Privateering in cyberspace. Should law and regulation prohibit paying ransomware gangs? FTC and data security.

Summary

By the CyberWire staff

At a glance.

Pirates and privateers, and how to fight them.
Rising sentiment in favor of restrictions on paying ransom demanded by online cybercriminals.
US Federal Trade Commission claims an active role in data security.

Two views on combatting cyber pirates and privateers.

TribLIVE says what’s old is new again in the realm of international conflict, comparing roving cyber marauders like DarkSide, who navigate dark web “backwaters” and the open seas of consumer services “with a wink and a nod from Vladimir Putin,” to the pirates of yore. Just like their early modern counterparts, cyber pirates compact with ruling parties and craft codes of conduct. The “great cyberfaring nation[s]” on the receiving end of their antics could, like those in the 16th century who’d had enough with brigands, issue “letters of marque and reprisal” authorizing private parties to engage on behalf of the state. In 2021, these parties would more closely resemble tech firms than shipowners.

Bloomberg casts DarkSide members as more privateers than pirates, given Russian cyber gangs’ tight ties to the Kremlin. (A privateer, Britannica reminds us, is a “pirate with papers.”) Bloomberg’s solution to President Putin’s ongoing strategy of weaponizing cyber piracy against rival nations is fourfold (and tack four aside, familiar): engage allies, name and sanction the perpetrators, let the NSA and CyberCom loose on hackers’ assets and capabilities, and impose proportionate consequences on states that provide “safe harbor.”

Sentiment grows in favor of restricting ransomware payment.

The Times reports UK National Cyber Security Centre (NCSC) founding executive Ciaran Martin’s comments that handling hackers like terrorists and outlawing ransomware payments would cut the industry off at its knees. “We have allowed this to spiral in an invisible way,” he observed.

FTC blogs that it expects boards to take an active role in data security.

Cooley summarizes five tips from a US Federal Trade Commission (FTC) blog underscoring board members’ responsibility for corporate cybersecurity:

Prioritize data security.
Know your firm’s weak spots.
Understand that compliance doesn’t guarantee security.
Plan for failure.
Adapt in response to errors—yours and others’.

The FTC has in the past cracked down on deceptive or inadequate security policies that neglected, for example, network monitoring, penetration testing, documentation, or workforce training.

Selected Reading

Russia Gives Safe Harbor to Pirates of the Cyber Seas (Bloomberg) Putin seems to have revived the 16th-century “letter of marque” that England used against the Spanish Empire.

'Twisted': Russia brands US an 'unfriendly' country (Washington Examiner) Russian President Vladimir Putin’s government has branded the United States an “unfriendly” nation, putting a new legal stamp on tensions with Washington in advance of high-level meetings with President Joe Biden’s administration.

Deterrence method for piracy might also discourage cyberattacks (TribLIVE.com) The Colonial Pipeline, which provides roughly 45% of the East Coast’s oil, gas and jet fuel, was hacked last week by a group called DarkSide. The cyberattack forced the pipeline owners to shut down operations, leading to long gas lines in many American cities. The incident has sparked a long-overdue

Ban ransom payments to hackers, urges ex-GCHQ boss (Times) Britain’s former cybersecurity chief has called for a ban on ransomware payments after the Irish health service became the latest to be hit by a major attack from international criminals.Ciaran Martin

Biden revokes Trump's social media executive order (Protocol) "They picked this [order] off the shelf and essentially rammed it through," a former White House official said at the time.

Addressing SolarWinds Through Executive Action: A Welcomed And Critical Advancement (Forbes) While the EO will not solve all of our security problems or prevent the next SolarWinds attack – and the truth is no single policy, government initiative, or technology will – it is a great start.

Biden Says Greater Private-Sector Investment In Cybersecurity Is Needed (Forbes) In remarks at the White House, President Joe Biden said, “private entities are in charge of their own cybersecurity...and we know what they need. They need greater private-sector investment in cybersecurity.”

The Executive Order on Cybersecurity does not adequately protect critical infrastructures – real cases prove it (Control Global) President Biden issued the Executive Order (EO) on Improving the Nation’s Cybersecurity. I am happy that cybersecurity is recognized at the Presidential level. However, I am disappointed the EO did not address the unique issues associated with control systems.

A federal government left ‘completely blind’ on cyberattacks looks to force reporting (POLITICO) A bipartisan group of lawmakers wants to make sure the government is never left in the dark about serious hacks again.

Learning from cyberattacks could be the key to stopping them (ZDNet) Anne Neuberger, deputy national security advisor for cyber and emerging technology at the White House, says recent events demonstrate the need to focus on preventing incidents.

Tech Sector Likes Cyber Order’s Enterprise-Wide View, Cloud Push (Meritalk) Tech-sector reaction to the White House’s sweeping cybersecurity executive order issued May 12 came in largely positive today, with security technology makers particularly applauding the urgency of the administration’s plans, the enterprise-wide view that the order takes for improving security, and its actions to hasten the movement of Federal agencies to cloud services.

Biden's Cybersecurity Order Likely To Reach Beyond Gov't (Law360) The Biden administration has taken a major step toward curtailing a growing scourge of cyberattacks with a new executive order that not only imposes heightened cybersecurity requirements on the federal government and its contractors but also sets a strong example that's likely to rub off on private companies.

Cyber Response Bill Advances in Senate (Nextgov.com) The legislation includes a fund to help impacted organizations pay for remediation efforts.

FTC Expects Board-Level Cybersecurity Oversight (cyber/data/privacy insights) Federal Trade Commission (FTC) staff published a blog post that highlights increased cybersecurity threats and emphasizes the key role corporate boards play in a successful cybersecurity program: “Corporate boards: don’t underestimate your role in data security oversight.” Boards that are not active

Cyber Deterrence, Workforce Questions Dominate at House Cyber Hearing (Meritalk) With the Colonial Pipeline ransomware attack adding to the count of high-profile cyberattacks to make news in the past six months, members of Congress focused in on how the United States can deter such attacks, as well as how to attract talent to the cyber workforce, at a May 14 House Armed Services subcommittee hearing.

Watch live: NSA director testifies on cybersecurity (TheHill) National Security Agency Director Gen. Paul Nakasone will testify on Friday morning before the House Armed Services Committee regarding cybersecurity across the defense department.The hearing comes as a major pipeline, Colonial Pipeline, was the target of a cyberattack last week. The attack prompted gasoline shortages in stations across the southeast.The hearing is slated to begin at 11 a.m. ET.Watch the live video above.

Royal Household seeks a cyber security expert to secure networks (teiss) The Royal Household is looking for a cyber security engineer to monitor networks and protect digital systems from hacking attacks.

Govt pro-actively looking for action on WhatsApp privacy rules issue: MeitY official (HT Tech) WhatsApp had set May 15 for its users to accept a change in privacy policy but later scrapped the deadline for users to accept the controversial update.

Will the cyber mission force soon receive more personnel? (C4ISRNET) The head of U.S. Cyber Command hinted that the cyber mission force could soon receive a bump in staffing.

Sen. Hwang Calls For CT Cyber Security Task Force (Hamlethub.com) Sen. Tony Hwang has called for CT Cyber Security Task Force

CMMC board adds new training head, board members (FCW) Melanie Kyle Gingrich will take over training daily operations for the Cybersecurity Maturity Model Certification Accreditation Body as the vice president of training and development.

FTC Picks New Antitrust Top Cop to Battle Facebook, Probe Amazon (The Information) A little-known criminal antitrust prosecutor at the U.S. Department of Justice, Eyitayo St. Matthew-Daniel, is expected to be named the top antitrust enforcer at the department’s sister agency, the Federal Trade Commission, say three people familiar with the situation. The previously unreported ...