Category: Industry News

Industry News

CISA and US and International Partners Publish Guidance on Priority Considerations in Product Selection for OT Owners and Operators

Agency News, Cyber Security CII sector, Industry News
CISA—along with U.S. and international partners—released joint guidance Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products. As part of CISA’s Secure by Demand series, this guidance focuses on helping customers identify manufacturers dedicated to continuous improvement and achieving a better cost balance, as well as how Operational Technology (OT) owners and operators should integrate secure by design elements into their procurement process.
Critical infrastructure and industrial control systems are prime targets for cyberattacks. The authoring agencies warn that threat actors, when compromising OT components, target specific OT products rather than specific organizations. Many OT products are not designed and developed with Secure by Design principles and often have easily exploited weaknesses. When procuring products, OT owners and operators should select products from manufacturers who prioritize security elements identified in this guidance.
For more information on questions to consider during procurement discussions, see CISA’s Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem. To learn more about secure by design principles and practices, visit Secure by Design.
Leave a comment

Improving Interoperability for EU Joint Civil Protection Actions

Industry News
TIEMS team in the FIRE – RES EU project has developed an Opinion Paper on “Improving Interoperability for EU Joint Civil Protection Actions”.
This Opinion Paper aims to initiate discussions to improve interoperability among EU Civil Protection organizations. By leveraging insights from the experience of TIEMS members, previous TIEMS projects, and initial findings from the FIRE-RES project, this presentation highlights the need for a comprehensive approach to enhancing coordination, communication, and collaboration across national borders in Europe.
Interoperability among EU Civil Protection organizations is essential for effective disaster response and resilience. The ability of different national systems to work together seamlessly ensures timely and coordinated efforts during emergencies, ultimately saving lives and resources. While each nation has developed its own protocols and structures, the growing frequency and complexity of cross-border emergencies necessitate a more integrated approach.
The EU Host Nation Support (HNS) guidelines provide a precedent for discussing command and control interoperability. These guidelines have established a framework for receiving and providing assistance during disasters, highlighting the importance of standardized procedures and cooperation among EU member states (UCP Knowledge Network). Similarly, this opinion paper advocates for a framework to enhance interoperability in civil protection, with a focus on command and control, leveraging insights from various EU Projects, TIEMS research and experience, and recent efforts such as FIRE-RES.
Objective: The primary objective of this opinion paper is to emphasize the need for a comprehensive roadmap to enhance command and control interoperability among EU Civil Protection organizations. While not a direct deliverable of the FIRE-RES project, the findings and experiences from FIRE-RES are highly applicable to this initiative and further support the previous research and projects by TIEMS. By identifying key issues and presenting relevant research and project findings, this paper aims to:
• Highlight the importance of interoperability in civil protection.
• Identify the challenges and opportunities related to interoperability.
• Propose the development of a detailed roadmap to address these challenges and leverage opportunities.
A next step would be the creation of a project under the EU framework that tackles interoperability through in-depth analysis and collaborative efforts, much like the development of the HNS guidelines. This approach would focus on the people, systems, and structures surrounding civil protection response, ensuring a robust and coordinated effort across the EU.
Insights from FIRE-RES
b The FIRE-RES project, funded under the European Union’s Horizon 2020 research and innovation program, aims to develop innovative solutions for creating fire-resilient territories across Europe. The project addresses extreme wildfire events (EWEs), which pose significant environmental, economic, and social threats. FIRE-RES integrates research, technology, civil protection, policy, and governance to innovate processes, methods, and tools for effective fire management.
Key Findings: The insights from the FIRE-RES project highlight several critical aspects that are relevant to developing command and control interoperability within EU Civil Protection systems:
• Multi-Actor Collaboration: Effective disaster management requires collaboration among multiple actors across different levels and sectors. FIRE-RES demonstrated the importance of engaging diverse stakeholders in planning and implementing fire management strategies. This involves fostering partnerships between public and private entities, enhancing the role of local communities, and ensuring that all relevant actors are equipped with the necessary knowledge and resources. Translating this to command and control interoperability, it is essential to establish clear communication channels and collaborative frameworks that include all relevant stakeholders in emergency response planning and execution.
• Capacity Building and Knowledge Sharing: One of the significant achievements of FIRE-RES is its emphasis on capacity building and knowledge sharing. By raising awareness and promoting education on wildfire risk prevention, preparedness, and response, the project enhances the overall capacity of involved stakeholders. Applying this to command and control systems, ongoing training programs, workshops, and the development of best practices are crucial for building a common understanding and operational proficiency among different national and regional command centers.
• Human Capital Development: The FIRE-RES training event in Valabre (April 2024) highlighted that, on a human capital level, nations have personnel capable of greater integration into command and control structures but lack the experience and opportunity to do so. For command and control interoperability, it is vital to develop the skills and experiences necessary for personnel to integrate seamlessly into broader, multi-national command frameworks. This includes creating opportunities for joint exercises and shared experiences that build trust and operational coherence.
These insights from the FIRE-RES project underscore the importance of a comprehensive approach to interoperability that includes not just technical solutions, but also organizational, procedural, and community-based strategies. They provide a valuable foundation for developing a roadmap aimed at improving interoperability among EU Civil Protection organizations.
Challenges and Opportunities
Identified Challenges: The FIRE-RES project has uncovered several significant challenges to achieving interoperability among EU Civil Protection organizations. These challenges highlight the complexities and barriers that need to be addressed to enhance cross-border cooperation effectively.
• Communication Barriers: Different communication protocols and languages used by various national civil protection agencies create significant barriers to effective collaboration. These differences can lead to misunderstandings and delays in response efforts during emergencies.
• Coordination Difficulties: Variations in command structures and decision-making processes across countries pose challenges to unified operations. Each country has its own established procedures and hierarchies, which can complicate efforts to coordinate a cohesive response during transnational emergencies.
• Administrative and Procedural Incompatibilities: Diverse administrative practices and procedural norms among EU member states further hinder interoperability. These incompatibilities can result in inefficiencies and slow down the mobilization of resources and personnel across borders, hampering overall command and control integration in the host nation.
Opportunities: Despite these challenges, there are numerous opportunities to enhance interoperability, as demonstrated by the FIRE-RES project and other EU, TIEMS, and research initiatives.
• Standardizing Procedures: Developing common procedures and protocols for emergency response can significantly enhance interoperability, while still appreciating the national structures and legislation. Standardization efforts could include creating unified guidelines for communication, resource allocation, and operational coordination, similar to the EU Host Nation Support (HNS) guidelines. In fact the EU Host Nation Support guidelines provide a good example of development of format of command and control guidelines (UCP Knowledge Network).
• Improving Communication Frameworks: Establishing robust communication frameworks that support multiple languages and protocols can bridge communication gaps. This could involve adopting interoperable communication technologies and platforms that enable real-time information sharing among different agencies (FIRE RES) (FIRE RES) (Research EU).
• Enhancing Collaborative Training Programs: Joint training programs and exercises are crucial for building trust and operational familiarity among different national teams. These programs can simulate cross-border emergency scenarios, but focus on command and control interoperability, allowing agencies to practice and refine their coordination and communication strategies (Research EU) (European Research Executive Agency). For example, the practicing of personnel exchange in command and control systems and simulations to address functional aspects of command and control interoperability.
• Promoting Capacity Building and Partnership Brokerage: Capacity building initiatives, such as training and educational programs, can equip stakeholders with the skills and knowledge needed for effective collaboration. Additionally, fostering partnerships between civil protection organizations with a focus on command and control, enhances overall preparedness and response capabilities.
By addressing these challenges and leveraging the opportunities identified, EU Civil Protection organizations can significantly improve their command and control interoperability at a functional level in personnel and systems. This will not only enhance their ability to respond to cross-border emergencies but also strengthen overall disaster resilience across the region, while not forcing investment in equipment, new technologies, or infrastructure.
Elements of Command and Control Interoperability
Overview: Command and Control Interoperability in the context of EU Civil Protection organizations encompasses various potential elements that enable different national systems to work together effectively during emergencies. These characteristics are well-documented globally and offer a foundation for developing interoperability frameworks tailored to the EU’s unique architecture and needs.
• Span of Control: Effective management and coordination of resources during emergencies require a clear span of control. This principle ensures that each supervisor oversees a manageable number of subordinates, facilitating efficient decision-making and communication. Adopting a standardized span of control can streamline operations and enhance response capabilities during large-scale emergencies.
• Unified Command: A unified command structure is essential for coordinated decision-making during emergencies. This structure allows multiple agencies to operate under a single, cohesive command, ensuring that all efforts are aligned, and resources are utilized efficiently. Unified command helps eliminate confusion and duplication of efforts, which is particularly important in cross-border emergency scenarios.
• Joint Training and Exercises: Regular, collaborative training programs and exercises are crucial for building trust and operational familiarity among different national teams. These activities allow agencies to practice and refine their coordination and communication strategies in simulated emergency scenarios. Joint training helps identify and address potential interoperability issues before they arise in real-world situations.
• Common Terminology and Procedures: Standardized language and procedures ensure clarity and consistency in communication and operations. By adopting common terminology and standardized procedures, EU Civil Protection agencies can reduce misunderstandings and enhance their ability to work together seamlessly. This element is particularly important for ensuring that all agencies understand each other’s roles, responsibilities, and actions during emergencies.
• Resource Sharing and Mutual Aid: Agreements and mechanisms for sharing resources across borders are vital for effective emergency response. These arrangements allow countries to provide and receive assistance quickly, ensuring that critical resources are available where and when they are needed. Resource sharing and mutual aid agreements enhance the collective capacity of EU Civil Protection organizations to manage large-scale emergencies.
Best Practice Example:
• Joint Drills and Integrated Response Scenarios: The FIRE-RES project has highlighted the importance of joint drills and integrated response scenarios. These activities allow agencies to test and improve their interoperability in realistic settings, identifying strengths and areas for improvement. In terms of command-and-control interoperability, this would be an ideal point to integrate personnel in functional areas in order to create interoperability at the individual level within a command and control structure. Exemplified by the training event in Valabre, France where integrated response scenarios integrated personal from different civil protection structures. The training event provided a platform for the exchange of personnel between civil protection system, fostering realistic learning and collaboration against the backdrop of an integrated response scenario.
Tailoring to the EU Architecture: It is important to note that while these elements and best practices are globally recognized, it is crucial to define and adapt them to fit the specific needs and architecture of the EU. The diversity of administrative structures, legal frameworks, and operational procedures across EU member states necessitates a tailored approach to interoperability. Developing a detailed roadmap and project focused on these tailored solutions will ensure that interoperability efforts are practical, effective, and sustainable within the EU context.
By understanding and implementing these potential elements, and customizing them to the EU’s unique context, EU Civil Protection organizations can significantly enhance their interoperability, ensuring a more coordinated and effective response to emergencies across national borders.
Potential Framework for Harmonization and Interoperability
Strategic Approach: To enhance command and control interoperability across EU Civil Protection systems, a strategic and collaborative approach is essential. Drawing lessons from existing initiatives like the EU Host Nation Support (HNS) guidelines, there is significant potential to develop a framework that aligns the diverse structures and processes of EU member states, enhancing cooperation and coordination.
Role of Interoperability: Interoperability is crucial for effective disaster response, enabling different national systems to work together seamlessly. It enhances the capacity to respond to cross-border emergencies, reduces redundancy, and maximizes resource use. A coordinated response ensures timely and efficient actions, ultimately saving lives and minimizing damage. Interoperability is being addressed through various initiatives, such as FIRE-RES, however command and control interoperability remains extant.
Pathways for Developing a Framework: Several pathways can be considered for developing a potential framework for interoperability:
• Command and Control Guidelines (Best Practices): Mirroring the EU HNS Guidelines effort, there is a need to develop and adopt a set of “best practices” or guidelines for command and control during response that all EU member states can follow. This includes understanding functional areas, aspects of incident management, resource allocation processes, and operational coordination mechanisms. Such standardization would facilitate smoother cooperation during cross-border emergencies, and specifically drive interoperability at depth to the personnel level.
• Interoperable Communication Systems: Establishing interoperable communication systems is vital for real-time information sharing among different agencies. This could involve adopting compatible technologies and platforms that support multiple languages and communication protocols, ensuring that all parties remain informed and coordinated during an emergency.
• Joint Training and Exercises: Implementing joint training programs and exercises that involve multiple national teams is crucial. These activities help build trust, operational familiarity, and a better understanding of each other’s capabilities and procedures. Regular exercises will also identify potential interoperability issues and allow for the development of solutions in a controlled environment.
• Legislative and Policy Alignment: Where applicable, harmonizing laws and policies related to civil protection and emergency management across the EU will provide a consistent legal framework that supports standardized procedures and facilitates cross-border cooperation. Legislative alignment ensures that all member states have compatible policies for resource sharing, mutual aid, and operational coordination.
Example: The development of the EU HNS guidelines serves as an exemplary model for the potential to create a framework for interoperability. Just as the HNS guidelines standardized procedures for receiving and providing assistance during disasters, a similar framework could outline standardized procedures and policies to enhance coordination and cooperation in civil protection efforts.
By pursuing these pathways and aligning them with the specific needs and contexts of EU member states, there is substantial potential to develop a framework that enables more effective and coordinated disaster response efforts. This strategic approach will ensure that EU Civil Protection organizations can work together seamlessly, enhancing resilience and reducing the impact of emergencies across the region.
What’s Next? Develop a Conceptual Way Ahead (Initial Roadmap)
To begin the conversation about developing command and control operability, an initial roadmap can be developed that can frame the problem and way ahead. However, a full comprehensive roadmap is required to understand the full complexity of the interoperability issue. A full and comprehensive roadmap requires funding and personnel to develop properly, and EU endorsement to provide the appropriate authority. A comprehensive roadmap will serve as a strategic guide, outlining the necessary steps, milestones, and resources required to create a framework that fosters coordination, communication, and collaboration across national borders.
Developing a detailed roadmap is essential for several reasons. First, a roadmap clarifies the role of command and control interoperability, creating a unified strategy that addresses common challenges and goals. By developing a roadmap towards command and control interoperability, there are opportunities to reduce redundancy and identify commonality amongst other EU projects. Second, a roadmap maximizes the use of available resources by identifying and prioritizing critical areas for development. This helps to ensure that funds and efforts are directed towards the most impactful initiatives, enhancing the overall effectiveness of a project to develop command and control interoperability.
A full roadmap also establishes clear milestones and performance indicators to track progress and ensure accountability throughout the implementation process. Clear milestones provide a timeline for achieving specific goals, making it easier to measure success and make adjustments as needed. Additionally, engaging all relevant stakeholders in the development and implementation process ensures broad support and participation. By involving stakeholders from the beginning, the roadmap can reflect a wide range of perspectives and expertise, enhancing its relevance and effectiveness.
A comprehensive roadmap would include several critical components. It would begin with a comprehensive assessment of current interoperability capabilities, aligning with international standards and best practices. This initial phase would involve engaging stakeholders through consultations and workshops to gather input and ensure alignment with national priorities. By understanding the current state and desired outcomes, the roadmap can be tailored to address specific needs and challenges to achieve command and control interoperability.
By committing to the development and implementation of this roadmap, EU Civil Protection organizations can ensure they are better equipped to respond to emergencies in a coordinated and effective manner. This strategic approach will lead to the creation of a robust and resilient civil protection framework that can effectively address the complexities of modern disaster response. The roadmap will provide a shared vision and actionable plan, fostering collaboration and enhancing the collective capacity to manage cross-border emergencies.
After the Roadmap
The next phase would involve developing non-binding guidelines that outline standardized procedures and protocols for interoperability. These guidelines would be customized to address the specific needs and contexts of EU member states, ensuring relevance and applicability. Additionally, training programs would be developed to support the implementation of these guidelines, providing civil protection agencies with the knowledge and skills needed to effectively collaborate across borders and effectively integrate into other command and control structures.
The development of the EU Host Nation Support (HNS) guidelines serves as an exemplary model for creating a framework for interoperability. Just as the HNS guidelines standardized procedures for receiving and providing assistance during disasters, an interoperability roadmap would outline standardized procedures and policies to enhance coordination and cooperation in civil protection efforts.
Pilot projects would be implemented to test the proposed solutions and frameworks in real-world scenarios. These pilot projects would provide valuable insights into the effectiveness of the guidelines and training programs, allowing for data collection and feedback to refine and improve the approach. By evaluating the success of these pilots, adjustments can be made to ensure the framework is robust and effective.
Following the pilot phase, the interoperability framework would be rolled out across all EU member states. This full-scale implementation would involve providing ongoing support and resources to facilitate adoption and ensure success. A feedback mechanism would be established to gather input from the field, allowing for continuous improvement of the framework based on real-world experiences.
Ensuring the long-term commitment to interoperability would require securing funding and resources to support ongoing efforts. Integrating the interoperability framework with other relevant EU initiatives and international organizations would ensure alignment and synergy, enhancing the overall impact of the efforts.
Conclusion
Interoperability among EU Civil Protection organizations is not just a desirable goal but an essential requirement for effective disaster response and resilience. As cross-border emergencies become increasingly frequent and complex, the ability of different national systems to work together seamlessly is crucial. The insights from TIEMS and findings from the FIRE-RES project highlight significant challenges and opportunities in achieving command and control interoperability, emphasizing the need for a coordinated and strategic approach.
The proposed development of a comprehensive roadmap represents a vital step towards enhancing interoperability. This roadmap will serve as a strategic guide, outlining the necessary steps, milestones, and resources required to foster coordination, communication, and collaboration across national borders. By aligning strategies, maximizing resources, establishing clear milestones, and engaging stakeholders, the roadmap will provide a structured and effective approach to achieving interoperability.
Key components of the roadmap will include a comprehensive assessment of current capabilities, the development of non-binding guidelines and customized training programs, the implementation and evaluation of pilot projects, and the full-scale rollout of the interoperability framework. Ensuring long-term commitment and integrating the framework with other relevant initiatives will be crucial for sustained success.
The development of the EU Host Nation Support (HNS) guidelines serves as an exemplary model for creating a framework for interoperability. Just as the HNS guidelines standardized procedures for receiving and providing assistance during disasters, a command and control interoperability roadmap would outline standardized procedures and policies to enhance coordination and cooperation in civil protection effort.
By committing to the development and implementation of this roadmap, EU Civil Protection organizations can significantly enhance their ability to respond to emergencies in a coordinated and effective manner. This strategic approach will lead to the creation of a robust and resilient civil protection framework that can effectively address the complexities of modern disaster response. The roadmap will provide a shared vision and actionable plan, fostering collaboration and enhancing the collective capacity to manage cross-border emergencies.
In conclusion, the journey towards command and control interoperability requires a collective effort, informed by research, guided by strategic planning, and sustained by continuous improvement. By initiating this discussion and committing to the development of a comprehensive roadmap, we can pave the way for a more resilient and cooperative future for EU Civil Protection organizations.
Leave a comment

Artificial Intelligence: DHS Needs to Improve Risk Assessment Guidance for Critical Infrastructure Sectors

Agency News, Cyber Security CII sector, Industry News
Federal agencies with a lead role in protecting the nation's critical infrastructure sectors are referred to as sector risk management agencies. These agencies, in coordination with the Department of Homeland Security's (DHS) Cybersecurity and Infrastructure Security Agency (CISA), were required to develop and submit initial risk assessments for each of the critical infrastructure sectors to DHS by January 2024.
Although the agencies submitted the sector risk assessments to DHS as required, none fully addressed the six activities that establish a foundation for effective risk assessment and mitigation of potential artificial intelligence (AI) risks. For example, while all assessments identified AI use cases, such as monitoring and enhancing digital and physical surveillance, most did not fully identify potential risks, including the likelihood of a risk occurring. None of the assessments fully evaluated the level of risk in that they did not include a measurement that reflected both the magnitude of harm (level of impact) and the probability of an event occurring (likelihood of occurrence). Further, no agencies fully mapped mitigation strategies to risks because the level of risk was not evaluated.
Lead agencies provided several reasons for their mixed progress, including being provided only 90 days to complete their initial assessments. A key contributing factor was that DHS's initial guidance to agencies on preparing the risk assessments did not fully address all the above activities.
Artificial intelligence is complex and evolving. It could be used to improve the systems that operate critical infrastructure, like water and energy. But it could also make them more vulnerable to cyberattacks.
Federal agencies that protect critical infrastructure had to assess AI risks to infrastructure sectors. But the Department of Homeland Security's guidance for assessments didn't have agencies fully measure how much harm an attack could cause or the probability of attacks. This information would help agencies address risks and foster responsible AI use.
DHS and CISA have made various improvements, including issuing new guidance and a revised risk assessment template in August 2024. The template addresses some—but not all—of the gaps that GAO found. Specifically, the new template does not fully address the activities for identifying potential risks including the likelihood of a risk occurring. CISA officials stated that the agency plans to further update its guidance in November 2024 to address the remaining gaps. Doing so expeditiously would enable lead agencies to use the updated guidance for their required January 2025 AI risk assessments.
AI has the potential to introduce improvements and rapidly change many areas. However, deploying AI may make critical infrastructure systems that support the nation's essential functions, such as supplying water, generating electricity, and producing food, more vulnerable. In October 2023, the President issued Executive Order 14110 for the responsible development and use of AI. The order requires lead federal agencies to evaluate and, beginning in 2024, annually report to DHS on AI risks to critical infrastructure sectors.
GAO's report examines the extent to which lead agencies have evaluated potential risks related to the use of AI in critical infrastructure sectors and developed mitigation strategies to address the identified risks. To do so, GAO analyzed federal policies and guidance to identify activities and key factors for developing AI risk assessments. GAO analyzed lead agencies' 16 sector and one subsector risk assessments against these activities and key factors. GAO also interviewed officials to obtain information about the risk assessment process and plans for future templates and guidance.
Recommendations
GAO is recommending that DHS act quickly to update its guidance and template for AI risk assessments to address the remaining gaps identified in this report. DHS agreed with our recommendation and stated it plans to provide agencies with additional guidance that addresses gaps in the report including identifying potential risks and evaluating the level of risk.
Leave a comment

CISA and ONCD Release Playbook for Strengthening Cybersecurity in Federal Grant Programs for Critical Infrastructure

Agency News, Cyber Security CII sector, Industry News
CISA and the Office of the National Cyber Director (ONCD) published Playbook for Strengthening Cybersecurity in Federal Grant Programs for Critical Infrastructure to assist grant-making agencies to incorporate cybersecurity into their grant programs and assist grant-recipients to build cyber resilience into their grant-funded infrastructure projects.
This guide is for federal grant program managers, critical infrastructure owners and operators, and organizations such as state, local, tribal, and territorial governments who subaward grant program funds, and grant program recipients. The guide includes:
- Recommended actions to incorporate cybersecurity into grant programs throughout the grant management lifecycle.
- Model language for grant program managers and sub-awarding organizations to incorporate into Notices of Funding Opportunity (NOFOs) and Terms & Conditions.
- Templates for recipients to leverage when developing a Cyber Risk Assessment and Project Cybersecurity Plan.
- Comprehensive list of cybersecurity resources available to support grant recipient project execution.
CISA encourages organizations to review and apply recommended actions to secure the nation’s critical infrastructure and enhance resilience.
Leave a comment

Future of Cybersecurity: Leadership Needed to Fully Define Quantum Threat Mitigation Strategy

Agency News, Cyber Security CII sector, Industry News
Cryptography is a set of mathematical processes that can "lock," "unlock," or authenticate information. Agencies, banks, utilities, and others rely on cryptography—e.g., data encryption algorithms—to secure systems and data.
Experts predict that a quantum computer capable of breaking such cryptography may exist within 10-20 years.
Various federal entities have developed documents that inform a national strategy for addressing this threat. But the strategy lacks details and nobody's in charge of implementing it. We recommended the National Cyber Director coordinate the national strategy and use our guidelines for effective national strategies.
GAO was asked to examine the federal government’s strategy to address the threat that quantum computers pose to our nation’s cryptography. This report provides information on, among other things, how cryptographic methods protect systems and data, the threat quantum computers pose, and the extent to which the U.S. national quantum computing cybersecurity strategy addresses the desirable characteristics of a national strategy.
Federal agencies and the nation's critical infrastructure—such as energy, transportation systems, communications, and financial services—rely on cryptography (e.g., encryption) to protect sensitive data and systems. However, some experts predict that a quantum computer capable of breaking certain cryptography—referred to as a cryptographically relevant quantum computer (CRQC)—may be developed in the next 10 to 20 years, putting agency and critical infrastructure systems at risk. Quantum computers leverage the properties of a qubit (the quantum equivalent of classical computer bits) to solve selected problems significantly faster than classical computers.
To address this threat, various documents developed over the past eight years have contributed to an emerging U.S. national strategy. Based on its review of these documents, GAO identified three central goals.
The strategy partially addresses the desirable characteristics of a national strategy identified in prior GAO work. For example:
- Problem definition and risk assessment. Several documents defined the problem as the threat of a CRQC to cryptography, but did not fully define a CRQC. In addition, although the executive branch conducted a comprehensive risk assessment on systems with vulnerable cryptography supporting critical infrastructure, it has not conducted such an assessment for systems used by federal agencies.
- Purpose, scope, and methodology. Several documents identified purpose and scope. With regard to methodology, three post-quantum cryptography standards documents provided information on how they were developed. However, the remaining documents did not describe the methodology or process used to develop them for the other two goals.
- Objectives, activities, milestones, and performance measures. The strategy documents identified objectives and activities for the first two goals but did not do so for the third. In addition, the strategy documents did not fully identify milestones for the second and third goals and did not identify performance measures for any of the three goals.
These desirable characteristics have not been fully addressed, in part, because no single federal organization is responsible for coordinating the strategy. In January 2021, Congress established an organization that is well-positioned to lead these efforts: the Office of the National Cyber Director. If the office embraces this role and ensures that the strategy fully addresses the desirable characteristics, the nation will have a better-defined roadmap for allocating resources and holding participants accountable.
Leave a comment

Weather Ready Pacific charts the way on Early Warnings for All

Agency News, Industry News, Water sector

Weather Ready Pacific - a major ten-year programme – aims at reducing the human and economic cost of severe weather events, protecting Pacific Island communities and livelihoods on the frontline of climate change.

WMO Deputy Secretary-General Ko Barrett stressed WMO’s commitment to the initiative in a high-level event at COO29 on “Early Warnings For All in the Pacific: Starting our journey to navigate through the challenges of a climate change world.”

Ministers and their representatives from Tonga, Fiji and Samoa highlighted the importance of the programme in building resilience to hazards such as tropical cyclones and coastal inundation in an era of rising sea levels and more extreme events.

Tiofilusi Tiuete, Minister for Finance and National Planning of Tonga, said there were already tangible improvements in forecasts thanks to a new weather radar which will increase the accuracy of advance warnings of high-impact events.

The Weather Ready Pacific Program was developed with the support of the Secretariat of the Pacific Regional Environment Programme (SPREP), WMO and the Government of Australia through the Australian Bureau of Meteorology (BOM). It is administered by SPREP and has a target to raise US $ 191 million over 10 years to strengthen the capacity of National Meteorological and Hydrological Services in the Pacific.

“We are committed to supporting sustainable capacity enhancement efforts wherever they occur and we stand ready to support with technical tools and guidance. National Meteorological and Hydrological Services are at the centre of all these efforts,” Ko Barrett told the high-level event.

“We are happy to leverage funding through the Systematic Observations Financing Facility (SOFF) and the Climate Risk and Early Warning Systems Initiative (CREWS) and other investment instruments to support the aims of the Weather Ready Pacific Programme and more generally of the Early Warnings for All initiative.”

Climate change ambassadors from Australia and New Zealand, two of the main financial backers, stressed how the programme is intended to foster long-term investment in sustainability. The aim is to bring different funding initiatives from a variety of partners under one roof and within a 10-year time frame, thus easing the administrative burden on Small Island Developing States.

“We have had so many projects that stop and start, stop and start. We spent more time writing reports than we do forecasting the weather,” said ‘Ofa Fa’ Anunu, the coordinator of the Weather Ready Pacific Programme. He was formerly the head of Tonga’s NMHS and president of WMO’s Regional Association for Asia-Pacific.

Systematic Observation Financing Facility (SOFF)
The Pacific represents 15 % of the world surface, but it has only six upper air stations which are compliant with the Global Basic Observing Network. This is a major gap that needs to be filled, given that a chain is only as strong as its weakest link.

SOFF seeks to fill this gap through long-term, grant based investments in infrastructure and enhancing the capacity of National Meteorological and Hydrological Services (NMHS).

Within the Pacific, Kiribati and the Solomon Islands have been approved for an amount of USD 20 million. Nauru and Samoa have been provisionally approved for an amount of USD 12 million.

Climate Risk and Early Warning Systems Initiative
Climate Risk and Early Warning Systems initiative seeks to bridge the early warnings capacity gap. Ko Barrett said CREWS is a textbook example of people-centred, community-based projects that are making a tangible difference to people’s lives.

WRP and CREWS share common programming frame and principles of country/regional driven programmes, people-centered approaches, and gender-responsiveness, said Gerard Howe, Head of Energy, Climate and Environment Directorate, UK Foreign, Commonwealth and Development Office (FCDO) and Chair of CREWS.

“CREWS is committed to support Weather Ready Pacific as a vehicle for more effective programming and financing,” he said.

Pacific Island countries benefited from one of the very first CREWS financing decisions in 2017. The CREWS Steering Committee recently initiated the consultations for a third phase of this regional project bringing the total contribution to the region to USD 25 million.

In Papua New Guinea, with the support of the Australian meteorological services, a new drought early warning system was established. In PNG, nearly eight in ten people rely on subsistence farming. Food insecurity is mostly due to crop failures from drought and frost.

Support to develop similar drought advisories has been received from 5 additional Island States and an additional US$ 5 million committed to support these.

Two countries (Tonga and Vanuatu) have accessed financing through the CREWS Accelerated Support Window a fast-track provider of technical assistance. This has led to the development of a smart weather app.

Leave a comment

Groundbreaking Framework for the Safe and Secure Deployment of AI in Critical Infrastructure Unveiled by Department of Homeland Security

Agency News, Industry News
The Department of Homeland Security (DHS) released a set of recommendations for the safe and secure development and deployment of Artificial Intelligence (AI) in critical infrastructure, the “Roles and Responsibilities Framework for Artificial Intelligence in Critical Infrastructure” (“Framework”). This first-of-its kind resource was developed by and for entities at each layer of the AI supply chain: cloud and compute providers, AI developers, and critical infrastructure owners and operators – as well as the civil society and public sector entities that protect and advocate for consumers. The Artificial Intelligence Safety and Security Board (“Board”), a public-private advisory committee established by DHS Secretary Alejandro N. Mayorkas, identified the need for clear guidance on how each layer of the AI supply chain can do their part to ensure that AI is deployed safely and securely in U.S. critical infrastructure. This product is the culmination of considerable dialogue and debate among the Board, composed of AI leaders representing industry, academia, civil society, and the public sector. The report complements other work carried out by the Administration on AI safety, such as the guidance from the AI Safety Institute, on managing a wide range of misuse and accident risks.
America’s critical infrastructure – the systems that power our homes and businesses, deliver clean water, allow us to travel safely, facilitate the digital networks that connect us, and much more – is vital to domestic and global safety and stability. These sectors are increasingly deploying AI to improve the services they provide, build resilience, and counter threats. AI is, for example, helping to quickly detect earthquakes and predict aftershocks, prevent blackouts and other electric-service interruptions, and sort and distribute mail to American households. These uses do not come without risk, and vulnerabilities introduced by the implementation of this technology may expose critical systems to failures or manipulation by nefarious actors. Given the increasingly interconnected nature of these systems, their disruption can have devastating consequences for homeland security.
“AI offers a once-in-a-generation opportunity to improve the strength and resilience of U.S. critical infrastructure, and we must seize it while minimizing its potential harms. The Framework, if widely adopted, will go a long way to better ensure the safety and security of critical services that deliver clean water, consistent power, internet access, and more,” said Secretary Alejandro N. Mayorkas. “The choices organizations and individuals involved in creating AI make today will determine the impact this technology will have in our critical infrastructure tomorrow. I am grateful for the diverse expertise of the Artificial Intelligence Safety and Security Board and its members, each of whom informed these guidelines with their own real-world experiences developing, deploying, and promoting the responsible use of this extraordinary technology. I urge every executive, developer, and elected official to adopt and use this Framework to help build a safer future for all.”
If adopted and implemented by the stakeholders involved in the development, use, and deployment of AI in U.S. critical infrastructure, this voluntary Framework will enhance the harmonization of and help operationalize safety and security practices, improve the delivery of critical services, enhance trust and transparency among entities, protect civil rights and civil liberties, and advance AI safety and security research that will further enable critical infrastructure to deploy emerging technology responsibly. Despite the growing importance of this technology to critical infrastructure, no comprehensive regulation currently exists.
DHS identified three primary categories of AI safety and security vulnerabilities in critical infrastructure: attacks using AI, attacks targeting AI systems, and design and implementation failures. To address these vulnerabilities, the Framework recommends actions directed to each of the key stakeholders supporting the development and deployment of AI in U.S. critical infrastructure as follows:
- Cloud and compute infrastructure providers play an important role in securing the environments used to develop and deploy AI in critical infrastructure, from vetting hardware and software suppliers to instituting strong access management and protecting the physical security of data centers powering AI systems. The Framework encourages them to support customers and processes further downstream of AI development by monitoring for anomalous activity and establishing clear pathways to report suspicious and harmful activities.
- AI developers develop, train, and/or enable critical infrastructure to access AI models, often through software tools or specific applications. The Framework recommends that AI developers adopt a Secure by Design approach, evaluate dangerous capabilities of AI models, and ensure model alignment with human-centric values. The Framework further encourages AI developers to implement strong privacy practices; conduct evaluations that test for possible biases, failure modes, and vulnerabilities; and support independent assessments for models that present heightened risks to critical infrastructure systems and their consumers.
- Critical infrastructure owners and operators manage the secure operations and maintenance of key systems, which increasingly rely on AI to reduce costs, improve reliability and boost efficiency. They are looking to procure, configure, and deploy AI in a manner that protects the safety and security of their systems. The Framework recommends a number of practices focused on the deployment-level of AI systems, to include maintaining strong cybersecurity practices that account for AI-related risks, protecting customer data when fine-tuning AI products, and providing meaningful transparency regarding their use of AI to provide goods, services, or benefits to the public. The Framework encourages critical infrastructure entities to play an active role in monitoring the performance of these AI systems and share results with AI developers and researchers to help them better understand the relationship between model behavior and real-world outcomes.
- Civil society, including universities, research institutions, and consumer advocates engaged on issues of AI safety and security, are critical to measuring and improving the impact of AI on individuals and communities. The Framework encourages civil society’s continued engagement on standards development alongside government and industry, as well as research on AI evaluations that considers critical infrastructure use cases. The Framework envisions an active role for civil society in informing the values and safeguards that will shape AI system development and deployment in essential services.
- Public sector entities, including federal, state, local, tribal, and territorial governments, are essential to the responsible adoption of AI in critical infrastructure, from supporting the use of this technology to improve public services to advancing standards of practice for AI safety and security through statutory and regulatory action. The United States is a world leader in AI; accordingly, the Framework encourages continued cooperation between the federal government and international partners to protect all global citizens, as well as collaboration across all levels of government to fund and support efforts to advance foundational research on AI safety and security.
President Biden directed Secretary Mayorkas to establish the Board to advise the Secretary, the critical infrastructure community, other private sector stakeholders, and the broader public on the safe and secure development and deployment of AI technology in our nation’s critical infrastructure. Secretary Mayorkas convened the Board for the first time in May 2024, and Board Members identified a number of issues impacting the safe use and deployment of this technology, including: the lack of common approaches for the deployment of AI, physical security flaws, and a reluctance to share information within industries.
The Framework is designed to help address these concerns and complements and advances existing guidance and analysis from the White House, the AI Safety Institute, the Cybersecurity and Infrastructure Security Agency, and other federal partners.
Leave a comment

CISA Releases Insights from Red Team Assessment of a U.S. Critical Infrastructure Sector Organization

Agency News, Industry News
The Cybersecurity & Infrastructure Security Agency (CISA) has released Enhancing Cyber Resilience: Insights from CISA Red Team Assessment of a U.S. Critical Infrastructure Sector Organization in coordination with the assessed organization. This cybersecurity advisory details lessons learned and key findings from an assessment, including the Red Team’s tactics, techniques, and procedures (TTPs) and associated network defense activity.
This advisory provides comprehensive technical details of the Red Team’s cyber threat activity, including their attack path to compromise a domain controller and human machine interface (HMI), which serves as a dashboard for operational technology (OT).
CISA encourages all critical infrastructure organizations, network defenders, and software manufacturers to review and implement the recommendations and practices to mitigate the threat posed by malicious cyber actors and to improve their cybersecurity posture.
For more information on the most common and impactful threats, tactics, techniques, and procedures, see CISA’s Cross-Sector Cybersecurity Performance Goals.
Leave a comment

TSA announces proposed rule that would require the establishment of pipeline and railroad cyber risk management programs

Agency News, Cyber Security CII sector, Industry News
The Transportation Security Administration (TSA) has published a Notice of Proposed Rulemaking that proposes to mandate cyber risk management and reporting requirements for certain surface transportation owners and operators.
“TSA has collaborated closely with its industry partners to increase the cybersecurity resilience of the nation’s critical transportation infrastructure,” said TSA Administrator David Pekoske. “The requirements in the proposed rule seek to build on this collaborative effort and further strengthen the cybersecurity posture of surface transportation stakeholders. We look forward to industry and public input on this proposed regulation.”
This rule proposes to continue TSA’s commitment to performance-based requirements. Building on the performance-based cybersecurity requirements TSA previously issued via annual Security Directives since 2021, the proposed rule leverages the cybersecurity framework developed by the National Institute of Standards and Technology and the cross-sector cybersecurity performance goals developed by the Cybersecurity and Infrastructure Security Agency (CISA).
Consistent with these requirements and standards, this rule proposes:
- To require that certain pipeline, freight railroad, passenger railroad and rail transit owner/operators with higher cybersecurity risk profiles establish and maintain a comprehensive cyber risk management program;
- To require these owner/operators, and higher-risk bus-only public transportation and over-the-road bus owner/operators, currently required to report significant physical security concerns to TSA to report cybersecurity incidents to CISA; and
- To extend to higher-risk pipeline owner/operators TSA’s current requirements for rail and higher-risk bus operations to designate a physical security coordinator and report significant physical security concerns to TSA.
TSA asserts that maintaining an effective cybersecurity posture is critically important to ensuring that the surface transportation sector is prepared for, and able to manage, cyber risks. The requirements contained in this proposed rule would strengthen cybersecurity resilience across the surface transportation systems sector.
Leave a comment ,

CISA Launches #PROTECT2024 Election Threat Updates Webpage

Agency News, Cyber Security CII sector, Industry News
The Cybersecurity and Infrastructure Security Agency (CISA) has launched a new one-stop shop website for election threat updates from CISA and its federal government partners. As foreign actors continue their efforts to influence and interfere with the 2024 elections, CISA is ensuring that information about the election threat environment is readily accessible.
Part of the larger #Protect2024 site launched in January, the page aims to make it easier to find specific threat related products that the American public can use to stay informed and the election community can use to prepare, including:
- Joint Statements from CISA, ODNI and FBI on threats to the 2024 election
- ODNI Election Threat Updates
- FBI and CISA “Just So You Know” Joint PSA Series
Since its initial launch, #Protect2024 has quickly grown and serves as the central point for critical resources, training lists and security services to support more than 8,000 election jurisdictions for the 2024 election cycle.
Leave a comment
1 2 3 4 5 6 … 57