Cyber Defenders Council to promote American Defend Forward policies. Expected changes to US cybersecurity policy. CISA predicts major ramp-up in transition to EDR tech for federal agencies.

Summary

By the CyberWire staff

At a glance.

Cyber Defenders Council to promote American Defend Forward policies.
Expected changes to US cybersecurity policy.
CISA predicts major ramp-up in transition to EDR tech for federal agencies.

From the private sector: Cyber Defenders Council to promote American Defend Forward policies.

Since 2018, the US government has been employing a proactive “Defend Forward” strategy as a means to combat against foreign adversaries using cyber operations to further their national interests. Experts have identified that such a strategy could be used to to defend private organizations as well, and to support these efforts, Cybereason announces it will be sponsoring the Cyber Defenders Council, an independent group of global cybersecurity leaders from the public and private sectors focused on adapting Defend Forward deterrence strategies for the private sector. The Council will be publishing a series of reports detailing guidance for organizations deploying Defend Forward strategies focused on increasing the costs for threat actors and strengthening organizations’ defensive measures. Cybereason released his document explaining the Council’s mission and outlining the six main principles of Defend Forward policy.

Expected changes to US cybersecurity policy.

National Security Presidential Memorandum 13 (NSPM-13), US cybersecurity policy established in 2018 during the Trump administration, is expected to undergo a revamp in the coming months. In order to better understand NSPM-13 and the change to come, Lawfare chronicles the history of cybersecurity policy in the US, starting with Presidential Policy Directive 20 (PPD-20). Issued by former US President Obama in 2012, it is the first known White House directive focused on cybersecurity and the classified document was exposed to the public as a result of the Edward Snowden leaks.

Though NSPM-13 is classified, it reportedly requires less consensus from the federal government on time-sensitive cybersecurity decisions, instead giving authority to a delegation of officials under the Secretary of Defense. Fast-forwarding to now, sources say the Biden administration’s key changes to NSPM-13 be a requirement that the Department of Defense (DoD) inform the White House and State Department about any cybersecurity actions in order to make sure those actions do not interfere with with intelligence-gathering efforts or State Department relations with the nations involved. Opponents of such a change argue that it will stymie cybersecurity efforts by tangling them in unnecessary bureaucratic red tape, but supporters say it will provide the DoD with necessary guidance when making large-scale strategic decisions.

CISA predicts major ramp-up in transition to EDR tech for federal agencies.

In an executive order last year, US President Joe Biden mandated that all federal agencies deploy endpoint detection and response (EDR) technology in order to better track malicious activity. Dozens of agencies have already made necessary changes, and according to the Cybersecurity and Infrastructure Security Agency (CISA), that number is expected to drastically increase before the end of the fiscal year. SC Magazine reports that at Tuesday’s House Homeland Security Committee hearing, CISA executive director Eric Goldstein stated, “At this point we are in the process of deploying these EDR tools across 26 federal civilian agencies and expect to be underway at 53 agencies at the end of this fiscal year, only a few short months away. Which means not even a year-and-a-half after execution of the executive order, we will have EDR deployments in place underway at over half of the federal government, with more rolling out in the months to come.”

US federal chief information security officer Chris DeRusha also gave an update on the progress made so far in carrying out the zero-trust measures outlined in President Biden’s executive order, stating, “We picked a few of these measures that had the most impact and put the highest amount of priority you can have around them, metricking them, having engagements not just with CIOs and CISOs but senior agency leadership, multiple meetings with deputy secretaries tracking and measuring progress…and starting down the path of zero trust at agencies.”

Selected Reading

SRI : In terms of cyber espionage, Russia's all relevant intelligence services try to be present in Romania (ACT Media) All relevant intelligence services from Russia, namely FSB, GRU and SVR, are trying to be present in Romania, on the cyber espionage side, the general director ...

CISA pledges half of federal agencies will have EDR by end of fiscal year (SC Magazine) CISA and OMB update Congress on how federal agencies had complied with the Biden administration’s cybersecurity executive order as well as their push to implement zero-trust architectures across agencies and departments.

CISA to Address State, Local Government Quantum Readiness (GovTech) A new memorandum instructs CISA to “engage with” state and local governments by late fall about quantum computing risks. Federal officials, meanwhile, are looking for new ways to build a quantum-focused workforce.

Cyber officials express confidence over ‘significant progress’ in federal security (The Hill) U.S. cyber officials testifying before a House subcommittee on Tuesday told lawmakers that they’ve made “significant progress” in improving and securing federal networks from cyber threats.&nb…

One year after Biden executive order, cyber officials defend progress (The Record by Recorded Future) A year after President Joe Biden signed a sweeping executive order to better secure federal networks from hackers, senior cyber officials insisted progress has been made — even though compliance with key portions of the directive remains uneven.

Leaders cite progress under cyber EO, but lawmakers press for more amid persistent threats (Federal News Network) Lawmakers are skeptical about progress on multifactor authentication, endpoint detection and other capabilities mandated by the cybersecurity executive order.

U.S. House passes bill requiring report on federal cyberattack response (Nebraska Examiner) The U.S. House has easily passed a bill that would require the Department of Homeland Security to evaluate its cybersecurity capability.

President Biden’s Policy Changes for Offensive Cyber Operations (Lawfare) Concerns about changes to the U.S. policy on offensive cyber operations raise an interesting and important question about the balance of power between the White House and the Department of Defense. But this is a poor framing of the problem.

Special ops leader issues warning over information warfare capabilities, funding (C4ISRNet) Though operational commitments keep U.S. Special Operations Command moving, progress comes down to affordability.

Understanding—and Fixing—the Army’s Challenge in Keeping Cyber Talent (Modern War Institute) This article is part of the series “Compete and Win: Envisioning a Competitive Strategy for the Twenty-First Century.” The series endeavors to present expert commentary on diverse issues surrounding US competitive strategy and irregular warfare with peer and near-peer competitors in the physical, cyber, and information spaces. The series is part of the Competition in Cyberspace […]

91st Cyber Brigade welcomes new commander (Virginia National Guard) Col. Rusty McGuire took command of the Virginia National Guard’s Bowling Green-based 91st Cyber Brigade from Brig. Gen. Teri Williams May 14, 2022, in Bowling Green, Virginia.