DHS S&T Announces $36.5M Funding Opportunity for New Center of Excellence

The Department of Homeland Security (DHS) Science and Technology Directorate (S&T) announced a $36.5 million funding opportunity for a new DHS Center of Excellence (COE), Engineering Secure Environments from Targeted Attacks (ESE).
“Partnering with universities, S&T delivers practical results by developing multidisciplinary, customer-driven solutions while training the next generation of homeland security experts,” said William Bryan, Acting Under Secretary for Science and Technology. “The challenges we face as a nation are complex. In collaboration with our academic partners, DHS is excited to launch a new COE focused on mitigating long-term threats against our nation’s surface transportation and built environments with novel engineering solutions.”
DHS plans to fund the new COE through a cooperative agreement for 10 years for a total of approximately $36.5 million.
The ESE COE will research and develop solutions to support DHS counterterrorism and violent extremism operations. The COE will help DHS continue fostering a culture of “security by design” by providing intentional and flexible architecture solutions to thwart an adaptive adversary. ESE will also advance a skilled workforce of scientists, technologists, engineers and mathematicians who focus on homeland security-related issues.
Technological advancements and their applications are increasingly complex and integrated into everyday processes. As cities grow larger and density increases across people, buildings, and infrastructure, a potential increase in the frequency or severity of targeted attacks from foreign and domestic terrorism is a legitimate concern. ESE will provide academic-led innovation that supports safer, more resilient transportation systems and communities.
DHS is soliciting proposals from multidisciplinary research and education teams, that will work closely with DHS and other subject-matter experts to develop approaches to strengthen the security of crowded spaces and transportation modalities. The teams will need various combinations of academic disciplines, including engineering, data analytics, and mathematics.
The DHS COEs work closely with DHS operating components to research, develop, and transition mission-relevant science and technology, and educate the next generation of homeland security technical experts. ESE will be required to engage with DHS operational components and fully understand the operational environment to help better identify technical and training gaps. Each DHS COE is led by a U.S. college or university and partners with other federally funded research and development centers, academic institutions, the commercial industry, and other federal, state, and local agencies.

World’s most dangerous malware EMOTET disrupted through global action

Law enforcement and judicial authorities worldwide have this week disrupted one of the most significant botnets of the past decade: EMOTET. Investigators have now taken control of its infrastructure in an international coordinated action.
This operation is the result of a collaborative effort between authorities in the Netherlands, Germany, the United States, the United Kingdom, France, Lithuania, Canada and Ukraine, with international activity coordinated by Europol and Eurojust. This operation was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).
EMOTET has been one of the professional and long lasting cybercrime services out there. First discovered as a banking Trojan in 2014, the malware evolved into the go-to solution for cybercriminals over the years. The EMOTET infrastructure essentially acted as a primary door opener for computer systems on a global scale. Once this unauthorised access was established, these were sold to other top level criminal groups to deploy further illicit activities such as data theft and extortion through ransomware.
Spread via Word documents
The EMOTET group managed to take email as an attack vector to a next level. Through a fully automated process, EMOTET malware was delivered to the victims’ computers via infected e-mail attachments. A variety of different lures were used to trick unsuspecting users into opening these malicious attachments. In the past, EMOTET email campaigns have also been presented as invoices, shipping notices and information about COVID-19.
All these emails contained malicious Word documents, either attached to the email itself or downloadable by clicking on a link within the email. Once a user opened one of these documents, they could be prompted to “enable macros” so that the malicious code hidden in the Word file could run and install EMOTET malware on a victim’s computer.
Attacks for hire
EMOTET was much more than just a malware. What made EMOTET so dangerous is that the malware was offered for hire to other cybercriminals to install other types of malware, such as banking Trojans or ransomwares, onto a victim’s computer.
This type of attack is called a ‘loader’ operation, and EMOTET is said to be one of the biggest players in the cybercrime world as other malware operators like TrickBot and Ryuk have benefited from it.
Its unique way of infecting networks by spreading the threat laterally after gaining access to just a few devices in the network made it one of the most resilient malware in the wild.
Disruption of EMOTET’s infrastructure
The infrastructure that was used by EMOTET involved several hundreds of servers located across the world, all of these having different functionalities in order to manage the computers of the infected victims, to spread to new ones, to serve other criminal groups, and to ultimately make the network more resilient against takedown attempts.
To severely disrupt the EMOTET infrastructure, law enforcement teamed up together to create an effective operational strategy. It resulted in this week’s action where by law enforcement and judicial authorities gained control of the infrastructure and took it down from the inside. The infected machines of victims have been redirected towards this law enforcement-controlled infrastructure. This is a unique and new approach to effectively disrupt the activities of the facilitators of cybercrime.
How to protect oneself against loaders
Many botnets like EMOTET are polymorphic in nature. This means that the malware changes its code each time it is called up. Since many antivirus programmes scan the computer for known malware codes, a code change may cause difficulties for its detection, allowing the infection to go initially undetected.
A combination of both updated cybersecurity tools (antivirus and operating systems) and cybersecurity awareness is essential to avoid falling victim to sophisticated botnets like EMOTET. Users should carefully check their email and avoid opening messages and especially attachments from unknown senders. If a message seems too good to be true, it likely is and emails that implore a sense of urgency should be avoided at all costs.
As part of the criminal investigation conducted by the Dutch National Police into EMOTET, a database containing e-mail addresses, usernames and passwords stolen by EMOTET was discovered. You can check if your e-mail address has been compromised at www.politie.nl/emocheck. As part of the global remediation strategy, in order to initiate the notification of those affected and the cleaning up of the systems, information was distributed worldwide via the network of so-called Computer Emergency Response Teams (CERTs).
The following authorities took part in this operation:
- Netherlands: National Police (Politie), National Public Prosecution Office (Landelijk Parket)
- Germany: Federal Criminal Police (Bundeskriminalamt), General Public Prosecutor's Office Frankfurt/Main (Generalstaatsanwaltschaft)
- France: National Police (Police Nationale), Judicial Court of Paris (Tribunal Judiciaire de Paris)
- Lithuania: Lithuanian Criminal Police Bureau (Lietuvos kriminalinės policijos biuras), Prosecutor’s General’s Office of Lithuania
- Canada: Royal Canadian Mounted Police
- United States: Federal Bureau of Investigation, U.S. Department of Justice, US Attorney's Office for the Middle District of North Carolina
- United Kingdom: National Crime Agency, Crown Prosecution Service
- Ukraine: National Police of Ukraine (Національна поліція України), Prosecutor General’s Office (Офіс Генерального прокурора)

ENISA release new report and training material to fight cybercrime and improve cooperation

The European Union Agency for Cybersecurity releases a new report and training material to support the cooperation among CSIRTs, Law Enforcement Agencies (LEAs) and their interaction with the judiciary.
The publications are designed to help tackle the challenges of this complex multi-stakeholder cooperation. The report, the handbook and the toolset are a set of deliverables complementing each other as follows:
- The report analyses roles, duties, competences, synergies and potential interferences across Computer Security Incident Response Teams (CSIRTs) - in particular, national and governmental ones, LE and judiciary (prosecutors and judges);
- The handbook helps a trainer explain these concepts through different scenarios;
- The toolset consists of exercises meant for trainees based on the handbook’s scenarios.
The report proposes a methodology to analyse the legal and organisational framework defining the roles and duties, the required competencies of CSIRTs and LE. It also identifies synergies and the potential interferences that may occur while engaging in the activities needed to respond to incidents of criminal nature and in fighting cybercrime.
In addition, it presents a detailed analysis focusing on Czechia, France, Germany, Luxembourg, Norway, Portugal, Romania, and Sweden. The methodology proposed can be used for a more comprehensive future analysis covering additional countries as it is based on:
- desk research;
- subject matter expert interviews;
- the segregation of duties (SoD) matrix.
This SoD matrix is also available in the ENISA repositories in GitHub, as well as the documentation on the Reference Security Incident Taxonomy Working Group (RSIT).
The RSIT working group will meet today as part of the 62nd TF-CSIRT Meeting. These are two other examples of the efforts ENISA engages in to contribute to building a bridge between CSIRTs and LE communities.
Main conclusions of the 2020 report on CSIRTs and LE cooperation include:
- The communities already engage in a number of actions meant to:
  - Avoid interferences wherever possible;
  - Create effective partnerships;
  - Use their synergies to support each other.
- However, interferences may still happen in the process of incident handling and cybercrime investigations, mainly because of the difference in purpose and mandate of each of these communities, i.e. incident mitigation (CSIRTs) compared with evidence preservation and criminal prosecution (LE and the judiciary).
- Joint training activities are organised mainly in community pairs, being either CSIRT and LE or LE and the judiciary. Such activities rarely involve the three communities. The joint training activities help the wider development of the competences required to respond to cybercrime.
- Overall, the 2019 pandemic of the COVID-19 virus did not have any significant impact on cooperation and exchanges between the three communities and their ability to function. Interaction even increased in some instances. For example, daily dialogues became more frequent in order to ensure that each community was kept informed as the situation evolved.
The response to cybercrime requires the cooperation of all actors involved. In this response, CSIRTs, LE and the judiciary perform each a different role and seek different objectives. Helping CSIRTs, LE and the judiciary understand their roles, duties and competences reciprocally will allow a closer cooperation while building on synergies and hence avoid possible interferences.
ENISA has been collecting input from the communities and compiling reports to shed light on the different aspects of the cooperation. These efforts are meant to further enhance the cooperation between CSIRTs and LE and their interaction with the judiciary, In addition, the Agency has been developing training material and co-organising the annual ENISA-EC3 workshop on CSIRT-LE Cooperation. The last edition of this event took place on 16 September 2020.
This new report and training material build on the work already completed in the area over the past. It contributed to the implementation of the ENISA programming document 2020-2022. The work conducted by ENISA in this area is planned to continue in 2021.

DHS Awards $1.5M to Small Business for First Responder Emergency Alerts Technology Development

As emergency communications technologies adapt to an increasingly interconnected nation, the Department of Homeland Security (DHS) Science and Technology Directorate (S&T) today announced it awarded more than $1.5 million to develop an Alerts, Warnings, and Notifications (AWN) Guidance Tool. The program planning app, which will be available through a portal at FEMA's website, is expected to provide customized resources, best practices and program templates to address the most pressing challenges of alert originators, helping public safety agencies at the federal, state, local, tribal and territorial levels disseminate emergency and life-saving information.
“From the devastating wildfires on the West Coast to the very active Atlantic/Caribbean 2020 hurricane season to the ongoing COVID-19 public health emergency, there is a growing need to push actionable information out quickly to the public in order to save lives,” said Antwane Johnson, director of FEMA’s Integrated Public Alert & Warning System (IPAWS) office.
S&T awarded $1,542,113 through its Long-Range Broad Agency Announcement (LRBAA) program to Corner Alliance, Inc., a small business consulting firm based in Washington, D.C. and Boulder, CO. The research and development of this tool is a continuation of S&T’s partnership with FEMA in creating the IPAWS Program Planning Toolkit, aimed at assisting public safety agencies in minimizing alerting delays; planning for future alerts, warnings and notifications enhancements; facilitating interoperability across different technologies; and improving information sharing among emergency management and public safety officials.
“First responders rely on information to make life saving decisions, often with very little time to spare,” noted William Bryan, DHS Senior Official Performing the Duties of the Under Secretary for Science and Technology. “This tool will help public safety agencies respond quickly and decisively during emergencies or catastrophic events, and that allows the greater homeland security enterprise to be more prepared and resilient.”
The documents in the IPAWS Program Planning Toolkit were produced based on recent innovative changes to technology and derived from the collection of successful practices and lessons learned from hundreds of data points from stakeholders, including emergency managers, public information officers, alerting originators and administrators, and alerting experts.
“FEMA and DHS S&T plan to expand the toolkit into an online, user-friendly format that will allow stakeholders to download and print pre-filled planning documents with their information,” said DHS S&T Program Manager Norman Speicher. “Through this development, our team will continue utilizing a stakeholder validation process.”
To learn more about the LRBAA program, please visit https://www.dhs.gov/science-and-technology/st-lrbaa.

CISA Launches Campaign to Reduce Risk of Ransomeware

The Cybersecurity and Infrastructure Security Agency (CISA) announced the Reduce the Risk of Ransomware Campaign today, a focused, coordinated and sustained effort to encourage public and private sector organizations to implement best practices, tools and resources that can help them mitigate this cybersecurity risk and threat.
Ransomware is increasingly threatening both public and private networks, causing data loss, privacy concerns, and costing billions of dollars a year. These incidents can severely impact business processes and leave organizations without the data they need to operate and deliver mission-critical services. Malicious actors have adjusted their ransomware tactics over time to include pressuring victims for payment by threatening to release stolen data if they refuse to pay and publicly naming and shaming victims as secondary forms of extortion.
“CISA is committed to working with organization at all levels to protect their networks from the threat of ransomware,” said Brandon Wales, Director (Acting) of CISA. “This includes working collaboratively with our public and private sector partners to understand, develop and share timely information about the varied and disruptive ransomware threats. Anyone can be the victim of ransomware, and so everyone should take steps to protect their systems.”
In this campaign, which will have a particular focus on supporting COVID-19 response organizations and K-12 educational institutions, CISA is working to raise awareness about the importance of combating ransomware as part of an organization’s cybersecurity and data protection best practices. Over the next several months, CISA will use its social media platforms to iterate key behaviors or actions with resource links that can help technical and non-technical partners combat ransomware attacks.
CISA established a new one-stop resource at cisa.gov/ransomware. On this page, interested partners will find four categories of ransomware resources:
- Alerts and Statements: Official CISA updates to help stakeholders guard against the ever-evolving ransomware threat environment. These alerts are geared toward system administrators and other technical staff to bolster their organization’s security posture.
- Guides and Services: Tips and best practices for home users, organizations, and technical staff to guard against the growing ransomware threat.
- Fact Sheets and Infographics: Easy-to-use, straightforward information to help organizations and individuals better understand the threats from and the consequences of a ransomware attack.
- Trainings and Webinars: This information provides technical and non-technical audiences, including managers, business leaders, and technical specialists with an organizational perspective and strategic overview.
Many of the resources on this webpage were developed in collaboration with industry and interagency partners, such as:
- CISA and Multi-State Information Sharing and Analysis Center (MS-ISAC) Joint Ransomware Guide;
- CISA, Federal Bureau of Investigation (FBI), and Department of Health and Human Services (HHS) Joint Cybersecurity Advisory on Ransomware Activity Targeting the Healthcare and Public Health Sector;
- CISA, FBI, DHS Homeland Security Investigations, and U.S. Secret Service recorded video discussion on Trends and Predictions in Ransomware from the 2020 CISA National Cybersecurity Summit.
- CISA Fact Sheet on Cyber Threats to K-12 Remote Learning Education for non-technical educational professionals with contributions from the FBI.

Securing Cloud Services for Health: New report by EU Agency for Cybersecurity helps healthcare organisations securely adopt cloud services and prepare for cybersecurity challenges

The European Union Agency for Cybersecurity (ENISA) published the Cloud Security for Healthcare Services report, which provides cybersecurity guidelines for healthcare organisations to help further digitalise with cloud services. Building on ENISA’s procurement guidelines for cybersecurity in hospitals, published early last year, this new report assesses the cybersecurity risks of cloud services and offers good practices for their secure integration into the European healthcare sector. The ENISA report comes as the European Commission is moving forward this year with the European Health Data Space initiative to promote the safe exchange of patients’ data and access to health data.
The COVID-19 pandemic has underlined an increased need for efficient – and secure – digital healthcare services. Cloud solutions allow for the flexible and rapid deployment of the electronic storage of data and electronic communications such as telemedicine. However, the complexity of legal systems and new technologies, as well as concerns over the security of sensitive patient data have slowed the healthcare sector in adopting cloud services.
EU Agency for Cybersecurity Executive Director Juhan Lepassaar said: “A resilient health sector relies on secure digital solutions. The EU Agency for Cybersecurity provides healthcare organisations with guidance to address cybersecurity concerns related to cloud services and is preparing an EU Cloud Cybersecurity Certification scheme, both of which aim to do just that.”
The report addresses these concerns by providing security guidelines for three main areas in which cloud services are used by the healthcare sector, namely for:
Electronic Health Record (EHR), i.e. systems focusing on the collection, storage, management and transmission of health data, such as patient information and medical exam results;
Remote Care, i.e. the subset of telemedicine supporting remote patient-doctor consultation;
Medical Devices, i.e. cloud services supporting the operation of medical devices such as making medical device data available to different stakeholders or for device monitoring.
For each of these use cases, the report highlights the main factors to be considered when healthcare organisations conduct the relevant risk assessment – for example, in terms of risk to sensitive patient data or availability of a medical service. These guidelines, however, are only a first step for healthcare providers to adapt securely to the cloud. More support is needed, such as established industry standards on cloud security, specific direction from national and EU authorities, and further guidelines from Data Protection Authorities on transferring healthcare data to the cloud.
The report also proposes a set of security measures for healthcare organisations to implement when planning their move to cloud services, such as establishing processes for incident management, defining data encryption requirements, and ensuring data portability and interoperability. The measures are proposed taking into consideration the draft candidate EU Cybersecurity Certification Scheme on Cloud Services (EUCS) to ensure compatibility and requirements mapping. The Agency’s draft scheme is part of the larger cybersecurity certification framework aimed at enhancing trust in ICT products, services and processes across Europe. The draft scheme is open for public consultation until 7 February 2021.
The EU Agency for Cybersecurity will continue its work to strengthen the cybersecurity of Europe’s healthcare sector by publishing guidelines, promoting information sharing, collaborating with policy-makers and organising events such as the annual eHealth Conference, addressing the healthcare sector’s major cybersecurity challenges.

ENISA and eu-LISA – Cooperation for a More Digitally Resilient Europe

Within the priorities of the Portuguese Presidency of the Council of the European Union and the current Recovery Plan for Europe put forward by the European Commission, the words “digital” and “resilience” are prominent and at times used together. When combined they bring to mind IT-related challenges that need to be addressed to ensure a stronger and safer Europe for its citizens. One of the primary concerns is cybersecurity; and, given that this is a topic of common interest to the European Union Agency for Cybersecurity (ENISA) and the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), it gives the two Agencies further impetus to work together to face this growing threat.
Earlier today Executive Directors Juhan Lepassaar (ENISA) and Krum Garkov (eu-LISA) signed a multiannual Cooperation Plan. The plan sets out activities that will provide benefits through joint actions to the Agencies themselves and to the EU Member States.
The three-year Cooperation Plan complements the existing regulations applicable to ENISA and eu-LISA, and lays out various actions within complimentary areas that the Agencies can draw benefits from by sharing knowledge, information and expertise. Information Security, Business Continuity, Research, Data Protection and Corporate Quality Management are among the priority areas identified for collaboration.
ENISA Executive Director Juhan Lepassaar said: “Securing our digital future is facilitated by sharing knowledge and expertise. This Cooperation Plan will allow our Agencies to find solutions together.”
"With cybersecurity and digital resilience high on the European agenda for the coming years, it seems fitting to take the opportunity to strengthen our cooperation with ENISA and to boost our common contributions to the goals set for Europe's digital future. There are many areas where our respective consolidated expertise can be put to good use. The EU Cybersecurity Strategy, adopted by the Commission in December, is one of these and the fast changing landscape of cyber threats including the ensuing need to secure common cyber spaces are examples of where we can mutually assist each other. This renewed agreement is the best way to kick-off 2021 and eu-LISA is looking forward to extending its relationship with ENISA." said Krum Garkov, Executive Director of eu-LISA.
It is in the common interest of both Agencies to promote and share activities with their stakeholders and the general public in order to provide increased visibility and further improve awareness of their respective responsibilities and joint successes. For this reason, the Cooperation Plan includes core activity related plans, as well as communication and information sharing as important areas for joint actions.

NSA releases “Eliminating Obsolete Transport Layer Security (TLS) Protocol Configurations” Cybersecurity Information

The National Security Agency released a cybersecurity product Tuesday detailing how to detect and fix out-of-date encryption protocol implementations. Networks and systems that use deprecated forms of Transport Layer Security (TLS) or Secure Sockets Layer (SSL) for traffic sessions are at risk of sensitive data exposure and decryption.
The Cybersecurity Information Sheet, “Eliminating Obsolete Transport Layer Security (TLS) Protocol Configurations” instructs National Security System (NSS), Department of Defense (DoD), and Defense Industrial Base (DIB) system administrators on how to detect, prioritize, and replace unauthorized or deprecated TLS protocols with ones that meet current standards. Committee on National Security Systems (CNSS) Policy 15 requires that TLS protocols used by National Security Systems meet specified algorithm standards. Remediation is crucial to decreasing computer system and network attack surfaces and preventing unauthorized access to private data.
To help system administrators fix their network components, NSA developed several server configurations and network signatures to accompany the report that are available on the NSA Cybersecurity Github. While this information is provided to assist NSA's mission customers, any network administrator interested in finding and fixing their network components to allow only authorized and strong encryption protocol configurations may find it useful.
NSA seeks to regularly release unique, actionable, and timely cybersecurity guidance to secure the Department of Defense, National Security Systems, and the Defense Industrial Base. For more information or other cybersecurity products, visit NSA.gov/cybersecurity-guidance.

FAA Should Examine a Range of Options to Support U.S. Launch Infrastructure

Demand for commercial space launches is expected to increase. Twelve launch sites in The US held operator licenses in Aug. 2020, and 11 more were seeking licenses from the Federal Aviation Administration.
Congress asked the FAA to recommend ways to facilitate and promote investments in space transportation infrastructure. The FAA told the GAO that its response would focus on 2 existing FAA grant programs.
Launch providers support the deployment of people and payloads, such as national security and commercial satellites or research probes, into space. The majority of these providers told GAO that U.S. space transportation infrastructure—located at sites across the country—is generally sufficient for them to meet their customers' current requirements. This situation is in part a result of the launch providers' investments in launch sites, along with state and local funding. Launch providers and site operators alike seek future improvements but differ on the type and location of infrastructure required. Some launch providers said that infrastructure improvements would be required to increase launch capacity at existing busy launch sites, while a few site operators said that new infrastructure and additional launch sites would help expand the nation's overall launch capacity.
The Federal Aviation Administration (FAA) was directed by statute to make recommendations to Congress on how to facilitate and promote greater investments in space transportation infrastructure, among other things. However, FAA's initial draft report was limited because it focused only on two existing FAA programs, rather than a range of options. FAA officials stated that they did not examine other options because of limited time and resources, and that the two identified programs could be implemented quickly because FAA has administrative authority to manage them. Leading practices in infrastructure investment emphasize the importance of conducting an examination of potential approaches, which can help identify how best to support national interests; avoid overlap or duplication of federal effort; and enhance, not substitute, participation by non-federal stakeholders. An examination may also help identify alternatives to making funding available, such as increasing efficiency and capacity through technology improvements. By focusing only on these existing programs, FAA may overlook other options that better meet federal policy goals and maximize the effect of any federal investment. Although FAA has already prepared its initial report to respond to the statute, it still has opportunities, such as during subsequent mandated updates, to report separately on potential approaches.
Demand for commercial space launches is anticipated to increase in the coming years. FAA, the agency responsible for overseeing the sites where these launches occur, was directed by statute to submit a report—and update it every 2 years until December 2024—that makes recommendations on how to facilitate and promote greater investments in space transportation infrastructure.

US Partnering with Cyprus on a Training Centre for Port and Border Security, known as CYCLOPS

This $5 million training facility donated by the United States will be owned and operated by the Republic of Cyprus and will allow international partners to train in a dedicated facility with cutting edge equipment. Here, experts from the region will receive state of the art instruction in border security, customs and export controls, port and maritime security, and cybersecurity.

A mobile cyber security training laboratory will allow regional partners to learn best practices to secure their critical infrastructure and engage in cross-border cyber investigations. These training platforms will serve as a hub that works in close association with partner countries in the Mediterranean, the Middle East, and elsewhere.

The CYCLOPS center is just one important result of continuing American engagement in the Eastern Mediterranean region and of the strong relationship between the United States and the Republic of Cyprus. We look forward to continuing our security partnership with the Republic of Cyprus and the region in the coming years.

1 38 39 40 41 42 48