and replace equipment produced by Huawei or ZTE if purchased using an $8.3 b..

FCC explores ‘additional consequences’ for banned IT vendors to secure supply chains (Federal News Network) The Federal Communications Commission is taking further steps to prohibit blacklisted Chinese IT vendors from doing business with U.S. telecommunications providers.

FCC Might Extend Security Crackdowns To Consumer Devices (Law360) The Federal Communications Commission's acting chairwoman is mulling whether to make foreign-made electronic devices ineligible for U.S. certification and sales if they pose security risks to end users, while FCC Republicans say they'd be on board with the plan.

FBI shares 4 million email addresses used by Emotet with Have I Been Pwned (BleepingComputer) Millions of email addresses collected by Emotet botnet for malware distribution campaigns have been shared by the Federal Bureau of Investigation (FBI) as part of the agency's effort to clean infected computers.

European police hope Google ads will steer teenagers away from a life of hacking (CyberScoop) In a series of new programs launching this year, European authorities are working to intervene with teen hackers before they break the law.

CPJ joins letter urging NSO to act on commitments to curb spyware abuse (Committee to Protect Journalists) The Committee to Protect Journalists and seven other civil society groups today co-signed an open letter asking the Israel-based NSO Group company to deliver on its commitments to improve transparency about sales of its advanced spyware, and due diligence to protect human rights. Research by CPJ and other organizations indicates that the company’s Pegasus product...