TWISTING IN THE SOLARWIND — The SolarWinds campaign promises to be one of the biggest problems confronting Biden's administration in a year already full of daunting challenges. Jake Sullivan, whom Biden has tapped to be his national security adviser, told CNN's Fareed Zakaria on Sunday that the president-elect "has made clear to us that from day one this is going to be a top national security priority of his administration." The sophisticated operation, tentatively linked to Russia's SVR intelligence service, has exposed the frailties of U.S. government and corporate networks and the risks of relying on poorly scrutinized technology vendors. "This attack constitutes a grave risk to our national security," Biden told reporters last week after meeting with national security advisers. The drip-drip-drip of details: The cyber campaign has infected the networks of more than a dozen companies operating critical infrastructure facilities such as power plants, along with at least three companies that supply technology to those facilities and have extensive remote access to them, according to The Intercept. Microsoft, which initially denied being hacked, said on New Year's Eve that an intrusion had exposed some of its products' source code (the company said its defenses do not rely on that code being secret). Microsoft also spotted hackers breaching one of its third-party resellers in a failed attempt to spy on the security firm CrowdStrike. Meanwhile, an Amazon intelligence report obtained by The New York Times suggested that the cyber campaign may have targeted as many as 250 networks. Congress wants answers: SolarWinds will pose an early test of Biden's relationship with Capitol Hill, as federal agencies face intense congressional scrutiny about their digital defenses. On Saturday, Sen. Richard Blumenthal (D-Conn.) tweeted that the government should "immediately" begin "declassifying [and] disclosing difficult facts" about the breach, hinting at the transparency issues that Biden will have to weigh once he takes office. Senate Foreign Relations ranking member Robert Menendez (D-N.J.) asked the State Department about the extent of the compromise there, and Blumenthal did the same with the Department of Veterans Affairs. CISA in the spotlight: DHS's Cybersecurity and Infrastructure Security Agency, which leads the protection of government networks, has told other agencies that it does not have "enough resources to provide direct support" to them in their SolarWinds investigations, according to CNN. CISA has released guidance documents and detection software for the SolarWinds campaign, but sources told CNN that CISA lacks the funding "to effectively handle an issue of this magnitude," echoing earlier reporting by yours truly. (CISA denies being overwhelmed.) Biden and his team will need to closely examine CISA's posture and determine whether it needs more staff to confront the chaos. Other potential targets: The IRS found no evidence that the SolarWinds hackers accessed taxpayer data; the U.S.'s electric grid regulator asked utilities to examine their networks for signs of a compromise; affected businesses must confront a patchwork of state data-breach notification laws; SolarWinds overlooked cybersecurity until it was too late , leading the government to worry about an insider threat at one of its Eastern European offices; and Palo Alto Networks published a handy timeline of the campaign. Question mark: Trump is considering "issuing three cyber presidential determinations in the coming days," CNN reported, including one that will transfer "certain authorities" from the Pentagon to CISA. Exactly what this will mean for the SolarWinds response, and for Biden's agenda, remains unclear. VETO, SHMETO — Congress easily overrode Trump's veto of the $740 billion National Defense Authorization Act, H.R. 6395, one of the most consequential pieces of cybersecurity legislation in years. As MC has highlighted, the massive authorization bill included more than two dozen provisions drawn from the Cyberspace Solarium Commission. Here are some of the key provision that just became law: — The creation of a Senate-approved National Cyber Director to coordinate the federal government's various digital missions and serve as the president's principal cyber adviser. — CISA received administrative subpoena power so that it can ask internet service providers for information about companies whose vulnerable infrastructure it uncovers. The agency also received the authority to hunt for threats across federal networks. The bipartisan bill also established a joint cyber planning office and a cyber advisory committee within the agency and directed CISA to appoint a cyber adviser for each state. — A force structure assessment of U.S. Cyber Command's Cyber Mission Force and a plan for annual Pentagon assessments of cyber vulnerabilities in major weapons systems. GROWING RISK FOR U.S. FIRMS IN CHINA — A new Chinese "data security" law taking effect early this year will increase the importance of U.S. businesses protecting their sensitive information, DHS said in an advisory published in December. The law "represents an even greater shift in [Beijing's] attitude away from protecting Chinese data systems as a defensive mechanism, and toward collecting data as an offensive act," DHS said. The agency's bulletin explains the new data-transfer law as well as an existing statute that applies to companies operating in China, and it lists the ways in which this collection can endanger U.S. companies and the mitigations they can apply. DHS advised U.S. firms to minimize the amount of sensitive data they store in China, determine the ownership structures of any Chinese firms with which they partner and identify alternatives to Chinese suppliers for their most sensitive operations. Companies should also develop plans for responding to Beijing's demands for data, the document said, and they should notify the U.S. embassy any time they receive such an order. | 
No comments:
Post a Comment