Category: Agency News

Mitigating the Impacts of Doxing on Critical Infrastructure

Agency News, Cyber Security CII sector, Industry News
CISA has produced an insight designed to help mitigate the impact of doxing: Mitigating the Impacts of Doxing on Critical Infrastructure:
WHAT IS DOXING?
Doxing refers to the internet-based practice of gathering an individual’s personally identifiable information (PII)—or an organization’s sensitive information— from open source or compromised material and publishing it online for malicious purposes. Although doxing can be carried out by anyone with the ability to query and combine publicly available information, it is often attributed to state actors, hacktivists, and extremists.
Doxers compile sensitive information from compromises of personal and professional accounts and a wide range of publicly available data sources to craft invasive profiles of targets, which are then published online with the intent to harm, harass, or intimidate victims.
POTENTIAL IMPACT TO CRITICAL INFRASTRUCTURE
Like many other businesses, critical infrastructure organizations maintain digital databases of PII and organizationally sensitive information, making them ripe targets for doxing attacks. Threat actors may target critical infrastructure organizations and personnel with doxing attacks as a result of grievances related to organizational activities or policies. Incidents of doxing that target personnel and facilities often serve to harass, intimidate, or inflict financial damages, and can potentially escalate to physical violence.
Doxing also poses a threat to senior leadership of critical infrastructure organizations, who may be targeted due to their elevated position with the organization or stance on a particular issue. Doxing attacks targeting senior leaders often serve as “reputation attacks” and could lead to activities seeking to embarrass, harass, or undermine confidence in an official.
Leave a comment , , , ,

CISA Launches Space Systems Critical Infrastructure Working Group

Agency News, Industry News, Space Sector

The Cybersecurity and Infrastructure Security Agency (CISA) announced the formation of a Space Systems Critical Infrastructure Working Group, a mix of government and industry members that will identify and develop strategies to minimize risks to space systems that support the nation’s critical infrastructure. The Working Group will operate under the Critical Infrastructure Partnership Advisory Council (CIPAC) framework, bringing together space system critical infrastructure stakeholders.

The critical infrastructure on which the United States depends relies on space systems. Increasing the security and resilience of space systems is essential to supporting the American people, economy, and homeland security.

“Secure and resilient space-based assets are critical to our economy, prosperity, and our national security,” said CISA Acting Director Brandon Wales. “This cross sector working group will lay the foundation for our collective defense against the threats we face today and in the future.”

This working group will serve as an important mechanism to improve the security and resilience of commercial space systems. It will identify and offer solutions to areas that need improvement in both the government and private sectors and will develop recommendations to effectively manage risk to space based assets and critical functions.

The working group is co-chaired by Jim Platt, Chief, Strategic Defense Initiatives, CISA and John Galer, Assistant Vice President, National Security Space, Aerospace Industries Association. Current members represent government and industry organizations from the communications, critical manufacturing, defense industrial base, information technology, and transportation sectors, including leading-edge satellite and space asset infrastructure firms with expertise in emerging technology areas.

Leave a comment , ,

CISA releases new 5G paper with NSAcyber and ODNIgov: Potential Threat Vectors to 5G Infrastructure

Agency News, Cyber Security CII sector, Industry News
Securing Critical Infrastructure operations means ensuring cybersecurity practices are incorporated within 5G.
The deployment of 5G has begun, and with it, a wealth of benefits that has the potential to impact every aspect of our lives and work. With faster connectivity, ultra-low latency, greater network capacity, 5G will redefine the operations of critical infrastructure activities from the plant floor to the cloud. It will enable large-scale connections, capabilities, and services that can pave the way for smart cities, remote surgery, autonomous vehicles, and other emergent technologies. However, these capabilities also make 5G networks an attractive target for criminals and foreign adversaries to exploit for valuable information and intelligence and even global disruption.
To secure the full scope of 5G use cases, it is critical that strong cybersecurity practices are incorporated within the design and development of 5G technology. In March 2020, the White House developed the National Strategy to Secure 5G, which outlines how the Nation will safeguard 5G infrastructure domestically and abroad. The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency, and the Office of the Director of National Intelligence, as part of the Enduring Security Framework (ESF)—a cross-sector, public-private working group—initiated an assessment of the cybersecurity and vulnerabilities to 5G infrastructure. The ESF established the 5G Threat Model Working Panel which developed this paper, Potential Threat Vectors to 5G Infrastructure, to enhance understanding of the threats posed to 5G adoption.
The Working Panel reviewed existing bodies of public and private research and analysis to identify and generate an aggregated list of known and potential threats to the 5G environment. From that list, they identified three primary threat vectors areas—Policy and Standards, Supply Chain, and 5G Systems Architecture—and within these threat vectors, 11 sub-threats were identified as additional points of vulnerability for threat actors to exploit (i.e., open standards, counterfeit parts, and multi-access edge computing). This paper represents the beginning of the Working Panel’s thinking on the types of risks introduced by 5G adoption in the Unites States, and not the culmination of it.
With the promise of connectivity between billions of Internet of Things (IoT) devices, it is critical that government and industry collaborate to ensure that cybersecurity is prioritized within the design and development of 5G technology.
https://www.cisa.gov/publication/5g-potential-threat-vectors
Leave a comment , , , , ,

US and UK agencies release cybersecurity advisory on recently modified tactics by Russian intelligence agency

Agency News, Cyber Security CII sector, Industry News
The FBI, National Security Agency and Cybersecurity and Infrastructure Security Agency collaborated with the United Kingdom's National Cyber Security Centre to release a Joint Cybersecurity Advisory examining tactics, techniques, and procedures associated with Russian Foreign Intelligence Service (SVR). The advisory provides additional insights on SVR activity including exploitation activity following the SolarWinds Orion supply chain compromise.
CISA released a related document, Fact Sheet: Russian SVR Activities Related to SolarWinds Compromise, that summarizes three joint publications focused on SVR activities related to the SolarWinds Orion compromise.
SVR cyber operators appear to have reacted to prior reporting by changing their TTPs in an attempt to avoid further detection and remediation efforts by network defenders.
Leave a comment , , , ,

Natural hazard triggered industrial accidents: Are they Black Swans?

Agency News, Industry News, Power/Energy/Oil & Gas sector
A recently published JRC study examines whether technological accidents caused by natural hazards (Natech accidents) are real “Blacks Swans” (unpredictable and hence unpreventable events), identifies their possible causes and discusses effective strategies to manage extreme risks.
The study concludes that the Black Swan metaphor is overused for technological accidents in general and Natech accidents in particular, whose recurrence raises questions about the effectiveness of corporate oversight and the application of state-of-the-art knowledge in managing risks.
What are Natech accidents?
Natech accidents occur when the natural and technological worlds collide, wherever hazardous industry is located in areas prone to natural hazards. Past Natech accidents have often had significant impacts on public health, the natural and built environment, and the local, national or even global economy.
Major technological accidents considered unpreventable are occasionally called Black Swan events. Three features characterize a Black Swan:
- it must be an outlier with respect to normal expectations, making it unpredictable;
- it has to have a major impact;
- it can be explained in hindsight, making it appear predictable.
Inadequate risk management and organisational risk blindness
A closer look at past Natech accidents shows that the vast majority of these events, if not all, could have been foreseen and prevented using available information and knowledge prior to the disaster. They can therefore not be considered inevitable or Black Swans.
The JRC study provides a detailed analysis of the reasons for why Natech risks are often underestimated:
- Risk management traditions and the Act-of-God mindset - The focus for managing natural risks has traditionally been on the response side and hence on disaster management, rather than on prevention and risk management, whereas the technological-risk community has always focused on risk- rather than disaster management. Natech risk is sandwiched between these two worlds, and neither community feels very much at ease with taking ownership of the risk;
- Complexity of Natech risk scenarios - Natech risk analysis would need extensions to traditional risk-analysis methodologies in order to cover the multi-hazard nature of the risk and the multitude of possible simultaneous scenarios;
- Risk governance and risk management problems due to the multi-stakeholder and multi-hazard nature of Natech risks, and the multitude of possibly conflicting issues that are usually on a manager’s radar screen;
- Socio-economic context, including group interests and power, economic pressure, and public or media indifference; and
- Human fallacies and cognitive biases that can corrupt the experiences we draw on for estimating risks.
Managing extreme risks
Building organisational resilience is key to managing risks effectively, in particular in high-risk industry. The JRC study discusses possible strategies to reduce extreme risks, prepare better for their consequences, and make Black Swans more accessible:
- Risk-based versus precaution-based strategies
- Disaster incubation theory and warning signals
- Mindfulness
- Resilience engineering
- Scenario planning
- Red teaming
While the JRC study is centered on Natech risks, it is generally applicable to managing also other types of extreme or low-probability risks.
Leave a comment , , ,

NSA releases Cybersecurity Advisory on Ensuring Security of Operational Technology

Agency News, Cyber Security CII sector, Industry News
The National Security Agency (NSA) released the Cybersecurity Advisory, “Stop Malicious Cyber Activity Against Connected Operational Technology” today, for National Security System (NSS), Department of Defense (DoD), and Defense Industrial Base (DIB) operational technology (OT) owners and operators. The CSA details how to evaluate risks to systems and improve the security of connections between OT and enterprise networks. Information technology (IT) exploitation can serve as a pivot point for OT exploitation, so carefully evaluating the risk of connectivity between IT and OT systems is necessary to ensure unique cybersecurity requirements are met.
Each IT-OT connection increases the potential attack surface. To prevent dangerous results from OT exploitation, OT operators and IT system administrators should ensure only the most imperative IT-OT connections are allowed, and that these are hardened to the greatest extent possible. An example of this type of threat includes recent adversarial exploitation of IT management software and its supply chain in the SolarWinds compromise with publicly documented impacts to OT, including U.S. critical infrastructure.
This guidance provides a pragmatic evaluation methodology to assess how to best improve OT and control system cybersecurity for mission success, to include understanding necessary resources for secure systems:
- First, NSA encourages NSS, DoD, and DIB system owners, operators, and administrators to evaluate the value against risk and costs for enterprise IT to OT connectivity. While the safest OT system is one that is not connected to an IT network, mission critical connectivity may be required at times. Review the connections and disconnect those that are not truly needed to reduce the risk to OT systems and functions.
- Next, NSA recommends taking steps to improve cybersecurity for OT networks when IT-OT connectivity is mission critical, as appropriate to their unique needs. For IT-OT connections deemed necessary, steps should be taken to mitigate risks of IT-OT exploitation pathways. These mitigations include fully managing all IT-OT connections, limiting access, actively monitoring and logging all access attempts, and cryptographically protecting remote access vectors.
Operational technology includes hardware and software that drives the operations of a given infrastructure environment, from an engine control unit in a modern vehicle to nationwide train transportation networks.
Every IT-OT connection creates an additional vector for potential OT exploitation that could impact and compromise mission and/or production. Performing a comprehensive risk analysis for all IT-OT interconnections and only allowing mission critical interconnections when they are properly protected will create an improved cybersecurity posture. By employing an appropriate risk analysis strategy, leadership and system owners and operators can make informed decisions to better manage OT networks while reducing the threats from and impact of exploitation and destructive cyber effects.
Leave a comment , , ,

Governments call for more public and private investment in disaster prevention and risk reduction

Agency News, Health & Social Care, Industry News
Member States gathered virtually to adopt the Outcome Document of the 2021 Economic and Social Council (ECOSOC) Forum on Financing for Development. This year’s outcome document provides indispensable intergovernmental policy guidance to countries on financing for disaster risk reduction and risk-informed investing.
For the first time at the ECOSOC Forum on Financing for Development, Governments recognise the systemic nature of risk and the need to strengthen the understanding of risk in economic and financial planning across all sectors and at all levels. There is a clear call to redress the balance from investing in response towards investing in prevention and risk reduction. Risk-sensitive public investment planning; the consideration of risk in land use planning; risk-sharing mechanisms that create an enabling environment for public-private partnerships; and diagnostics for infrastructure investments that include resilience and climate change adaptation are some of the policy options identified to accelerate financing for disaster risk reduction.
To support these efforts, national and regional development banks and international financial institutions are invited to integrate disaster risk reduction and resilience into COVID-19 economic recovery strategies. The outcome document also breaks new ground in recognizing the need to strengthen the resilience of the financial system through systematically integrating climate, environmental and disaster risks into global risk monitoring to inform future decision making.
Application of this intergovernmental policy guidance at national level will undoubtedly bring significant benefit to the implementation of national and disaster risk reduction strategies. It can also support coherence between financing for disaster risk reduction and climate change adaptation and ensure that the financing for the Sustainable Development Goals and COVID-19 socioeconomic recovery strategies build resilience and reduce the risk of future disasters.
Deliberations at the Forum, which ran from 12 to 15 April, were guided by the 2021 Financing for Sustainable Development Report. This year’s report includes a dedicated chapter that provides guidance to ministries of finance and planning to integrate disaster risk reduction into their policy decisions. During the forum, UNDRR, in partnership with UNDESA and the Co-Chairs of the Group of Friends for Disaster Risk Reduction, organized a side event titled “Financing for Disaster Risk Reduction and a Risk-Informed Approach to Investing Across the SDGs”. The event brought together a variety of development finance practitioners from government and the private sector to discuss the comprehensive approach needed to finance disaster risk reduction and capitalize on public sector policy-setting and private sector innovation.
In her opening remarks, Ms. Mami Mizutori, Special Representative of the Secretary-General for Disaster Risk Reduction, stated that “the current approach to funding disaster risk reduction is not keeping pace with the exponential rise of disaster risk” and called for “a paradigm shift in political attitudes towards financing for disaster risk reduction especially in places that are largely unprotected from the ravages of the climate emergency and the threat of biological hazards”. Mr. Shaun Tarbuk, Chief Executive of the International Cooperative and Mutual Insurance Federation, announced an upcoming report with UNDRR titled “From protection to prevention: the role of cooperative and mutual insurance in disaster risk reduction”.
Leave a comment ,

Exploring Research Directions in Cybersecurity

Agency News, Cyber Security CII sector, Industry News
ENISA, the European Union Agency for Cybersecurity, has identified key research directions and innovation topics in cybersecurity to support the efforts of the EU towards a Digital Strategic Autonomy.
Resilience, technological sovereignty and leadership are essential for the EU and as such, they are addressed by the new EU Cybersecurity Strategy. In an effort to support this cybersecurity strategy, the European Union Agency for Cybersecurity releases today a report intended to look into digital strategic autonomy in the EU and suggests future research directions.
What is Digital Strategic Autonomy?
Digital strategic autonomy can be defined as the ability of Europe to source products and services designed to meet the EU’s specific needs and values, while avoiding being subject to the influence of the outside world. In the digital world, such needs may encompass hardware, software or algorithms, manufactured as products and/or services, which should comply with the EU values, and thus preserve a fair digital ecosystem while respecting privacy and digital rights.
To ensure the sourcing of such products and/or services complies with the EU’s needs and values, the EU has the option to self-produce them autonomously, or in the case where products and services are acquired from third countries, to certify them and validate their compliance.
However, in cases where there is a high dependence on sourcing, the EU should still be capable of operating its digital infrastructures without giving rise to any possible detrimental influence. Hence, Europe needs to maintain the capability to produce its critical products and services independently.
In short, digital strategic autonomy means the capacity for the EU to remain autonomous in specific areas of society where digital technologies are used.
Why such a move?
The new challenges brought about by the digitalisation of our environment raise questions on our capacity to retain ownership and control of our personal data, of our technological assets and of our political stand. Such are the main dimensions to be considered under the idea of digital strategic autonomy.
Furthermore, the COVID-19 pandemic highlighted the importance of cybersecurity and the need for the EU to continue to invest in research & development in the digital sector. Within this context, ENISA’s report sets and prioritises the key research and innovation directions in cybersecurity.
Key Research Directions: which are they?
The report identifies the following seven key research areas:
- Data security;
- Trustworthy software platforms;
- Cyber threat management and response;
- Trustworthy hardware platforms;
- Cryptography;
- User-centric security practices and tools;
- Digital communication security.
For each of these areas, the report introduces the current state-of-play in the EU, includes an assessment of current and expected issues. The analyses included serve the purpose of issuing recommendations on cybersecurity related research topics. Such recommendations intend to highlight the bases needed to bolster the EU’s digital autonomy.
Leave a comment , ,

UNDRR ROAMC: Investment in education creates more resilient societies

Agency News, Industry News, University/Research/Academia sector
Investments in safe schools provide economic returns for society and also contribute to economic recovery, according to the latest evidence. They represent a clear way to finance risk reduction initiatives in the education sector and are a direct contribution to the creation of more resilient societies.
The suspension of classes for more than a year, due to the pandemic, has not been duly dimensioned.  Until now. Education may well be one of the most affected sectors by the COVID-19 crisis. According to different analyses, students affected by school closures will obtain 3% less income during their professional lives, which will mean an approximate GDP loss of 1.5% over the remainder of the century. The pandemic will also increase school desertion and will have a profound effect on learning processes for an entire generation, without taking into account systemic effects from school closures, such as increased malnutrition, mental health effects, and other vulnerabilities.
These are devastating figures that demonstrate the need for schools and their safety to be a fundamental part of national budgetary preparations. 3 out of 5 students who did not go to school last year live in Latin America and the Caribbean.  This was emphasized during the Virtual Caribbean Safe School Initiative Pre-Ministerial Forum, held between the 15th to the 26th of last March, which was oriented towards the promotion of safety in Caribbean schools, and which is the regional mechanism for putting into practice a relationship between education and resilience.
The sixth session of the Pre-forum: School safety investment as a Key Element of Economic Recovery showed the importance of integrating into recuperation processes all the lessons learnt during this crisis.
“We should invest in gathering and use of information for observation and mapping of precise interventions, while at the same time modernizing our technological infrastructure, not only to be able to face disasters, but also in regards to contemporary realities,” stated Fayval Willams, Minister of Education, Youth, and Information of Jamaica.
According to João Pedro Azevedo, World Bank economist, the educational system must prepare its teachers to confront lower learning levels and higher inequality levels. That is to say, to prepare them for the consequences of the pandemic. “Vulnerable sectors have been those most affected by the closures during the pandemic since they have no access to the necessary technology,” added Cynthia Hobbs, an education specialist from the Interamerican Development Bank.
Andrew A. Fahie, Prime Minister of the British Virgin Islands, stated that reconstruction of the school system after the pandemic must consider technology. “Inaction cannot be an action,” he stated.
FUNDING PRIORITY
Kamal Ahmed, an international disaster risk finance consultant for the United Nations Office for Disaster Risk Reduction (UNDRR), elaborated further on the importance of investing in all aspects of school safety. “A school structure that collapses or closes interrupts nutritional programs, for example, which are a key element in social programs of many countries, and which at times are the only access to nutrition for many vulnerable children. In the case of the pandemic, if the child stays at home, and the father or mother must also stay, it reduces participation of that home in the labour market and therefore, their income,” stated Ahmed. “Investment in education produces amazing results, but also a lack of investment leaves surprising consequences.”
According to Ahmed, governments should develop a comprehensive evaluation of schools, identifying strengths and capacities, in addition to creating a matrix with safe and resilient school strategies, fragile and marginal school programs, and most vulnerable school projects. A plan must be created to compensate for learning losses.
From the financial point of view, added Ahmed, investment must be made in such a way as to reduce economic, social, environmental, physical, and lack of governance vulnerabilities. The Ministry of Education must be the priority in national budget preparation, with projections not only for costs but also for emergency funds.
Raúl Salazar, chief of UNDRR - Regional Office for the Americas and the Caribbean, stated that “loss of education increases gaps and inequality in the school system, and therefore social vulnerabilities. The disappearance of a large sector of the school population from the educational system will create significant effects on all social systems, including the economic systems.”    This clearly underlines the dimensions of systemic risk by its characteristics and requires us to confront them with a holistic and comprehensive vision.
Fahie, Prime Minister of the British Virgin Islands, specified that 20% of the 7% tax collection is applied to financial services for the improvement of schools structure. In this case, risk reduction forms a permanent part of state expenditures.
The Sendai Framework for Disaster Risk Reduction (2015-2030) is clear on this subject: “disaster risk reduction should be strengthened by providing adequate resources through various funding mechanisms, including increased, timely, stable and predictable contributions to the United Nations Trust Fund for Disaster Reduction and by enhancing the role of the Trust Fund in relation to the implementation of the present Framework”.
The world initiative for Safe Schools was accepted by the States during the signing of the Sendai Framework, which has been in effect for six years as of the 18th of March.
“In order to go forward, we must do it together, in a comprehensive way, with inter-institutional and inter-sectorial effort that would employ the disaster management abilities of various sectors which will put in motion well developed plans and strategies, financed and coherent with other large agencies, such as the Sustainable Development Objectives, and the Paris Agreement,” stated Mami Mizutori, the Special Representative of the Secretary General for Disaster Risk Reduction, during the opening day of the Pre-Ministerial Forum.
Leave a comment , ,

Security updates released for Microsoft Exchange Servers

Agency News, Cyber Security CII sector, Industry News
The National Cyber Security Centre (NCSC) is encouraging organisations to install critical updates following a number of vulnerabilities being addressed in Microsoft Exchange.
As part of Microsoft's scheduled April update cycle, a number of critical severity vulnerabilities were addressed in Microsoft Exchange. We have no information to suggest that these vulnerabilities are being used in active exploitation. However, given the recent focus on Exchange, we recommend the installation of updates as soon as practicable, as attackers may seek to build exploit capability which could be used against systems before the updates are applied.
The vulnerabilities affect Microsoft Exchange Server. The affected versions are:
- Exchange Server 2013
- Exchange Server 2016
- Exchange Server 2019
Organisations running an out-of-support version of Microsoft Exchange should update to a supported version without delay.
Exchange Online customers are already protected.
Recommendation
The NCSC recommends following vendor best practice advice in the mitigation of vulnerabilities. In this case, the most important aspect is to install the latest security updates immediately. The April 2021 security update fixes a number of security vulnerabilities and more information can be found on Microsoft's website.
Leave a comment , , ,
1 … 30 31 32 33 34 … 44