News: First look: Financial Services GOP issue cyber report — Krebs says Trump should go

Monday, January 11, 2021

First look: Financial Services GOP issue cyber report — Krebs says Trump should go — Biden fills more NSC posts

Jan 11, 2021

With help from Eric Geller

Editor's Note: Weekly Cybersecurity is a weekly version of POLITICO Pro's daily Cybersecurity policy newsletter, Morning Cybersecurity. POLITICO Pro is a policy intelligence platform that combines the news you need with tools you can use to take action on the day's biggest stories. Act on the news with POLITICO Pro.

Quick Fix

— Cybercriminals have moved to take advantage of the raging Covid-19 pandemic, according to a report from Republicans on the Financial Services Committee.

— President Donald Trump could earn 'redemption' after last week's deadly insurrection by resigning, according to former CISA chief Chris Krebs.

— More Obama-era veterans were tapped to fill key posts on President-elect Joe Biden's incoming National Security Council.

HAPPY MONDAY and welcome to Morning Cybersecurity! Send your thoughts, feedback and especially tips to mmatishak@politico.com and be sure to follow @POLITICOPro and @MorningCybersec. Full team info below.

FIRST IN MC: FINANCIAL SERVICES GOP URGE DIGITIZATION — Congress, regulators and the private sector should prioritize issues related to cybersecurity and digitization after the Covid-19 pandemic and related relief programs "created an environment ripe for cybercriminal activity" around the globe, according to a report issued on Monday from Republicans on the House Financial Services Committee.

The GOP report examines in-depth the proliferation of malicious digital activity since the pandemic started last March, including the still unfolding SolarWinds compromise. The examination also includes documents and information obtained from federal regulators related to their ongoing efforts to digitize their operations as well unimplemented recommendations from a number of federal agency inspectors general, many of which relate to IT and digital security. "The evidence makes clear the committee must focus on further strengthening the nation's financial cybersecurity systems," the report's executive summary states.

Yet as additional coronavirus relief funds get set to be released "financial institutions are well equipped to deal" with various threats posed by digital criminals, according to the document. That said, the report suggests a number of steps regulators should take to bolster cybersecurity and implement new digitization guidelines for their supervisory relationship, such as digitizing operations to accommodate what may be a permanent shift to virtual interactions between themselves and the firms they regulate and seeking ways to "permanently digitize" their oversight functions.

HAPPENING THURSDAY - THE COVID-19 VACCINE ROLLOUT: What are the logistical challenges facing the coronavirus immunization campaign? Who is overseeing the process and working to overcome obstacles to ensure that vulnerable groups have access to the vaccine? Join POLITICO for a virtual discussion on the outgoing Trump administration's plan to prioritize lower-income, rural, and communities of color for vaccine distribution and what the Biden administration can do to streamline plans and fill in any gaps. REGISTER HERE.

The Capitol Riot

DON'T LET THE DOOR HIT YOU ON THE WAY OUT — Former CISA chief Chris Krebs on Sunday said President Donald Trump should resign after inciting last week's deadly assault on the Capitol. "The president's legacy is a heap of ashes. There's nothing redeemable at this point, given the fact that he incited this attempt to overturn democracy, a fair and free election," Krebs said on CBS' "Face the Nation."

Krebs — who will be the last administration official fired via presidential tweet should Trump's suspension from the social media platform hold — said the president has a chance to redeem himself. "Again, he can resign. He can tell his supporters that it was all a big con and that he is sorry," Krebs said. However, Krebs added: "I don't know if he's capable of doing it, but that's the best way to prevent further violence, to prevent further erosion of confidence in democracy over the next four years." He also said that "every single Republican on the Hill that continues to support these election irregularities has to do the same thing. They have to denounce it and they have to come back to the middle."

Building the Biden Administration

MORE BIDEN NSC PICKS — President-elect Joe Biden's transition team on Friday announced more Obama-era veterans would flesh out the incoming National Security Council. Caitlin Durkovich, who served on Biden's DHS agency review team, was named senior director for resilience and response. She previously served as assistant secretary of infrastructure protection from 2012 to 2017 at DHS, a position that has since become the assistant director for infrastructure security at CISA. From 2009 to 2012, Durkovich was the chief of staff at the DHS arm that evolved into CISA.

Tarun Chhabra will serve as senior director for technology and national security, according to the transition. Chhabra, a senior fellow at the Center for Security and Emerging Technology at Georgetown University, previously served as the NSC's director for strategic planning and director for human rights and national security issues.

Vulnerabilities

LET ME SEE SOME IDENTIFICATION — CISA on Friday published guidance to help companies detect breaches of their Microsoft enterprise software , including Office 365 and the Azure Active Directory authentication system. The advice follows revelations that the suspected Russian hackers behind the SolarWinds campaign began rooting around inside victims' Microsoft cloud environments after the initial compromise. "CISA observed this threat actor moving from user context to administrator rights for Privilege Escalation … within a compromised network and using native Windows tools and techniques … to forge authentication tokens … and then to move laterally to Microsoft Cloud environments," the agency said. "This level of compromise is challenging to remediate and requires a rigorous multi-disciplinary effort to regain administrative control before recovering."

CISA's bulletin describes how to use open-source tools such as Hawk and CISA's own Sparrow to identify hacked Microsoft accounts by looking at the history of security certificate exports, changes to user-authentication services and other indicators of potential compromise. But detection of cloud breaches requires speed, the agency said, because "the amount of telemetry retention is far less than the traditional logging facilities of on-premises data sources. Threat actor activity that is more than 90 days old is unlikely to have been saved" to be visible through management consoles. Another problem is that auditing software often requires global administrator privileges, which hinders forensic work. In addition, some tools only offer advanced features through paid subscriptions.

KEEP UP WITH THE FIRST 100 DAYS OF THE BIDEN ADMINISTRATION WITH TRANSITION PLAYBOOK: It was a dark week in American history, and a new administration will have to pick up the pieces. Transition Playbook brings you inside the last days of this crucial transfer of power, tracking the latest from President-elect Biden and his growing administration. Written for political insiders, this scoop-filled newsletter breaks big news and analyzes the appointments, people, and the emerging power centers of the new administration. Track the transition and the first 100 days of the incoming Biden administration. Subscribe today.

In the courts

SEE YOU IN COURT — Dominion Voting Systems on Friday sued former Trump campaign attorney Sidney Powell for pushing various conspiracy theories about the company in the wake of the 2020 presidential election. "Powell falsely claimed that Dominion had rigged the election, that Dominion was created in Venezuela to rig elections for Hugo Chávez, and that Dominion bribed Georgia officials for a no-bid contract," the lawsuit states. The company is seeking damages of more than $1.3 billion, arguing it has spent millions on security for its employees and that its reputation has been tarnished by Powell's baseless accusations.

People on the Move

— Georgianna Shea today joined the Foundation for Defense of Democracies as chief technologist of its Transformative Cyber Innovation Lab. Shea most recently served as chief engineer of MITRE's Defense Acquisition and Policy Department, where she was an adviser to the Office of the Under Secretary of Defense, Research and Engineering (OUSD R&E) Developmental Test Evaluation and Assessment (DTE&A).

TWEET OF THE DAY — The real reason why Krebs' name will go down in history.

Quick Bytes

— The NSA released a 2020 cybersecurity year-in-review report.

— Op-ed: 2020 was a bad year for ransomware. 2021 will be worse."

— A ODNI ombuds report exposed internal tensions over intelligence on election security threats.

— The National Telecommunications and Information Administration requested comments on 5G to support DoD.

That's all for today.

Stay in touch with the whole team: Eric Geller (egeller@politico.com, @ericgeller); Bob King (bking@politico.com, @bkingdc); Martin Matishak (mmatishak@politico.com, @martinmatishak); and Heidi Vogt (hvogt@politico.com, @heidivogt).