FISMA revisions considered. Anti-ransomware best practices. The 5G attack surface.

Summary

By the CyberWire staff

At a glance.

US Senate committee considers FISMA revisions to facilitate information sharing.
Anti-ransomware best practices.
The 5G attack surface.

Senators consider FISMA changes to facilitate incident information-sharing.

MeriTalk reports concerns from the US Senate Homeland Security and Governmental Affairs Committee that the Federal Information Security Modernization Act (FISMA) may need tweaking to ensure prompt and thorough disclosures of significant cyberattacks to Congress. Committee members expressed alarm in a hearing yesterday that the Department of Health and Human Services didn’t report the Holiday Bear breach as a “major incident,” and that other agencies report attacks on a delay or with inadequate detail. Congress may need to update FISMA to remove “ambiguity” about Federal civilian agencies’ notification requirements, lawmakers warned. Senator Portman (Republican of Ohio) said he’d also like to see a “single point of accountability” for Federal cybersecurity.

CISA shares best practices for avoiding a devastating ransomware attack.

In the wake of the Colonial Pipeline ransomware attack, a Cybersecurity and Infrastructure Security Agency (CISA) alert describes best practices for critical infrastructure operators hoping to avoid a similar occurrence:

“Require multi-factor authentication”
“Enable strong spam filters to prevent phishing emails from reaching end users”
“Implement a user training program and simulated attacks for spearphishing”
“Filter network traffic”
“Update software”
“Limit access to resources over networks, especially by restricting RDP”
“Set antivirus/antimalware programs to conduct regular scans”
“Implement unauthorized execution prevention”
“Implement and ensure robust network segmentation between IT and OT networks”
“Organize OT assets into logical zones”
“Identify OT and IT network inter-dependencies and develop workarounds or manual controls”
“Regularly test manual controls”
“Implement regular data backup procedures”
“Ensure user and process accounts are limited”

The alert concludes with a link to CISA’s free “hygiene services” and a reminder that the FBI and CISA discourage ransomware payment.

NSA outlines 5G vulnerabilities.

The NSA this week announced the publication of an analysis paper titled “Potential Threat Vectors to 5G Infrastructure.” The Office of the Director of National Intelligence and CISA collaborated with the NSA and industry experts to evaluate 5G risks, threats, and vulnerabilities, with a particular focus on systems architecture, standards, and the supply chain.

C4ISRNET highlights the threat posed by adversarial influence over standards-setting processes. China is the elephant in the room when the report refers to “the competitive balance within the 5G market” and “the availability of trusted suppliers.” Beijing has been known to inundate regulatory bodies with “mass amounts of proposed technical standards” with the aim of blocking rival technology.

For an idea of the stakes involved in the issue, consider that the Pentagon is currently testing 5G warehouse and radar applications.

Selected Reading

CYBERSECURITY: Pipeline hackers wear a 'bull's‑eye.' Will Biden act? (E&E News) The hackers who shut down half the fuel supplies to the U.S. East Coast said they just wanted "to make money."

How cyberattack on major US pipeline has become a diplomatic issue between US and Russia (ThePrint) Shutdown of largest US gasoline pipeline underscores how vulnerable the country’s cyber infra is to criminals & national adversaries like Russia, China and Iran, say experts.

Colonial Pipeline attack underscores US energy's vulnerability (TheHill) The ransomware attack on Colonial Pipeline, the largest supplier of oil to the Northeast region of the United States, is underscoring just how vulnerable critical U.S.

All the tech within the 2021 Australian Budget (ZDNet) Here's a summary of the Australian government's digital economy strategy, as well as the rest of the tech-related investments made as part of the 2021-22 federal Budget.

China Threatens Retaliation Against Ericsson if Sweden Doesn’t Drop Huawei 5G Ban (Wall Street Journal) Beijing is giving Sweden one last chance to reverse its ban on telecommunications-equipment giant Huawei before it could retaliate against rival Ericsson.

U.S. Agrees to Remove Xiaomi From Blacklist After Lawsuit (Bloomberg) U.S. to vacate order designating company as military-linked. Xiaomi had sued U.S. government following the Trump order.

The Colonial Pipeline ransomware attack and the SolarWinds hack were all but inevitable – why national cyber defense is a ‘wicked’ problem (GCN) Recognizing that hackers in the service of foreign adversaries are dedicated, thorough and not constrained by any rules is important for anticipating their next moves and reinforcing and improving U.S. national cyber defenses.

Senators Want FISMA Changes on Cyberattack Reporting (Meritalk) The chairman and ranking member of the Senate Homeland Security and Governmental Affairs Committee said today they are interested in changing the Federal Information Security Management Act (FISMA) to make sure that Congress gets timely notifications about major cyberattacks that have a national impact.

Senators discuss federal cybersecurity following SolarWinds hack (KHON2) A ransomware attack and shutdown of the largest fuel pipeline in the U.S. has led to panic at the pump over fears of shortages and gas price increases.

CISA's Wales backs new response, recovery fund (FCW) Brandon Wales, acting director of the Cybersecurity and Infrastructure Security Agency, said the funding would go toward expanding CISA's incident response teams with additional contractors and developing new technologies to be used by those teams.

SolarWinds Opened the Door for Cybersecurity Culture Overhaul at DHS (Government CIO) DHS and CISA want to lead the federal register and private industry by example.

Congress mulls $500 million in grants to help states upgrade cybersecurity (Roll Call) The money would help state and local governments, under frequent attack, upgrade their equipment and cybersecurity.

Gov't May Lean On Private Sector To Stop Next Critical Hack (Law360) Convincing private businesses to open up to the government about cybercrime could be key in preventing future hacks of U.S. critical infrastructure, a risk underscored by a ransomware attack that has shuttered one of the nation's largest fuel pipelines.

FTC To Lean On State AGs After High Court Ruling, Head Says (Law360) The Federal Trade Commission is planning to partner "more frequently and more enthusiastically" with state attorneys general to press consumer protection and privacy enforcement actions in the wake of a recent U.S. Supreme Court ruling that slashed the FTC's ability to pursue monetary relief from lawbreakers, the agency's acting chair said Tuesday.

Space Force Looks to Boost Cyber Defenses of Satellites with Acquisition Reorganization (Air Force Magazine) The restructuring of Space Force acquisition authorities is designed in part to ensure proper cybersecurity testing and monitoring of new programs.