NSA releases Cybersecurity Advisory on Ensuring Security of Operational Technology

The National Security Agency (NSA) released the Cybersecurity Advisory, “Stop Malicious Cyber Activity Against Connected Operational Technology” today, for National Security System (NSS), Department of Defense (DoD), and Defense Industrial Base (DIB) operational technology (OT) owners and operators. The CSA details how to evaluate risks to systems and improve the security of connections between OT and enterprise networks. Information technology (IT) exploitation can serve as a pivot point for OT exploitation, so carefully evaluating the risk of connectivity between IT and OT systems is necessary to ensure unique cybersecurity requirements are met.
Each IT-OT connection increases the potential attack surface. To prevent dangerous results from OT exploitation, OT operators and IT system administrators should ensure only the most imperative IT-OT connections are allowed, and that these are hardened to the greatest extent possible. An example of this type of threat includes recent adversarial exploitation of IT management software and its supply chain in the SolarWinds compromise with publicly documented impacts to OT, including U.S. critical infrastructure.
This guidance provides a pragmatic evaluation methodology to assess how to best improve OT and control system cybersecurity for mission success, to include understanding necessary resources for secure systems:
- First, NSA encourages NSS, DoD, and DIB system owners, operators, and administrators to evaluate the value against risk and costs for enterprise IT to OT connectivity. While the safest OT system is one that is not connected to an IT network, mission critical connectivity may be required at times. Review the connections and disconnect those that are not truly needed to reduce the risk to OT systems and functions.
- Next, NSA recommends taking steps to improve cybersecurity for OT networks when IT-OT connectivity is mission critical, as appropriate to their unique needs. For IT-OT connections deemed necessary, steps should be taken to mitigate risks of IT-OT exploitation pathways. These mitigations include fully managing all IT-OT connections, limiting access, actively monitoring and logging all access attempts, and cryptographically protecting remote access vectors.
Operational technology includes hardware and software that drives the operations of a given infrastructure environment, from an engine control unit in a modern vehicle to nationwide train transportation networks.
Every IT-OT connection creates an additional vector for potential OT exploitation that could impact and compromise mission and/or production. Performing a comprehensive risk analysis for all IT-OT interconnections and only allowing mission critical interconnections when they are properly protected will create an improved cybersecurity posture. By employing an appropriate risk analysis strategy, leadership and system owners and operators can make informed decisions to better manage OT networks while reducing the threats from and impact of exploitation and destructive cyber effects.

Governments call for more public and private investment in disaster prevention and risk reduction

Member States gathered virtually to adopt the Outcome Document of the 2021 Economic and Social Council (ECOSOC) Forum on Financing for Development. This year’s outcome document provides indispensable intergovernmental policy guidance to countries on financing for disaster risk reduction and risk-informed investing.
For the first time at the ECOSOC Forum on Financing for Development, Governments recognise the systemic nature of risk and the need to strengthen the understanding of risk in economic and financial planning across all sectors and at all levels. There is a clear call to redress the balance from investing in response towards investing in prevention and risk reduction. Risk-sensitive public investment planning; the consideration of risk in land use planning; risk-sharing mechanisms that create an enabling environment for public-private partnerships; and diagnostics for infrastructure investments that include resilience and climate change adaptation are some of the policy options identified to accelerate financing for disaster risk reduction.
To support these efforts, national and regional development banks and international financial institutions are invited to integrate disaster risk reduction and resilience into COVID-19 economic recovery strategies. The outcome document also breaks new ground in recognizing the need to strengthen the resilience of the financial system through systematically integrating climate, environmental and disaster risks into global risk monitoring to inform future decision making.
Application of this intergovernmental policy guidance at national level will undoubtedly bring significant benefit to the implementation of national and disaster risk reduction strategies. It can also support coherence between financing for disaster risk reduction and climate change adaptation and ensure that the financing for the Sustainable Development Goals and COVID-19 socioeconomic recovery strategies build resilience and reduce the risk of future disasters.
Deliberations at the Forum, which ran from 12 to 15 April, were guided by the 2021 Financing for Sustainable Development Report. This year’s report includes a dedicated chapter that provides guidance to ministries of finance and planning to integrate disaster risk reduction into their policy decisions. During the forum, UNDRR, in partnership with UNDESA and the Co-Chairs of the Group of Friends for Disaster Risk Reduction, organized a side event titled “Financing for Disaster Risk Reduction and a Risk-Informed Approach to Investing Across the SDGs”. The event brought together a variety of development finance practitioners from government and the private sector to discuss the comprehensive approach needed to finance disaster risk reduction and capitalize on public sector policy-setting and private sector innovation.
In her opening remarks, Ms. Mami Mizutori, Special Representative of the Secretary-General for Disaster Risk Reduction, stated that “the current approach to funding disaster risk reduction is not keeping pace with the exponential rise of disaster risk” and called for “a paradigm shift in political attitudes towards financing for disaster risk reduction especially in places that are largely unprotected from the ravages of the climate emergency and the threat of biological hazards”. Mr. Shaun Tarbuk, Chief Executive of the International Cooperative and Mutual Insurance Federation, announced an upcoming report with UNDRR titled “From protection to prevention: the role of cooperative and mutual insurance in disaster risk reduction”.

Exploring Research Directions in Cybersecurity

ENISA, the European Union Agency for Cybersecurity, has identified key research directions and innovation topics in cybersecurity to support the efforts of the EU towards a Digital Strategic Autonomy.
Resilience, technological sovereignty and leadership are essential for the EU and as such, they are addressed by the new EU Cybersecurity Strategy. In an effort to support this cybersecurity strategy, the European Union Agency for Cybersecurity releases today a report intended to look into digital strategic autonomy in the EU and suggests future research directions.
What is Digital Strategic Autonomy?
Digital strategic autonomy can be defined as the ability of Europe to source products and services designed to meet the EU’s specific needs and values, while avoiding being subject to the influence of the outside world. In the digital world, such needs may encompass hardware, software or algorithms, manufactured as products and/or services, which should comply with the EU values, and thus preserve a fair digital ecosystem while respecting privacy and digital rights.
To ensure the sourcing of such products and/or services complies with the EU’s needs and values, the EU has the option to self-produce them autonomously, or in the case where products and services are acquired from third countries, to certify them and validate their compliance.
However, in cases where there is a high dependence on sourcing, the EU should still be capable of operating its digital infrastructures without giving rise to any possible detrimental influence. Hence, Europe needs to maintain the capability to produce its critical products and services independently.
In short, digital strategic autonomy means the capacity for the EU to remain autonomous in specific areas of society where digital technologies are used.
Why such a move?
The new challenges brought about by the digitalisation of our environment raise questions on our capacity to retain ownership and control of our personal data, of our technological assets and of our political stand. Such are the main dimensions to be considered under the idea of digital strategic autonomy.
Furthermore, the COVID-19 pandemic highlighted the importance of cybersecurity and the need for the EU to continue to invest in research & development in the digital sector. Within this context, ENISA’s report sets and prioritises the key research and innovation directions in cybersecurity.
Key Research Directions: which are they?
The report identifies the following seven key research areas:
- Data security;
- Trustworthy software platforms;
- Cyber threat management and response;
- Trustworthy hardware platforms;
- Cryptography;
- User-centric security practices and tools;
- Digital communication security.
For each of these areas, the report introduces the current state-of-play in the EU, includes an assessment of current and expected issues. The analyses included serve the purpose of issuing recommendations on cybersecurity related research topics. Such recommendations intend to highlight the bases needed to bolster the EU’s digital autonomy.

UNDRR ROAMC: Investment in education creates more resilient societies

Investments in safe schools provide economic returns for society and also contribute to economic recovery, according to the latest evidence. They represent a clear way to finance risk reduction initiatives in the education sector and are a direct contribution to the creation of more resilient societies.
The suspension of classes for more than a year, due to the pandemic, has not been duly dimensioned.  Until now. Education may well be one of the most affected sectors by the COVID-19 crisis. According to different analyses, students affected by school closures will obtain 3% less income during their professional lives, which will mean an approximate GDP loss of 1.5% over the remainder of the century. The pandemic will also increase school desertion and will have a profound effect on learning processes for an entire generation, without taking into account systemic effects from school closures, such as increased malnutrition, mental health effects, and other vulnerabilities.
These are devastating figures that demonstrate the need for schools and their safety to be a fundamental part of national budgetary preparations. 3 out of 5 students who did not go to school last year live in Latin America and the Caribbean.  This was emphasized during the Virtual Caribbean Safe School Initiative Pre-Ministerial Forum, held between the 15th to the 26th of last March, which was oriented towards the promotion of safety in Caribbean schools, and which is the regional mechanism for putting into practice a relationship between education and resilience.
The sixth session of the Pre-forum: School safety investment as a Key Element of Economic Recovery showed the importance of integrating into recuperation processes all the lessons learnt during this crisis.
“We should invest in gathering and use of information for observation and mapping of precise interventions, while at the same time modernizing our technological infrastructure, not only to be able to face disasters, but also in regards to contemporary realities,” stated Fayval Willams, Minister of Education, Youth, and Information of Jamaica.
According to João Pedro Azevedo, World Bank economist, the educational system must prepare its teachers to confront lower learning levels and higher inequality levels. That is to say, to prepare them for the consequences of the pandemic. “Vulnerable sectors have been those most affected by the closures during the pandemic since they have no access to the necessary technology,” added Cynthia Hobbs, an education specialist from the Interamerican Development Bank.
Andrew A. Fahie, Prime Minister of the British Virgin Islands, stated that reconstruction of the school system after the pandemic must consider technology. “Inaction cannot be an action,” he stated.
FUNDING PRIORITY
Kamal Ahmed, an international disaster risk finance consultant for the United Nations Office for Disaster Risk Reduction (UNDRR), elaborated further on the importance of investing in all aspects of school safety. “A school structure that collapses or closes interrupts nutritional programs, for example, which are a key element in social programs of many countries, and which at times are the only access to nutrition for many vulnerable children. In the case of the pandemic, if the child stays at home, and the father or mother must also stay, it reduces participation of that home in the labour market and therefore, their income,” stated Ahmed. “Investment in education produces amazing results, but also a lack of investment leaves surprising consequences.”
According to Ahmed, governments should develop a comprehensive evaluation of schools, identifying strengths and capacities, in addition to creating a matrix with safe and resilient school strategies, fragile and marginal school programs, and most vulnerable school projects. A plan must be created to compensate for learning losses.
From the financial point of view, added Ahmed, investment must be made in such a way as to reduce economic, social, environmental, physical, and lack of governance vulnerabilities. The Ministry of Education must be the priority in national budget preparation, with projections not only for costs but also for emergency funds.
Raúl Salazar, chief of UNDRR - Regional Office for the Americas and the Caribbean, stated that “loss of education increases gaps and inequality in the school system, and therefore social vulnerabilities. The disappearance of a large sector of the school population from the educational system will create significant effects on all social systems, including the economic systems.”    This clearly underlines the dimensions of systemic risk by its characteristics and requires us to confront them with a holistic and comprehensive vision.
Fahie, Prime Minister of the British Virgin Islands, specified that 20% of the 7% tax collection is applied to financial services for the improvement of schools structure. In this case, risk reduction forms a permanent part of state expenditures.
The Sendai Framework for Disaster Risk Reduction (2015-2030) is clear on this subject: “disaster risk reduction should be strengthened by providing adequate resources through various funding mechanisms, including increased, timely, stable and predictable contributions to the United Nations Trust Fund for Disaster Reduction and by enhancing the role of the Trust Fund in relation to the implementation of the present Framework”.
The world initiative for Safe Schools was accepted by the States during the signing of the Sendai Framework, which has been in effect for six years as of the 18th of March.
“In order to go forward, we must do it together, in a comprehensive way, with inter-institutional and inter-sectorial effort that would employ the disaster management abilities of various sectors which will put in motion well developed plans and strategies, financed and coherent with other large agencies, such as the Sustainable Development Objectives, and the Paris Agreement,” stated Mami Mizutori, the Special Representative of the Secretary General for Disaster Risk Reduction, during the opening day of the Pre-Ministerial Forum.

Security updates released for Microsoft Exchange Servers

The National Cyber Security Centre (NCSC) is encouraging organisations to install critical updates following a number of vulnerabilities being addressed in Microsoft Exchange.
As part of Microsoft's scheduled April update cycle, a number of critical severity vulnerabilities were addressed in Microsoft Exchange. We have no information to suggest that these vulnerabilities are being used in active exploitation. However, given the recent focus on Exchange, we recommend the installation of updates as soon as practicable, as attackers may seek to build exploit capability which could be used against systems before the updates are applied.
The vulnerabilities affect Microsoft Exchange Server. The affected versions are:
- Exchange Server 2013
- Exchange Server 2016
- Exchange Server 2019
Organisations running an out-of-support version of Microsoft Exchange should update to a supported version without delay.
Exchange Online customers are already protected.
Recommendation
The NCSC recommends following vendor best practice advice in the mitigation of vulnerabilities. In this case, the most important aspect is to install the latest security updates immediately. The April 2021 security update fixes a number of security vulnerabilities and more information can be found on Microsoft's website.

Report First 3 months of 2021 brought billion-dollar disaster, warm start to spring for U.S.

Since January, conditions across the U.S. have been running warmer and wetter than normal. The nation also recorded its first billion-dollar weather and climate disaster of 2021 — the deadly deep freeze that enveloped much of the central U.S. in February — and two tornado outbreaks in late March.
The month of March turned out a bit warmer and drier than average, according to NOAA’s National Centers for Environmental Information.
Here are more highlights from NOAA’s latest monthly U.S. climate report:
Climate by the numbers
Year to date | Billion-Dollar Disasters
The average U.S. temperature for the year to date (January through March) was 36.9 degrees F (1.8 degrees above average), which ranked in the warmest third of the record.
The contiguous U.S. also kicked off the year a little on the wet side, with a year-to-date average rainfall of 6.55 inches — 0.41 of an inch above average.
Most notable, the U.S. saw its first billion-dollar disaster of 2021 that had a devastating death toll: At least 125 people died as a direct or indirect result of a mid-February blanket of arctic weather that dropped temperatures to historic lows across the central United States. Texas experienced the majority of the property and infrastructure losses that were incurred by more than a dozen states. The preliminary total damage estimate for this extreme event — in excess of $10 billion — makes it the most costly winter weather disaster on record for the U.S., surpassing the so-called “Storm of the Century” that struck the Gulf Coast all the way up to Maine in 1993.
March 2021
The average monthly temperature across the contiguous U.S. was 45.5 degrees F (4.0 degrees above the 20th-century average) and ranked in the warmest third of the climate record.
Above-average temperatures were observed across much of the country, from the Northwest to the Northeast, as well as from the Great Lakes to the Gulf of Mexico. North Dakota, for example, had its fourth-warmest March on record.
The average precipitation in the contiguous U.S. last month was 2.45 inches (0.06 of an inch below average), ranking in the middle third of the climate record.
Below-average precipitation fell across the Northwest, northern Plains, and Northeast, as well as portions of the Southeast, Deep South and West. Both Montana and North Dakota saw their second-driest March in 127 years.
More notable climate events in March
Deadly tornado outbreaks: In March, two rounds of deadly severe weather and tornadoes raked the U.S. South. More than 100 tornadoes were reported during the two outbreaks (March 17-18 and March 25-27). One particularly violent EF3-tornado struck Calhoun County, Alabama, on March 25 and caused five deaths.
A chilly, wintry month for Alaska: The state shivered through its coldest March in four years. The average March temperature for Alaska was 7.2 degrees F, 3.6 degrees below the long-term average. The capital city of Juneau reported its snowiest March since 2007.
Drought improved slightly: By the end of March, the U.S. Drought Monitoroffsite link reported that nearly 44% of the contiguous U.S. was in drought, down from 46.6% at the beginning of the month. Drought improved across parts of the central Rockies, central Plains, Puerto Rico and Hawaii.

Guidelines for Cybersecurity in Hospitals: New Online tool

The new tool helps healthcare organisations identify best practices in order to meet cybersecurity needs when procuring products or services.
To facilitate the use of the Procurement Guidelines for Cybersecurity in Hospitals published in 2020, ENISA releases an online tool today to support the healthcare sector in identifying procurement good practices to meet cybersecurity objectives when procuring products or services.
In addition, the Agency also publishes a concise version of the procurement guidelines dedicated to the sector in each of the 24 EU official languages.
Cybersecurity in Healthcare: why does it matter?
The COVID-19 pandemic demonstrated the value of eHealth services such as telemedicine and remote patient care.
Since it has become increasingly digital and interconnected, the healthcare sector needs to consider cybersecurity as an enabler and as a key factor for ensuring the resilience and availability of key healthcare services.
Cybersecurity needs to be envisaged throughout the procurement lifecycle. IT departments should be involved in procurement activities as the cybersecurity implications in the procurement of any product or service should be well understood and consistently addressed by healthcare organisations.
EU Agency for Cybersecurity Executive Director, Juhan Lepassaar, declared: “Securing eHealth today means ensuring the resilience of the EU’s life support system, the healthcare sector. ENISA is committed to shape the ICT environment needed to prevent cybersecurity incidents and attacks on our healthcare sector.”
Procurement Guidelines and online tool: What for?
The online tool was developed as a complement to the procurement guidelines for cybersecurity in hospitals. Its purpose is:
- To help healthcare organisations to quickly identify the guidelines that are most relevant to their procurement context such as assets procured or related threats;
- To promote the importance of a good procurement process to ensure appropriate security measures.
To facilitate the dissemination of good practices across all healthcare organisations across the EU, a concise version of the procurement guidelines is now made available in the 22 official EU languages and the full version is available in english and spanish languages.
The report on procurement guidelines has already generated a significant interest in the healthcare cybersecurity community.
Stakeholders in the sector, including members of the eHealth Security Experts Group suggested the idea of an interactive format of the guidelines making it possible to customise searches and help decision making through informed procurement.
The guidelines were translated in order to allow health organisations across Member States to directly access the content in their own language.
Who is it meant for?
- Procurement officers of healthcare organisations;
- Healthcare professionals with technical positions or in charge of IT systems and equipment;
- Chief level executives such as CIO, CISO, CTO;
- The EU citizens involved in or seeking to develop knowledge and awareness on such processes.

European Space Agency signs Memorandum of Intent with Public Safety Communication Europe

Public Safety Communication Europe (PSCE) and the European Space Agency (ESA) have signed a Memorandum of Intent (MoI) to support the utilisation of satellite applications for Public Safety.
ESA and PSCE will work together under the new MoI towards establishing interoperable public safety communications systems.
The MoI will support the emergence of space-based applications in the Public Safety domain such as public safety services relying on secure mobile broadband communication solutions. These include applications within disaster preparedness, response and resilience, situational awareness, assessments of damages, navigation-based services for tracking and coordinating rescue forces on-site and for emergency vehicles.
"ESA Space Solutions and the 4S Strategic Programme Line will support through this agreement the emergence of solutions making use of secure satellite communications for institutional Public Safety user communities. This can be achieved as of today through existing satellite telecommunications infrastructures. In the future it will be possible to make use of new and innovative infrastructures with enhanced capabilities. Early pilots and demonstrations will showcase the unique benefits granted by satellites to the user communities and early adopters", says Rita Rinaldo, ESA
"The cooperation with ESA will help to explore complementary solutions that will contribute to cover capability gaps and needs for public safety. It is of extreme importance to improve public safety communication systems with cutting-edge and rapidly deployable solutions that will facilitate PPDR missions", explains Marie-Christine Bonnamour, PSCE.
The cooperation between ESA and PSCE will be activated as a first step through PSCE participation in the ongoing user studies on "Satellite Applications for Public Safety".
PSCE will contribute to the identification of the needs of public safety stakeholders such as emergency services, fire brigades and law enforcement.

Building Trust in the Digital Era: ENISA boosts the uptake of the eIDAS regulation

The European Union Agency for Cybersecurity issues technical guidance and recommendations on Electronic Identification and Trust Services helping Member States to implement the eIDAS regulation.
The European Union Agency for Cybersecurity (ENISA) completed a package of five reports in order to boost the implementation of the eIDAS regulation and promote the uptake of Electronic Identification and Trust Services. This work falls under the scope of the EU Cybersecurity strategy for the Digital Decade.
ENISA has been in the forefront of the developments on eIDAS since 2013 and with the Cybersecurity Act, established in 2019, the Agency has an extended mandate to support and assist the European Commission and the Member States in the area of electronic identification.
In this challenging period, the “EU digital ID scheme for online transactions across Europe” initiative will drive the revision of the eIDAS and will promote digital identities for all Europeans. ENISA in order to support the Commission has undertaken activities to explore the security considerations for trust service providers and remote identity proofing.
Four of the reports on trust services form an update of ENISA’s guidelines for qualified trust service providers. They represent a voluntary toolset designed to help those trust service providers comply with eIDAS. Specifically, they include:
- technical guidance on the security framework for Qualified Trust Service Providers (QTSP) and for the non-Qualified ones;
- security recommendations for Qualified Trust Service Providers based on Standards;
- guidelines on Conformity Assessment of Trust Service Providers.
A fifth report includes an analysis of the methods used to carry out identity proofing remotely and exploring security considerations. Remote identification allows customers to have their identification information collected and validated without the need for physical presence to the premises of the operator. This has become crucial during the COVID-19 pandemic as it allows access to cross-border online services offered by Member States.
Technical Guidelines on Trust Services
ENISA issued the reports in order to update existing recommendations and guidelines issued in 2017 for qualified trust services. The purpose of these reports is therefore to focus on the requirements set by the eIDAS regulation and the emergence of new standards and new TSP services.
The new guidelines are presented in four different reports according to the following topics:
- trust service providers (qualified or not) looking for guidance on how to meet the requirements of the eIDAS Regulation;
- service providers seeking to clarify whether they qualify as a trust service provider according to the provisions under the eIDAS regulation;
- relying parties seeking to evaluate to what extent their trust service provider complies with the eIDAS requirements.
As a result, the set of recommendations include:
- Security Framework for Qualified Trust Service Providers and for Non-Qualified Trust Service Providers. These guidelines consider the greater potential variety encountered in non-qualified trust service providers;
- Security Recommendations for Qualified Trust Service Providers based on Standards, and Guidelines on Conformity Assessment of Trust Service Providers.
These guidelines have been consulted with and validated by experts in the eIDAS field from various sectors.

ITU Handbook update: Wireless guidelines to support intelligent transport

As the world’s population approaches 8 billion, with more and more people migrating to ever-expanding cities, life and work are also becoming increasingly mobile.
But while these long-term trends can boost quality of life and create new communities, they also bring unprecedented traffic congestion, air pollution, and road safety challenges.
Managing these negative impacts calls for new levels of intelligence and responsiveness in the world’s transport systems.
Since most of us rely on some form of transport in our everyday lives, a tremendous number of people stand to benefit from smarter mobility.
What are ITS?
Intelligent transport systems (ITS) combine computers, communications, positioning, and automation technologies to improve the safety, management, and efficiency of terrestrial transportation.
Systems using wireless communications, sensors, and computer and control technologies are well placed to ease traffic congestion and reduce incidents. Communication standards ensure interoperability and make ITS easy for anyone to use.
Land Mobile Handbook updated
Growing ITS use increases the need for well-informed digital infrastructure planning, especially in relation to wireless-based land mobile systems. To strengthen decision-making in this area, the International Telecommunication Union (ITU) has published an updated volume of a key reference guide, the Handbook on Land Mobile (including Wireless Access), whose fourth volume deals with ITS.
The Handbook is designed to assist in training engineers and planners in regulating, planning, engineering, and deploying these systems, especially in developing countries.
The new Volume 4 replaces the 2006 edition. Development of the multi-volume Handbook began in the late 1990s, aiming to help developing countries build state-of-the-art land mobile services of all kinds.
The five volumes published to date are:
• Volume 1: Fixed Wireless Access
• Volume 2: Principles and Approaches on Evolution to IMT-2000
• Volume 3: Dispatch and Advanced Messaging Systems
• Volume 4: Intelligent Transport Systems
• Volume 5: Deployment of Broadband Wireless Access Systems
Volume 4 summarizes the current and developing use of wireless communications in ITS around the globe, including ITS architecture and applications. Despite rapid uptake, ITS remains in its infancy as a technology.
The new volume gives an overview of wireless communications used in ITS globally by 2020.
It also includes chapters on ITS applications, ITS communication architecture, radio technologies for ITS, and international and national standardization. The final chapter describes radio frequency usage for ITS systems.
1 24 25 26 27 28 37