Data breaches and IP. Current cyberespionage campaigns. A warning that the cyber phases of the hybrid war can’t be expected to be over, yet. Exfiltration via machine learning inference.

Tre Hester: CISA adds three known exploited vulnerabilities to its Catalog. The data breach at Acer exposes intellectual property. Sharp Panda deploys SoulSearcher malware in cyberespionage campaigns. U.S. Cyber Command's head warns against underestimating Russia in cyberspace. Dave Bittner sits down with Simone Petrella of N2K Networks to discuss the recently released Defense Cyber Workforce Framework. Betsy Carmelite from Booz Allen Hamilton speaks about CISA's year ahead. And are large language models what the lawyers call an attractive nuisance?

Tre Hester: From the CyberWire studios at DataTribe, I'm Tre Hester, filling in for Dave Bittner, with your CyberWire summary for Wednesday, March 8, 2023. 

CISA adds three known exploited vulnerabilities to its running Catalog.

Tre Hester: CISA has added three entries to its Known Exploited Vulnerabilities Catalog. Presently undergoing active exploitation are: CVE-2022-28810, a Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability, CVE-2022-33891, an Apache Spark Command Injection Vulnerability, and CVE-2022-35914,, a Teclib GLPI Remote Code Execution Vulnerability. U.S. federal civilian executive agencies have until March 28 to inspect their systems and address the issues they find there. As CISA says, apply updates per vendor instructions. 

Data breach at Acer exposes intellectual property.

Tre Hester: Computer manufacturer Acer has confirmed that it sustained a data breach that resulted in the theft of company data. SecurityWeek reports that a hacker is offering 160GB of stolen data for sale on a criminal forum. According to BleepingComputer, the hacker claims the stolen data contains technical manuals, software tools, back-end infrastructure details, product model documentation for phones, tablets and laptops, BIOS images, ROM files, ISO files and replacement digital product keys. Acer said in a statement to SecurityWeek, quote, "we have recently detected an incident of unauthorized access to one of our document servers for repair technicians. While our investigation is ongoing, there is currently no indication that any customer data was stored on that server," end quote. Most discussions of data breaches tend to concentrate on the threat they pose to personal data. The incident in Acer shows that threat actors are also interested in intellectual property. 

Sharp Panda deploys SoulSearcher malware in cyberespionage campaigns.

Tre Hester: Check Point is tracking a Chinese cyberespionage operation that's targeting government entities in several Southeast Asian countries, including Vietnam, Thailand and Indonesia. The threat actor is delivering the Soul malware framework via a new version of the SoulSearcher loader. The Soul framework was previously unattributed, but the researchers conclude, based on the campaign, that the malware is being used by one or more APTs based in China. The operation has overlaps with previous campaigns by the Chinese APT Sharp Panda, though the researchers point out that since sharing custom tools or operational methods is common among Chinese-based threat actors to facilitate intrusion efforts and poses a challenge to their attribution. 

US Cyber Command head warns against underestimating Russia.

Tre Hester: Russia remains a very capable adversary, U.S. Cyber Command and NSA Chief General Paul Nakasone told the U.S. Senate Armed Services Committee yesterday. The general told the senators that U.S. Cyber Command was monitoring the war very carefully. Representatives of General Nakasone's two commands were also forthright in sharing a warning anonymously, and not for attribution, with the media. The Voice of America writes, the weight of this conflict remains significant, a spokesperson for U.S. Cyber Command told Voice of America, sharing information on the condition of anonymity due to the nature of the ongoing fight. They stated, quote, "we anticipate their cyber activities may become bolder and look at broader targets." Officials at the National Security Agency have reached similar conclusions - quote, "if the conflict continues to not go well for Russia, there is some chance that Russia will become increasingly brazen in its cyberattacks on civilian infrastructure, as we have already seen in their kinetic activity," end quote. 

Tre Hester: Russian cyber operations have so far shown disappointing results, especially for the amount of effort expended on them. The warnings from NSA and Cyber Command think, however, that Russian forces will seek to redress battlefield failures with cyberattacks, and especially cyberattacks against those countries that have provided Ukraine important support. Lindy Cameron, head of the U.K.'s National Cyber Security Centre, offered an appreciation quoted in Computer Weekly - both efforts have largely failed thanks to the efforts of Ukraine and Western digital expertise within governments and private sector. In many ways, the most important lesson to take from the invasion is not around the Russian attacks, which have been very significant and, in many cases, very sophisticated, it is around Russia's lack of success. Try as they might, Russian cyberattacks simply have not had the intended impact. We haven't seen the cyber Armageddon. What we have seen is very significant conflict in cyberspace, probably the most sustained and intensive cyber campaign on record," end quote. Thus, both American and British cyber authorities warn that Russia may not have exhausted itself in cyberspace yet. 

Large language models as an attractive nuisance.

Tre Hester: And finally, Dark Reading reports an odd result from Cyberhaven, who's blocking a fair number of interactions with large language models in its clients' networks. The interactions are troubling because employees are feeding sensitive data into what are, for the most part, third-party data aggregators and processors. Dark Reading writes, quote, "In one case, an executive cut and pasted the firm's 2023 strategy document into ChatGPT and asked it to create a PowerPoint deck. In another case, a doctor input his patient's name and medical condition and asked ChatGPT to craft a letter to the patient's insurance company," end quote. This emergent class of risk is being called exfiltration via machine-learning inference. 

Tre Hester: Coming up after the break, Dave Bittner sits down with Simone Petrella of N2K Networks to discuss the recently released Defense Cyber Workforce Framework. And Betsy Carmelite from Booz Allen Hamilton speaks about CISA's year ahead. Stick around. 

Dave Bittner: On February 15, the Department of Defense issued DOD Manual 8140.03, the cyberspace workforce qualification and management program. DOD says the program provides a targeted, role-based approach to identify, develop and qualify cyber personnel by leveraging the DOD cyber workforce framework. For insights on this, I reached out to one of our in-house experts, Simone Petrella, president of N2K Networks and CEO and founder of CyberVista. 

Simone Petrella: This document, this directive is actually a manual that is a companion to directive 8140. That directive, which has been out for some time, was intended or is intended to provide a targeted, role-based approach to cybersecurity personnel that are supporting the Department of Defense. The manual, which has been long anticipated and is just coming out now, is really the details that was never fleshed out in the original directive. So we've known for quite some time that the intent was to move the DOD into a more role-based approach. But the inevitable question was, well, what does this mean, or what will this mean? This manual is essentially there now to answer that question as far as what are the qualifications, how does the Department of Defense actually evaluate and validate that the personnel supporting their work, whether civilian or contractor, have the qualifications they need to perform in those work roles? 

Dave Bittner: So I know you've been spending some time going through the manual here. What are some of the things in here that have caught your eye? 

Simone Petrella: The thing that's caught my eye the most is - for those who are familiar with 8140's predecessor, which was DOD directive 8570, that was a qualification matrix that was very reliant on certification. And the first thing that strikes me is that this is actually really by design taking into account levels of experience that demonstrate knowledge and ability and capacity to serve in roles that are far beyond certification. So it is a movement away from certifications. However, what also strikes me is that when I look at the way that they are outlining their approach to provide that kind of level of validation, there's a lot there. It's pretty intense as far as, you know, we can choose between education and training, potentially certifications. There's also ways to look at the experience levels. So what strikes me is that there's not only going to be a fairly high burden for personnel to meet the requirements, but there's going to be an equivalent burden on the DOD to track this in a sustainable and scalable way. It's just a lot of data. 

Dave Bittner: Does this give them the potential to open up these opportunities for more people? Does it give them more flexibility? 

Simone Petrella: It definitely provides more flexibility because they're allowing for options that are beyond traditional certifications. That said, one of the things that I did find very interesting is that for anything that does meet the qualifications of being appropriate training, they are requiring that it has a assessment component to it based on the lesson objectives of that course. So there does need to be a measurement element in order to demonstrate all of those things. The other thing that I think is also really telling is that there is an emphasis on continuing education, which is really around the collection and maintenance of CPE credits as people go through individual and professional development. 

Dave Bittner: What are the practical implications of this? You know, for the folks that this affects, what sort of things are they going to have to do now? 

Simone Petrella: I think it's going to practically put a pretty high standard and bar on organizations that support the DOD to track and maintain their workforce in a way that they can actually justify and document. And that's at a level here that is unprecedented. Prior to this coming out, you could put - I'll use a kind of a defense contractor perspective to start. You could place someone on a contract by demonstrating that they met a certain certification credential, and that was sufficient to essentially check the box. Now it's about four different categories of things that we need to put forward to say this person is qualified. And then you're thinking, you know, times that by however many personnel are going on to staff - you have to maintain it, too. So I think it's going to put a pretty large reporting requirement on both sides of the DOD itself and the organizations that support the DOD. 

Dave Bittner: And what sort of timeline are we on here for implementation? Again, the organizations who have to follow this - how's the clock running for them? 

Simone Petrella: Yeah. The timeline, like most things in the DOD - first of all, I mean, we waited over five years-plus for this manual to come out, so that gives an implementation timeline. I think there is about two years of time for the civilian employees to actually meet the qualifications under this definition of work-role elements and three years for other work roles. Contractors - so anyone who is supporting the DOD in a consultative or contracted capacity, they have to comply with this upon any new award of work. So that's almost immediately. 

Dave Bittner: Is that realistic? Again, what sort of burden do we think this is going to place on the contractors? 

Simone Petrella: It's certainly going to put them in a scramble to try and document and figure out how they can capture information about their workforce in a way that they can present that meet these qualifications. So that's going to be the biggest burden right off the bat is they're going to have to do a good clean inventory of who they already have been putting on these contracts and making sure that they meet all the existing criteria as they're outlined in this new manual. 

Dave Bittner: Overall, what is your take on this? Do you think this will be an effective way to improve the cybersecurity of the DOD? 

Simone Petrella: Overall, you know, I think what is most striking to me, it corrects one of the failings that - 8570 ultimately had the unintended consequence of making us more reliant on someone having a credential or certification as evidence of their qualification to be competent in their role. And it was well-intended, but it had the adverse effect of really becoming a check-the-box. And I think from a, you know, intention of, like, we want to make our national security posture more secure, this is putting a higher burden on actual - how do we demonstrate that someone has the knowledge? How do we demonstrate that someone has the abilities to do this type of work so that we can result in a higher degree of security? It's going to be hard to get there, but I think that the fact that it's now written so clearly that this is something that we are looking at from a role-based perspective - that's going to have a pretty significant effect. Not only the DOD, but the fact that they're the first organization to do it, I think you'll start to see other elements of the government agencies as well as the private sector start to kind of look at their workforce in similar ways. 

Dave Bittner: Our thanks to our own Simone Petrella for joining us. 

Dave Bittner: And joining me once again is Betsy Carmelite. She's a principal at Booz Allen Hamilton. Betsy, it's always great to welcome you back to the show. I want to talk to you today about CISA, the Cybersecurity and Infrastructure Security Agency, and the kinds of things that you see on their road map for this year ahead. What can you share with us today? 

Betsy Carmelite: Sure. So this past fall, we saw CISA release its 2023-to-2025 strategic plan, and this was a major milestone for the agency. It's the agency's first. It's a relatively young agency, so it's its first comprehensive strategic plan since it was established in 2018. And the plan focuses and guides the agency's efforts, and specifically, the plan sets CISA on a path over the next three years to drive change in four key areas - spearheading the national effort to ensure the defense and resilience of cyberspace, reducing risks to and strengthening the resilience of America's critical infrastructure, strengthening the whole-of-nation operational collaboration and information-sharing environment, and then unifying as one CISA through integrated functions, capabilities and its workforce. And then on top of that, we saw this past fall that CISA's Jen Easterly outlined the agency's 2023 priorities in which she said one of the agency's focuses will be on supporting so-called target-rich, resource-poor sectors such as K-12 education. So here we're looking at municipalities, school districts, who are often constant victims of ransomware. Same with hospitals, water and wastewater facilities and small businesses. 

Dave Bittner: So what about in terms of critical infrastructure here? I mean, how do these cybersecurity performance goals go at protecting them? 

Betsy Carmelite: Yeah. So again, another development this last fall was what you just mentioned - the cybersecurity performance goals. And these outline the highest-priority baseline measures that businesses and critical infrastructure owners of all sizes can take to protect themselves against cyberthreats. So we're kind of seeing this linear build of the strategic plan and then the focus from the CISA director, and now we're seeing the cybersecurity performance goals. So we're seeing the goals being helpful to organizations - decide how to leverage their cybersecurity investments with confidence that the measures they will take will make some sort of material impact on protecting their businesses and safeguarding the country. 

Betsy Carmelite: Also, within those goals, the performance goals, are a comprehensive list of best practices and recommendations covering everything from zero-trust, segmentation, asset visibility and management. And those goals are a great starting point for organizations looking to work through the cybersecurity maturation process. And I think that's really important as you're building from a ground-up. Like, where is this going to take me? Will this help me reach a point where I am confident that I am maturing through these processes? Especially for those operational technology networks that our critical infrastructure is reliant on and proactively bolstering their cyberdefensive posture. 

Dave Bittner: You know, as someone who keeps an eye on the federal space the way I know you do, where do you suppose CISA's going to head this year? What do you think is on their road map? 

Betsy Carmelite: So a couple things. So I think we're going to continue to see the focus on critical infrastructure organizations having a relationship with CISA and integrating its products and outputs in their processes. So while the goals in the plans provided needed direction and really critical relationship-building steps between CISA and the critical infrastructure organizations and operators, now is the time when we're hopeful that implementation strategies are being developed. The hard work, we know, is being done inside of CISA to help those organizations mature, use those investments, but how do we tactically take that out to the public? I think we've seen a really good example with CISA kicking off some of these efforts. In January, they released a tool kit for K-12 institutions to help them better protect against cybersecurity threats - so some of that focused direction for those under-resourced entities. Also, how can CISA facilitate information-sharing moving forward? How - data transport between government entities and private sector critical infrastructure entities. How can CISA encourage CI operators, really, to come to the table now to take part in these performance goals? That's hugely important. 

Betsy Carmelite: And I do think we also need to acknowledge that to make all of those things happen, there is so much more work involved. We're looking at where does future legislation come into play? Data ownership rights. And CI sectors are going to - the critical infrastructure sectors are going to have expected outcomes from CISA through these relationships. So really putting some definition around that. 

Dave Bittner: You know, it's been my perspective or my take that so far, as you say, CISA's a young organization, but it seems to me like they've been getting pretty high marks on what they've been able to accomplish so far. Does that track with what you've been seeing as well? 

Betsy Carmelite: Yeah. I - it does, and I think you're right with understanding the context, and we should always be looking at this through the context of where it's come since just 2018. And, really, the role that it's looking to have with the public has been so much more a focused effort, and that's where our information - that's where our infrastructure lies with public and private networks. So I think the work moving forward to make sure that understanding what implementation can occur across those public and private networks is really the - what the best is yet to come. 

Dave Bittner: All right. Well, Betsy Carmelite, thanks for joining us. 

Tre Hester: And that's the CyberWire. For links to all of today's stories, check out our Daily Briefing at thecyberwire.com. The CyberWire podcast is a production of N2K networks proudly produced in Maryland out of the startup studios of DataTribe, where they're co-building the next generation of cybersecurity teams and technology. This episode was produced by Liz Irvin and senior producer Jennifer Eiben. Our mixer is me, with original music by Elliott Peltzman. This show is written by John Petrik. Our executive editor is Peter Kilpe. And I'm Tre Hester filling in for Dave Bittner. Thanks for listening, and we'll see you back here tomorrow.