Category: Agency News

CISA Releases Insights from Red Team Assessment of a U.S. Critical Infrastructure Sector Organization

Agency News, Industry News
The Cybersecurity & Infrastructure Security Agency (CISA) has released Enhancing Cyber Resilience: Insights from CISA Red Team Assessment of a U.S. Critical Infrastructure Sector Organization in coordination with the assessed organization. This cybersecurity advisory details lessons learned and key findings from an assessment, including the Red Team’s tactics, techniques, and procedures (TTPs) and associated network defense activity.
This advisory provides comprehensive technical details of the Red Team’s cyber threat activity, including their attack path to compromise a domain controller and human machine interface (HMI), which serves as a dashboard for operational technology (OT).
CISA encourages all critical infrastructure organizations, network defenders, and software manufacturers to review and implement the recommendations and practices to mitigate the threat posed by malicious cyber actors and to improve their cybersecurity posture.
For more information on the most common and impactful threats, tactics, techniques, and procedures, see CISA’s Cross-Sector Cybersecurity Performance Goals.
Leave a comment

TSA announces proposed rule that would require the establishment of pipeline and railroad cyber risk management programs

Agency News, Cyber Security CII sector, Industry News
The Transportation Security Administration (TSA) has published a Notice of Proposed Rulemaking that proposes to mandate cyber risk management and reporting requirements for certain surface transportation owners and operators.
“TSA has collaborated closely with its industry partners to increase the cybersecurity resilience of the nation’s critical transportation infrastructure,” said TSA Administrator David Pekoske. “The requirements in the proposed rule seek to build on this collaborative effort and further strengthen the cybersecurity posture of surface transportation stakeholders. We look forward to industry and public input on this proposed regulation.”
This rule proposes to continue TSA’s commitment to performance-based requirements. Building on the performance-based cybersecurity requirements TSA previously issued via annual Security Directives since 2021, the proposed rule leverages the cybersecurity framework developed by the National Institute of Standards and Technology and the cross-sector cybersecurity performance goals developed by the Cybersecurity and Infrastructure Security Agency (CISA).
Consistent with these requirements and standards, this rule proposes:
- To require that certain pipeline, freight railroad, passenger railroad and rail transit owner/operators with higher cybersecurity risk profiles establish and maintain a comprehensive cyber risk management program;
- To require these owner/operators, and higher-risk bus-only public transportation and over-the-road bus owner/operators, currently required to report significant physical security concerns to TSA to report cybersecurity incidents to CISA; and
- To extend to higher-risk pipeline owner/operators TSA’s current requirements for rail and higher-risk bus operations to designate a physical security coordinator and report significant physical security concerns to TSA.
TSA asserts that maintaining an effective cybersecurity posture is critically important to ensuring that the surface transportation sector is prepared for, and able to manage, cyber risks. The requirements contained in this proposed rule would strengthen cybersecurity resilience across the surface transportation systems sector.
Leave a comment ,

CISA Launches #PROTECT2024 Election Threat Updates Webpage

Agency News, Cyber Security CII sector, Industry News
The Cybersecurity and Infrastructure Security Agency (CISA) has launched a new one-stop shop website for election threat updates from CISA and its federal government partners. As foreign actors continue their efforts to influence and interfere with the 2024 elections, CISA is ensuring that information about the election threat environment is readily accessible.
Part of the larger #Protect2024 site launched in January, the page aims to make it easier to find specific threat related products that the American public can use to stay informed and the election community can use to prepare, including:
- Joint Statements from CISA, ODNI and FBI on threats to the 2024 election
- ODNI Election Threat Updates
- FBI and CISA “Just So You Know” Joint PSA Series
Since its initial launch, #Protect2024 has quickly grown and serves as the central point for critical resources, training lists and security services to support more than 8,000 election jurisdictions for the 2024 election cycle.
Leave a comment

CISA Releases Plan to Align Operational Cybersecurity Priorities for Federal Agencies

Agency News, Cyber Security CII sector, Organisation Types, Power/Energy/Oil & Gas sector
The Cybersecurity and Infrastructure Security Agency (CISA) has published the Federal Civilian Executive Branch (FCEB) Operational Cybersecurity Alignment (FOCAL) Plan. As the operational lead for federal cybersecurity, CISA uses this plan to guide coordinated support and services to agencies, drive progress on a targeted set of priorities, and align collective operational defense capabilities. The end result is reducing the risk to more than 100 FCEB agencies.
Each FCEB agency has a unique mission, and thus have independent networks and system architectures to advance their critical work. This independence means that agencies have different cyber risk tolerance and strategies. However, a collective approach to cybersecurity reduces risk across the interagency generally and at each agency specifically, and the FOCAL Plan outlines this will occur. CISA developed this plan in collaboration with FCEB agencies to provide standard, essential components of enterprise operational cybersecurity and align collective operational defense capabilities across the federal enterprise.
“Federal government data and systems interconnect and are always a target for our adversaries. FCEB agencies need to confront this threat in a unified manner and reduce risk proactively,” said CISA Executive Assistant Director for Cybersecurity, Jeff Greene. “The actions in the FOCAL plan orient and guide FCEB agencies toward effective and collaborative operational cybersecurity and will build resilience. In collaboration with our partner agencies, CISA is modernizing federal agency cybersecurity.”
The FOCAL plan is organized into five priority areas that align with agencies’ metrics and reporting requirements. Each priority has goals ranging from addressing universal cybersecurity challenges such as managing the attack surface of internet-accessible assets and bolstering cloud security to long-rage efforts including building a defensible architecture that is resilient in the face of evolving security incidents. The priority areas for FCEB agencies are:
- Asset Management – fully understand the cyber environment, including the operational terrain and interconnected assets.
- Vulnerability Management – proactively protect enterprise attack surface and assess defensive capabilities.
- Defensible Architecture – design cyber infrastructure with an understanding that security incidents will happen, and that resilience is essential.
- Cyber Supply Chain Risk Management (C-SCRM) - quickly identify and mitigate risks, including from third parties, posed to federal IT environments.
- Incident Detection and Response - improve the ability of Security Operations Centers (SOCs) to detect, respond to, and limit the impact of security incidents.
The FOCAL Plan was developed for FCEB agencies, but public and private sector organizations should find it useful as a roadmap to establish their own plan to bolster coordination of their enterprise security capabilities.
The Plan is not intended to provide a comprehensive or exhaustive list that an agency or CISA must accomplish. Rather, it is designed to focus resources on actions that substantively advance operational cybersecurity improvements and alignment goals.
Leave a comment

FBI, CISA, NSA, and US and International Partners Release Advisory on Russian Military Cyber Actors Targeting US and Global Critical Infrastructure

Agency News, Cyber Security CII sector, Industry News
The Federal Bureau of Investigation (FBI )— in partnership with CISA, the National Security Agency (NSA), and other U.S. and international partners — have released a joint Cybersecurity Advisory Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure.
This advisory provides overlapping cybersecurity industry cyber threat intelligence, tactics, techniques, and procedures (TTPs) and Indicators of Compromise (IOCs) associated with Russian General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155) cyber actors, both during and succeeding their deployment of the WhisperGate malware against Ukraine.
These cyber actors are responsible for computer network operations against global targets for the purposes of espionage, sabotage, and reputational harm since at least 2020. The authoring agencies encourage organizations to review this advisory for recommended mitigations against such malicious activity.
Leave a comment

DHS Has Efforts Underway to Implement Federal Incident Reporting Requirements

Agency News, Cyber Security CII sector, Industry News
Cyber threats to systems that provide essential services such as banking and health care are growing.
A 2022 law required the Department of Homeland Security to take several actions to address these threats.
The first set of requirements for DHS included proposing a rule that identifies which infrastructure operators have to report about cyber incidents. DHS proposed the rule in March 2024. According to DHS, access to cyber incident reports could help it improve its prevention of and response to cyber threats.
DHS also met requirements related to specific programs, and to its coordination of federal cybersecurity efforts.
What GAO Found
The Department of Homeland Security (DHS) has implemented the 13 requirements from the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (the act) that were due by March 2024. Specifically, DHS's Cybersecurity and Infrastructure Security Agency (CISA) submitted a proposed rule related to cyber incident reporting requirements to the Federal Register in March 2024, and it was published in April 2024. DHS plans to issue the final rule by October 2025. In addition, the department implemented the remaining 12 requirements (see figure). As a result of these efforts, DHS should be better positioned to coordinate the federal government cybersecurity and mitigation efforts more effectively, as intended by the act. Additionally, DHS should be better positioned to assist entities with defending against cyber incidents on the critical infrastructure.
Extent to Which the Department of Homeland Security (DHS) Implemented 13 Applicable Cyber Incident Reporting for Critical Infrastructure Act of 2022 Requirements
DHS identified a variety of challenges in implementing the act and is taking steps to address them. These challenges are related to harmonizing cyber incident reporting requirements, addressing cyber incident review responsibilities, and facilitating a more efficient method for federal agencies to begin sharing cyber incident reports. DHS noted that it has taken several mitigation steps to address these challenges, such as (1) identifying four recommendations for federal agencies and three proposals to Congress to address duplicative reporting requirements; (2) updating its technologies; and (3) hiring additional staff to facilitate the review, analysis, and sharing of reports. If implemented effectively, the four recommendations and three proposals can further mitigate challenges and help standardize incident reporting.
Why GAO Did This Study
Cybersecurity incidents involving critical infrastructure sectors—the sectors whose assets, systems, and networks provide essential services—cost the United States billions of dollars annually and cause significant disruptions. To provide increased visibility into the growing cyber threats to critical infrastructure, Congress and the President enacted a law on cyber incident reporting. This law calls for DHS to address 13 requirements by March 2024, including publishing a proposed rule for certain entities to submit reports on cyber incidents and ransom payments to DHS.
The law also includes a provision for GAO to report on the implementation of the act. This report (1) examines the extent to which DHS has implemented the act's requirements and (2) describes efforts DHS has made to identify and mitigate challenges with meeting the act's requirements.
To do so, GAO identified 59 requirements in the act that DHS was responsible for implementing. Of those, 13 requirements were due by March 2024. GAO organized the requirements into four categories: proposed rule for reporting requirements, cyber incident reporting council, ransomware pilot program, and joint ransomware task force. GAO then analyzed the department's implementation of the 13 requirements. GAO also summarized documentation and testimonial evidence regarding challenges DHS faced in implementing the act's requirements and its mitigation plans.
Leave a comment

CISA and Partners Release Advisory on Iran-based Cyber Actors Enabling Ransomware Attacks on US Organizations

Agency News, Cyber Security CII sector, Industry News
CISA—in partnership with the Federal Bureau of Investigation (FBI) and the Department of Defense Cyber Crime Center (DC3)—released Iran-based Cyber Actors Enabling Ransomware Attacks on U.S. Organizations. This joint advisory warns of cyber actors, known in the private sector as Pioneer Kitten, UNC757, Parisite, Rubidium, and Lemon Sandstorm, targeting and exploiting U.S. and foreign organizations across multiple sectors in the U.S.
FBI investigations conducted as recently as August 2024 assess that cyber actors like Pioneer Kitten are connected with the Government of Iran (GOI) and linked to an Iranian information technology (IT) company. Their malicious cyber operations are aimed at deploying ransomware attacks to obtain and develop network access. These operations aid malicious cyber actors in further collaborating with affiliate actors to continue deploying ransomware.
This advisory highlights similarities to a previous advisory, Iran-Based Threat Actor Exploits VPN Vulnerabilities published on Sept. 15, 2020, and provides known indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs).
CISA and partners encourage critical infrastructure organizations to review and implement the mitigations provided in this joint advisory to reduce the likelihood and impact of ransomware incidents. For more information on Iranian state-sponsored threat actor activity, see CISA’s Iran Cyber Threat Overview and Advisories page.
Leave a comment , ,

CISA Releases Secure by Demand Guidance

Agency News, Cyber Security CII sector, Industry News
CISA and the Federal Bureau of Investigation (FBI) have released Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem to help organizations drive a secure technology ecosystem by ensuring their software manufacturers prioritize secure technology from the start.
An organization’s acquisition staff often has a general understanding of the core cybersecurity requirements for a particular technology acquisition. However, they frequently don’t assess whether a given supplier has practices and policies in place to ensure that security is a core consideration from the earliest stages of the product development lifecycle.
This guide provides organizations with questions to ask when buying software, considerations to integrate product security into various stages of the procurement lifecycle, and resources to assess product security maturity in line with secure by design principles.
This guide compliments the “Software Acquisition Guide for Government Enterprise Consumers: Software Assurance in the Cyber-Supply Chain Risk Management (C-SCRM) Lifecycle” that was recently published.
CISA encourages organizations to review both the Secure by Demand Guide and Software Acquisition Guide and implement recommended actions.
Leave a comment

DHS Deploys Pilot Programs, Expands Efforts to Leverage AI to Secure Nation’s Critical Infrastructure

Agency News, Cyber Security CII sector, Industry News
It has been over 270 days since President Biden issued his landmark Executive Order (EO) 14110, “Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence,” ensuring that the United States leads the world in seizing the promise of Artificial Intelligence (AI) while addressing its risks. Throughout its AI-related efforts, the Department of Homeland Security (DHS) has maintained a clear set of principles and robust governance that prioritizes the protection of civil rights, civil liberties, and privacy, and increased its engagement with affected communities.
Conducted New AI Pilot to Identify and Combat Vulnerabilities in Critical United States Government Software, Systems, and Networks
- As directed in executive order 14110 and on behalf of DHS, the Cybersecurity and Infrastructure Security Agency (CISA) developed, conducted, and completed an operational pilot using AI capabilities to support CISA’s cybersecurity mission in the detection and remediation of vulnerabilities in critical United States Government software, systems, and networks.
- Through this operational pilot, CISA examined whether current vulnerability detection software products that use AI, including large language models, are more effective at detecting vulnerabilities than those that do not use AI.
- The report found that the best use of AI for vulnerability detection currently lies in supplementing and enhancing, as opposed to replacing, existing tools.
- AI tools are improving constantly, and CISA will continue to monitor the market and test tools to ensure CISA’s vulnerability detection capabilities remain state-of-the-art.
Developed an AI International Engagement Plan for Collaboration with Allies and Partners
- DHS developed a comprehensive strategy of engagement on AI and critical infrastructure with our international allies and partners, including, Canada, Mexico, the European Union (EU), and Five Eyes partners covering everything from cybersecurity to transnational infrastructure. This collaborative strategy identifies ways for the United States and its allies to detect, deter, and prevent threats at the nexus of AI, cyber, and critical infrastructure security.
- The efforts outlined in the strategy include sharing lessons learned and threat information, and identifying and collaborating on new opportunities and risks, through existing and novel international forums. DHS will engage across the spectrum with our closest security allies, in support of the Biden-Harris Administration’s AI contact group of nations, multilateral efforts such as the G7 and the Organization for Economic Cooperation and Development, and pivotal bilateral engagements with countries, including those with shared critical infrastructure.
Hired 15 New Experts to the “AI Corps” Who are Helping Responsibly Leverage AI Across DHS Mission Areas
- As part of the Department’s “AI Corps” hiring sprint, DHS has onboarded the first cohort of 15 AI experts from the private and public sectors to play pivotal roles responsibly leveraging AI across strategic mission areas in the Department. The AI Corps is one of the most significant AI-talent recruitment efforts of any federal civilian agency, aiming to hire 50 AI experts to enhance service delivery and impact the homeland security mission while safeguarding privacy, civil rights, and civil liberties.
- AI Corps members are currently working with the DHS Supply Chain Resilience Center to investigate how AI could be used to forecast the impacts of critical supply chain disruptions to public safety and security; working with DHS Science & Technology (S&T) to develop test and evaluation (T&E) requirements across the lifecycle of an AI system; and leveraging generative AI to support the work of the Department’s Homeland Security Investigations (HSI) department to combat fentanyl, human trafficking, child exploitation, and other criminal networks.
- In addition to the AI Corps, the DHS Office of Partnership and Engagement (OPE) hired a new Senior Director for Artificial Intelligence to further build the Department’s engagement on AI across sectors, meeting a commitment outlined in the AI Roadmap and establishing a channel for ongoing stakeholder feedback and information sharing.
Convened the AI Safety and Security Board and Took Steps to Bolster AI Safety and Security
- At the President’s direction, Secretary of Homeland Security Alejandro N. Mayorkas established the AI Safety and Security Board (AISSB), an unparalleled gathering of AI leaders representing prominent companies in the hardware and software industries, AI model labs, critical infrastructure owners and operators, civil rights leaders, and federal, state, and local officials.  The President directed the Board to provide to the Secretary and the critical infrastructure community advice, information, and recommendations on the safe and secure development and deployment of AI.
- The Board convened its inaugural meeting in May 2024. Since then, the Department and the Board have been developing guidance and standards of practices to improve AI safety and security across the AI ecosystem.  The deployment of safe, secure, and trustworthy AI generates consumer trust and fuels adoption and innovation.  AI can substantially improve the services the nation’s critical infrastructure provides, if we secure systems against safety and security threats.
Met with 16 Groups to Better Ensure Civil Rights, Civil Liberties and Privacy Are Protected in AI Adoption
- Through the DHS Artificial Intelligence Task Force, the DHS Office for Civil Rights and Civil Liberties (CRCL), in collaboration with the DHS Privacy Office, leads efforts to develop tailored approaches to provide guidance, risk assessment, mitigation strategies, and oversight for the protection of civil rights and civil liberties in projects championed by the DHS AI Task Force.
- In March 2024, the Department launched the AI Roadmap, which details plans to test uses of the technologies that deliver meaningful benefits to the American public and advance homeland security, while ensuring that individuals’ privacy, civil rights, and civil liberties are protected.
- Under the leadership of the DHS Office of Partnership and Engagement (OPE), the Department is exercising its commitment to ensure increased engagement on the development and deployment of AI with community-based organizations; civil-rights and civil-liberties organizations; academic institutions; industry; State, local, Tribal, and territorial governments; and other stakeholders. Building on an initial series of AI and civil rights engagements led by OPE with DHS leadership in Spring 2024, OPE facilitated engagement for Secretary Mayorkas with civil society leaders to discuss the AI Roadmap. In his engagement, the Secretary emphasized the AI Roadmap’s direction to ensure the responsible and trustworthy use of AI and explicit commitment to continued partnerships and engagement with civil society. The Department has continued to engage with multiple civil society, academic, industry and other organizations to discuss privacy, civil rights, and civil liberties protections and impacts and how they are being addressed through the DHS AI Roadmap.
These efforts build and expand on the Department’s ongoing AI initiatives announced earlier this year to facilitates the safe and responsible deployment and use of AI in federal government, critical infrastructure, and the U.S. economy.
Leave a comment

EU mobilises aid to combat wildfires in North Macedonia and Bulgaria

Agency News, Industry News
In response to urgent requests for assistance in their fight against severe wildfires received from North Macedonia and Bulgaria, the EU Civil Protection Mechanism has been activated.
North Macedonia is receiving 1 helicopter from Serbia, 2 helicopters from Slovenia, 2 aircrafts and 1 helicopter from Türkiye, and 1 aircraft from the rescEU firefighting fleet from Croatia.
Bulgaria is also receiving 2 helicopters from Czechia, one of them from the rescEU firefighting fleet.
Commissioner for Crisis Management, Janez Lenarčič, emphasised the importance of solidarity in these efforts: “The EU stands united in its support. Our rapid response through the EU Civil Protection Mechanism is crucial in aiding local efforts against these devastating wildfires. We remain ready to provide additional support if needed. Wildfires know no borders, and neither does our commitment to help.”
The EU's Emergency Response Coordination Centre continues to closely monitor the situation, ensuring that further assistance can be swiftly deployed if required.
The Commission has put together a fleet of aircraft and pre-positioned firefighters this summer across Europe. 556 firefighters from 12 countries are strategically prepositioned across key locations in Europe this summer, such as France, Greece, Portugal, and Spain, ready to help local fire brigades.
The EU has assembled a dedicated rescEU fleet of firefighting aircraft for this summer, consisting of 28 airplanes and 4 helicopters stationed in 10 Member States.
Leave a comment
1 … 7 8 9 10 11 … 48