At a glance.
- US Department of Energy awards $15 million to electric cooperatives.
- UK bolsters security amid fears of Chinese and Russian cyber aggression.
- How effective is voluntary cyber incident reporting?
US Department of Energy awards $15 million to electric cooperatives.
National Rural Electric Cooperative Association (NRECA), an American trade association representing electric cooperatives that serve approximately 42 million Americans, has been awarded $15 million in cybersecurity funding from the Department of Energy. The money, Security Week explains, is intended to help the nearly nine hundred electric cooperatives represented by the NRECA to bolster their industrial control systems. Awarded over the next three years, the funds are specifically to be used to help these cooperatives identify and deploy cyber monitoring tech in order to better detect suspicious activity on their systems. Critical infrastructure operators like electricity providers are attractive targets for threat actors. NRECA CEO Jim Matheson stated, “As threats and threat actors evolve, electric cooperatives consistently work to improve their cyber defenses. Funding like this helps co-ops stay ahead of the curve. Our longstanding partnership with DOE makes the electric grid more resilient, reliable and secure.”
UK bolsters security amid fears of Chinese and Russian cyber aggression.
British officials are calling for an independent investigation into the hacking of former Prime Minister Liz Truss’s phone, Fox News reports. The hack, which has been linked to Russian cybercriminals, allegedly occurred over the summer while Truss was running for the PM position, and the probe would also examine allegations that Truss attempted to conceal news of the incident for fear it could damage her campaign. As well, ministerial aides will reportedly be undergoing new security clearance vetting to determine whether they previously worked with public figures linked to "hostile" nations and, therefore, may be unqualified to handle the sensitive info intrinsic to carrying out their jobs.
A cabinet spokesperson said the new screening was just "part of the wider Cabinet Office vetting modernization program of work, which makes greater use of automation and data checks to deliver national security vetting." In March, Lord John McFall, Baron of Alcluith and Speaker of the House of Lords, wrote a letter urging parliament to strengthen its vetting process amidst calls for a Russian-born member of the house to be stripped of his privileges. He wrote, "I would urge the government to look at this, drawing upon the work of those who have already taken extensive evidence on this and proposed sensible reforms. I am always open to engagement with the government on these matters."
How effective is voluntary cyber incident reporting?
Cyber incident reporting has been a major area of focus in recent years, with new US legislation concentrated on setting reporting standards to ensure the government and other connected entities stay readily informed about cyberattacks. An op-ed in The Hill questions whether voluntary cyber incident reporting alone is an adequate mechanism for information sharing. The writer posits that “simply relying on industry to report incidents voluntarily hasn’t been enough. We still lack key data about cyber incidents: What is the overall rate of incidents? How does it differ by sector or region or company size? Can we use knowledge about an incident at one company to prevent something bad from happening to another?”
In the US, Congress earlier this year passed legislation requiring critical infrastructure owners to report substantial cyber incidents, but many operators are pushing back, fearing that sharing such intel could actually put them in harm’s way and even lead to unwanted regulatory enforcement. Furthermore, current reporting has resulted in data gaps that make it difficult to determine whether ransomware activity has increased or remained steady. The Cyber Incident Reporting for Critical Infrastructure Act will hopefully help close this gap by requiring critical infrastructure operators to report significant cyber incidents to the Department of Homeland Security.