Taxi apps required to share rider data. US cybersecurity EO, one year in. Maryland upgrades local cybersecurity assistance.

Announcement

The CyberWire launches CISA Cybersecurity Alerts.

We are very pleased to announce the launch of our new service, CISA Cybersecurity Alerts, a first-of-its-kind audio feed for urgent cybersecurity advisories from the US Government. The CISA Cybersecurity Alerts podcast is a public service to the community, funded by the CyberWire and entirely ad-free. You can find these alerts wherever you get your podcasts and in the CyberWire Daily podcast feed. We invite everyone to publish these alerts through their own feeds, podcasts, or websites. Contact the CyberWire team to publish the CISA Cybersecurity Alerts and subscribe today in your favorite podcast app. Read more in the press release.

Summary

By the CyberWire staff

At a glance.

Taxi apps required to share rider data.
US cybersecurity EO, one year in.
Maryland upgrades local cybersecurity assistance.

Russian taxi app users could share more than a ride.

Moscow has introduced a law requiring taxi apps to give the Federal Security Service (FSB) real-time remote access to their transportation data. According to a statement published Wednesday by the lower house State Duma, "The document prescribes the obligation of the taxi ordering service to provide the FSB with automated remote access to the information systems and databases used to receive, store, process and transmit taxi orders." Security Week notes that until now, the FSB was required to file a formal information request with the taxi ordering service, which had up to thirty days to respond. The new law has some citizens worried that the intelligence agency might use the data to track taxi passengers, but Adalbi Shkhagoshev, a member of parliament's security committee, says the data would be used only for urgent matters of national security when “FSB agents need to have this data practically within an hour to solve a crime or prevent it." The legislation is the latest in a string of measures the Russian government has enacted to restrict public freedoms since the start of the war in Ukraine.

Biden’s cybersecurity executive order celebrates first birthday.

It’s been one year since US President Joe Biden issued the Executive Order on Improving the Nation’s Cybersecurity, and in honor of this milestone, Mayer Brown offers an overview of the measures the EO has motivated so far. Following a surge of large-scale cyberattacks impacting critical infrastructure in the US, the EO led to a wave of legislation aimed at strengthening the security of the US’s digital tech systems, including a plan for implementing zero-trust architectures, revamped incident reporting rules, and heightened security in the software supply chain. CSO spoke with industry experts about what progress has been made to date, and where there’s room for improvement. President and CEO of the Cyber Threat Alliance Michael Daniel (a former White House cybersecurity coordinator) says, "Whether you're talking about software bills of material, or you're talking about the push for multi-factor authentication across the federal enterprise, the cybersecurity executive order provided the foundation for the ongoing activity and is the lodestar for the administration's priorities." Bob Kolasky, senior vice president for critical infrastructure at Exiger and former assistant director of the Cybersecurity and Infrastructure Security Agency (CISA), adds that while it might be too early to assess the full impact of the EO, “It was, first and foremost, 'Let's get our own house in order. Let's modernize our own house as much as possible.’ I think there's early evidence that it has accomplished that.” That said, Daniel says some measures, like the new incident reporting legislation passed by Congress, have yet to be fully implemented. And, co-founder and CTO of Veracode Chris Wysopal says measures need to be taken to cover more types of software. “The initial requirements around what they deem critical software involve things like hypervisors and operating systems and network security devices, and things that have to operate at increased privileges. That is all well and good…but we've seen plenty of breaches that have come in through run-of-the-mill websites. So that's where I think it needs to go in the future, realizing that most software is putting the government at risk. It's not just critical software."

Maryland governor signs measure to provide assistance for local cybersecurity improvements.

Bollyinside reports that the governor of the US state of Maryland Larry Hogan yesterday signed legislation focused on improving cybersecurity in state and municipal governments, including a measure providing local governments, school systems, and health agencies with greater resources and assistance from the Maryland Emergency Management Agency. Hogan stated, “Today, we are signing bipartisan legislation to further solidify our standing as America’s cyber capital, and to further strengthen our infrastructure to protect Marylanders against cyberattacks.” The agency will assist local governments in completing vulnerability assessments and response plans. During the last legislative session, Maryland lawmakers put approximately $570 million toward cybersecurity and information technology upgrades, including $200 million for cybersecurity.

Selected Reading

Costa Rica declares emergency in ongoing cyber attack (AP NEWS) After a month of crippling ransomware attacks, Costa Rica has declared a state of emergency. In theory, the measure usually reserved to deal with natural disasters or the COVID-19 pandemic would free up the government to react more nimbly to the crisis.

EU's plan to combat online child abuse may compromise people's online privacy, experts warn (Computing) Under proposed rules, tech firms could be asked to detect both new and previously identified child sexual abuse material by breaking encryption if necessary

A quick guide to the most important AI law you’ve never heard of (MIT Technology Review) The European Union is planning new legislation aimed at curbing the worst harms associated with artificial intelligence.

EU governments, lawmakers agree on tougher cybersecurity rules for key sectors (Reuters) EU countries and lawmakers agreed on Friday to tougher cybersecurity rules for large energy, transport and financial firms, digital providers and medical device makers amid concerns about cyber attacks by state actors and other malicious players.

Russia Pushes Law to Force Taxi Apps to Share Data With Spy Agency (SecurityWeek) Russian authorities have been ramping up restrictions on public freedoms since the start of Moscow's offensive in Ukraine on February 24.

Happy EOnniversary: One Year of Action Since President Biden’s Cybersecurity Executive Order (Mayer Brown) Strengthening the nation’s cybersecurity has been a top priority for the Biden administration, as reflected in its collaboration with industry, regulatory actions, and the legislation it has supported in Congress, including the Cyber Incident Reporting for Critical Infrastructure Act of 2022.

A year later, Biden’s cybersecurity executive order driving positive change (CSO Online) Notable experts say the cybersecurity executive order has improved the nation's security posture, but more work is to be done.

Biden extends US telecom supply chain order aimed at Huawei, ZTE (The Record by Recorded Future) The Trump-era executive order prohibited U.S. companies from using telecommunications equipment from Chinese companies.

Building a Cyber Force Is Even Harder Than You Thought (War on the Rocks) In the past decades, over 40 states have publicly established some sort of military cyber command, with at least a dozen more planning to do so. Yet

In Cyberspace, No One Can Hear You Bluff (CIMSEC) General Paul Nakasone – Commander, U.S. Cyber Command (USCC) and Director, National Security Agency (NSA) – asserts that “traditional military deterrence is binary in regard to conflict and a deterrence model…does not comport to cyberspace where much of the nefarious cyber activity plays out non-stop in an ambiguous strategic gray zone.” While this article is in agreement with the “futility of totally deterring adversaries from operating in cyberspace and instead actively disrupting those activities before they can inflict damage,” it takes the position of respectfully disagreeing that traditional deterrence is binary and the rules of traditional deterrence do not hold in cyberspace.

Businesses Seek to Soften SEC Cyber Rules (Wall Street Journal) Lobbying groups and companies are expressing concern over public disclosure requirements.

CIA selects new CISO with deep private sector experience (The Record by Recorded Future) Joseph “Rich” Baich most recently worked at American Insurance Group (AIG) as its global chief information security officer.

The 688th Cyberspace Wing activates the 692nd Cyberspace Operations Squadron to consolidate operations, enhance Air Force security and capabilities (DVIDS) The 688th Cyberspace Wing held an activation ceremony for the 692nd Cyberspace Operations Squadron, April 20, 2022 at Elgin Air Force Base, Florida.

The Governor of Maryland has signed laws to boost cybersecurity (Bollyinside) On Thursday, Maryland Governor Larry Hogan signed legislation to boost cybersecurity in state and municipal governments, following legislation and

Conn. Privacy Law Hikes Pressure On Congress To Set Rules (Law360) With Connecticut enacting the nation's fifth consumer privacy law, businesses are increasingly electing to roll out their new obligations to users nationwide rather than state-by-state and are intensifying their call for Congress to set a firm federal standard.