Conti attacks lead Costa Rican President to declare state of emergency. US election security team reconvenes for midterms. SHIELDS UP, explained. Spanish government replaces CNI director over surveillance scandal.

Announcement

The CyberWire launches CISA Cybersecurity Alerts.

We are very pleased to announce the launch of our new service, CISA Cybersecurity Alerts, a first-of-its-kind audio feed for urgent cybersecurity advisories from the US Government. The CISA Cybersecurity Alerts podcast is a public service to the community, funded by the CyberWire and entirely ad-free. You can find these alerts wherever you get your podcasts and in the CyberWire Daily podcast feed. We invite everyone to publish these alerts through their own feeds, podcasts, or websites. Contact the CyberWire team to publish the CISA Cybersecurity Alerts and subscribe today in your favorite podcast app. Read more in the press release.

Summary

By the CyberWire staff

At a glance.

Conti attacks lead Costa Rican President to declare state of emergency.
US election security team reconvenes for midterms.
SHIELDS UP, explained.
Spanish government replaces CNI director over surveillance scandal.

Conti attacks lead Costa Rican President to declare state of emergency.

The government of Costa Rica has declared a state of national emergency as a result of Conti ransomware attacks that targeted several government bodies last month. Newly elected President Rodrigo Chaves stated on Sunday, "The attack that Costa Rica is suffering from cybercriminals, cyberterrorists is declared a national emergency and we are signing this decree, precisely, to declare a state of national emergency in the entire public sector of the Costa Rican State and allow our society to respond to these attacks as criminal acts.” Bleeping Computer notes that as of yesterday, Conti claims to have leaked 97% of the 672 GB of data allegedly stolen from Costa Rican government bodies. The Treasury Department’s digital services have been down since April 18, disrupting government procedures that impact the country’s entire production sector. The Administrative Board of the Electrical Service of the province of Cartago, the Ministry of Science, Innovation, Technology, and Telecommunications, the National Meteorological Institute, Radiographic Costarricense (Racsa), and the Costa Rican Social Security Fund are among the other impacted government entities. Conti previously requested a $10 million ransom, which the government reportedly refused to pay, and Conti threat actor "UNC1756" has threatened the government with future attacks of "a more serious form."

US election security team reconvenes for midterms.

Amidst concerns that foreign influences (in other words, Russia) could attempt to meddle with the upcoming midterm elections, the US has reassembled its election security team, Data Center Knowledge reports. “We’re less than 200 days before our nation goes to vote for midterm elections, and I assure you that we are ready and we will be ready going forward,” General Paul Nakasone, who leads the National Security Agency (NSA) and U.S. Cyber Command (CYBERCOM), said at a recent summit on modern conflict. The team, which was first convened to defend the 2018 midterms from Russian meddling, is composed of military and civil personnel from NSA and CYBERCOM, who will collaborate with the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency (CISA), and National Guard. They will be jointly led by Brigadier General Victor Macias and NSA senior executive Anna Horrigan. Major General William J. Hartman, who leads the national cyber mission force responsible for defending against foreign threats, said US sanctions against Russia for the war in Ukraine will likely lead Russia to retaliate by attempting to influence the elections. “I expect that there will be a fair amount of domestically generated information that the Russians will freely amplify,” General Hartman stated.

SHIELDS UP, explained.

The Hacker News offers a breakdown of SHIELDS UP, CISA’s guidance to US organizations on protecting their systems in the midst of increased cyberagression from Russia as a result of the war in Ukraine. With more than twenty instructions in total, SHIELDS UP might appear to be a lot to digest, but many of the recommendations, like limiting user privileges and patching known vulnerabilities, are common sense practices that most organizations should already have in place. For organizations who have discovered gaps in their security protocols, it is recommended that they collaborate with an external security partner. Live, automated patching tools can also go a long way in ensuring that organizations stay current on any security updates.

In the midst of surveillance scandal, Spanish government replaces CNI director.

Following the discovery that Pegasus spyware was placed on the phones of Spanish politicians and activists, including the Prime Minister and many Catalan separatists, the Washington Post reports that Spain has fired the director of National Intelligence Center (CNI), Paz Esteban. As the country’s top intelligence agency, CNI has been under fire for its role in the surveillance of the separatists and for taking a year to discover the hacking of the government officials’ devices. Defense Minister Margarita Robles, whose phone was also found to be infected by Pegasus, announced Esteban’s dismissal. “That (the hacks of government phones) took a year to discover, well, it is clear there are things that we need to improve,” Robles stated. Esteban will be replaced by Esperanza Casteleiro, a 40-year veteran at the agency who has served as secretary of defense since 2020. Popular Party President Alberto Nuñez Feijóo, the leader of Spain’s opposition conservatives, said he is less than pleased with Esteban’s removal, feeling that she was sacrificed to appease the separatist movement. “It is a monstrosity that Sánchez offers the head of the CNI director to the separatists, once again weakening the state to assure his survival,” Feijóo tweeted.

Selected Reading

SHIELDS UP in bite sized chunks (The Hacker News) The Cybersecurity and Infrastructure Security Agency (CISA) provides guidance to US federal agencies in their fight against cybercrime.

What Is The CCPA? Here’s How To Comply (Forbes Advisor) The CCPA is a privacy law enacted in 2018 by the state of California to regulate the way businesses all over the world can collect, use and share the personal information of California residents. Irrespective of where you are located or operate, if you have consumers in California, you must know abo

Here are Federal Agencies' Steps to IOT Adoption (Government CIO) Connected capabilities can improve mission activities, but requires the right infrastructure, security and governance.

How the Colonial pipeline hack galvanized a nation at risk (E&E News) The attack on the 5,500-mile pipeline that shut down gasoline shipments to the East Coast a year ago was a turning point for U.S. cybersecurity policy.

Regulator Proposes $1 Million Fine for Colonial Pipeline One Year After Cyberattack (SecurityWeek) One year after the ransomware attack, the US Department of Transportation has proposed a fine of nearly $1 million to Colonial Pipeline over control room management failures.

Spain fires intelligence chief amid phone hacking scandals (Washington Post) Spain’s government fired the director of the country’s top intelligence agency Tuesday following the hacking of politicians’ cellphones, including the devices of the prime minister and several supporters of the Catalonia region’s secession.

Costa Rica declares national emergency after Conti ransomware attacks (BleepingComputer) The Costa Rican President Rodrigo Chaves has declared a national emergency following cyber attacks from Conti ransomware group. BleepingComputer also observed Conti published most of the 672 GB dump that appears to contain data belonging to the Costa Rican government agencies.

Tech trade group comes out against Indian cybersecurity law over reporting mandate (The Record by Recorded Future) One of the world’s biggest technology trade groups has come out against a new directive from the Indian government mandating companies report cybersecurity incidents to CERT-IN within six hours of an incident.

Biden Signs Metrics Bill to Combat Cybercrime into Law (Virtualization Review) President Joe Biden signed into law the Better Cybercrime Metrics Act, enlisting the FBI and other government agencies to spearhead a metrics reporting initiative.

Biden signs cybercrime tracking bill into law (Register) All part of a larger push by the Feds to improve cybersecurity reporting

First on CNN: White House bolsters cyber office with hires from Microsoft and CIA (CNN) The Biden administration is building out a nascent White House office for strengthening federal cybersecurity policy and strategy by hiring a prominent Microsoft executive and a former CIA official, multiple people familiar with the matter told CNN.

US Brings Back Cyber Team to Combat Possible Election Meddling (Data Center Knowledge) The effort comes amid warnings from U.S. officials that Russia could seek to sway voters during the midterms.

The development of cyber warfare in the US – part 7 (Israel Defense) This chapter focuses on major contracts awarded by the DoD to various cyber companies, whose products serve to place the US as the international race winner

Public Company Cybersecurity; Proposed Rules (US Securities and Exchange Commission) The Securities and Exchange Commission proposed rules and amendments to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incident reporting by public companies (“registrants”) that are subject to the reporting requirements of the Securities Exchange Act of 1934.

Proposed Rule: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure File Number S7-09-22 (ACLI) Dear Ms. Countryman, Thank you for the opportunity to provide comments to the Securities and Exchange Commission (“SEC”) on the Proposed Rules for public companies regarding cybersecurity requirements. We previously submitted comments on the recent proposal related to Advisors, and many of the points we raised in that comment letter are relevant to this Proposed Rule as well. We will be brief in this letter and limit comments to a few items relevant to both proposals we deem of most importance, plus several items introduced in the Proposed Rule for public companies

File Number S7-09-22 (BSA) Dear Ms. Countryman: BSA | The Software Alliance (“BSA”) appreciates the opportunity to provide the below comments to the Securities and Exchange Commission’s (“Commission” or “SEC”) Proposed Rule on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (“Proposed Rule”).1

FILE NUMBER S7-09-22 — COMMENTS ON CYBERSECURITY RISK MANAGEMENT, STRATEGY, GOVERNANCE, AND INCIDENT DISCLOSURE (Digital Directors Network) Ladies and Gentlemen of the Commission, We are pleased to provide our comments on the proposed rules referenced in FILE NUMBER S7-09-22.

Idaho maps out cybersecurity strategy (GCN) Successful defense against cybersecurity threats will require more resources, partnerships and meaningful information-sharing between public and private sector organizations, a new report says.

Silicon Valley rallies behind New York ban on geofence and keyword search warrants (TechCrunch) Eleven tech giants, including Google, Microsoft and Yahoo, support the state bill to ban the controversial warrants.