CISA and Partners join ASD’S ACSC to Release Advisory on PRC State-Sponsored Group, APT 40

CISA has collaborated with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC) to release an advisory, People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action outlining a PRC state-sponsored cyber group’s activity. The following organizations also collaborated with ASD's ACSC on the guidance:
- The National Security Agency (NSA);
- The Federal Bureau of Investigation (FBI);
- The United Kingdom’s National Cyber Security Centre (NCSC-UK);
- The Canadian Centre for Cyber Security (CCCS);
- The New Zealand National Cyber Security Centre (NCSC-NZ);
- The German Federal Intelligence Service (BND) and Federal Office for the Protection of the Constitution (BfV);
- The Republic of Korea’s National Intelligence Service (NIS) and NIS’ National Cyber Security Center (NCSC); and
- Japan’s National Center of Incident Readiness and Strategy for Cybersecurity (NISC) and National Policy Agency (NPA).
The advisory is based on current ACSC-led incident response investigations and shared understanding of a PRC state-sponsored cyber group, APT40—also known as Kryptonite Panda, GINGHAM TYPHOON, Leviathan and Bronze Mohawk in industry reporting.
APT 40 has previously targeted organizations in various countries, including Australia and the United States. Notably, APT 40 possesses the ability to quickly transform and adapt vulnerability proofs of concept (POCs) for targeting, reconnaissance, and exploitation operations. APT 40 identifies new exploits within widely used public software such as Log4J, Atlassian Confluence and Microsoft Exchange to target the infrastructure of the associated vulnerability.
CISA urges all organizations and software manufacturers to review the advisory to help identify, prevent, and remediate APT 40 intrusions. Software vendors are also urged to incorporate Secure by Design principles into their practices to limit the impact of threat actor techniques and to strengthen the security posture of their products for their customers.

Securing Critical Infrastructure With Validated and Trusted AI

AI is changing cybersecurity – providing new tools for security professionals, but also giving cyber threat actors a better arsenal of weapons for their attacks. Fortress is leveraging the latest in GenAI to better identify and understand the supply chain risks critical infrastructure organizations face.
Fortress's AI Monitoring, tailor made for the unique threats Critical Infrastructure organizations face, enables security pros to get quicker and more accurate data on the most critical risks and vulnerabilities across vendors and products. In short, it's a new evolution in cyber supply chain risk management (C-SCRM) and third-party cybersecurity risk management (TPCRM).
"AI is changing cybersecurity, but it is not the cure-all to national security threats from nation-state adversaries," said Fortress CEO and co-founder Alex Santos. "We were extremely deliberate in how we decided to deploy AI in our solutions. AI-enabled data retrieval without collaborative data sharing and human validation leaves large blind spots and generates false positives that divert resources from fighting the most pressing challenges. However, AI combined with a comprehensive approach to cyber defenses can quickly identify the 'needles in the haystack' that pose the most critical risks."
AI gives Fortress the ability to reduce risk assessment and monitoring costs by up to 90% and discover risks more than 80% faster. Using the latest in GenAI, Fortress automates the retrieval and analysis of vendor and product risk resulting in actionable, prioritized, and conclusive steps to empower security and risk management teams and keep your organization safe.
Besides generating comprehensive insights alerting organizations to emerging risks faster, Fortress integrates with legacy systems that can be omnipresent in critical infrastructure and streamlines government and energy regulatory compliance to simplify complex and time-consuming audits administered by regulatory enforcement.
"Certainly, there is an industry-wide push to get AI integrated into cybersecurity products as fast as possible," said Santos. "Others saw AI as a 'move fast and break things' moment. We knew AI had to be done right and done responsibly. We knew by working hand in hand with our customers that AI had to be done right and responsibly. Our AI Monitoring suite is built for today's rapidly changing and complex cyber supply chain and third-party attack surfaces. We've allowed our clients to stay one step ahead."

Hybrid threats: Council paves the way for deploying Hybrid Rapid Response Teams

The European Council has approved the guiding framework for the practical establishment of the EU Hybrid Rapid Response Teams. This paves the way for such teams to be deployed upon request, to prepare against and counter hybrid threats and campaigns.
Hybrid Rapid Response Teams are one of the key instruments to support EU member states and partner countries in countering hybrid threats as part of the EU Hybrid Toolbox. As one of the key deliverables of the Strategic Compass, they will provide tailored and targeted short-term assistance to member states, Common Security and Defence Policy missions and operations, and partner countries in countering hybrid threats and campaigns.
In a deteriorating security environment, with increasing disinformation, cyber-attacks, attacks on critical infrastructure, instrumentalised migration, and election interference by malign actors, the Hybrid Rapid Response Teams will be an important new capability of the EU to counter new and emerging threats.

Your latest issue of Critical Infrastructure Protection & Resilience News has arrived

Download your copy now at www.cip-association.org/CIPRNews
Please find here your downloadable copy of the Spring 2024 issue of Critical Infrastructure Protection & Resilience News, the official magazine of the International Association of CIP Professionals (IACIPP), for the latest views, features and news, including a Review of the recent Critical Infrastructure Protection & Resilience North America conference and exhibition in Lake Charles, LA.
Critical Infrastructure Protection & Resilience News in this issue:
- Protecting Life - Securing Agriculture
- Protect our Electric Grid – Before it’s Too Late
- Connecting Unrelated Industries Strengthens All Sectors
- Why Airspace Awareness Matters for Critical Infrastructure Security
- Critical Infrastructure Resilience: Are we addressing the real challenges? In the right way?
- Break down cyber and physical security silos to improve protection and operations
- An Interview with CITGO
- Is Cybersecurity As Enchanted as Sleeping Beauty?
- CIPRE Review
- Agency News
- Industry News
Download your copy at www.cip-association.org/CIPRNews

Custom-made Awareness Raising to enhance Cybersecurity Culture

The European Union Agency for Cybersecurity (ENISA) empowers organisations by publishing the updated version of the ‘Awareness Raising in a Box’.
Advanced protection of systems and a robust cybersecurity strategy have become a priority for all kinds of organisations, as cybersecurity issues and threats have evolved to be increasingly sophisticated and pervasive. Thus, awareness raising activities and having a relevant methodology in place are a fundamental to integrating cybersecurity in the organisational culture. With a view to achieve this goal, applying game design elements in cybersecurity awareness activities can simplify familiarisation with terms and concepts through a hands-on experience and motivate employees’ participation.
To test the new edition of the all-in-one toolkit, ENISA piloted the Awareness Raising in a Box (AR-in-a-BOX) with the Cypriot Digital Security Authority and the Cypriot National Coordination Centre.
The Head of the Cypriot Digital Security Authority, Diamantis Zafeiriades, highlighted that "The Digital Security Authority (DSA) and the Cyprus National Coordination Centre for Cybersecurity (NCC-CY) is proud to be working along with the European Union Agency for Cybersecurity (ENISA) to test and promote the Awareness Raising in a Box’ (AR-in-a-BOX), which aims to boost knowledge on cybersecurity awareness techniques. Acknowledging that cyber resilience is a constant training journey for the unpredictable, we are committed to support such initiatives on an ongoing basis."
AR-in-a-Box allows professionals from small and medium (SMEs) to big enterprises and public or private entities, to improve their knowledge on cybersecurity awareness techniques. This comprehensive toolkit offers a blend of theoretical frameworks and practical resources, enabling organisations to craft tailored cybersecurity awareness programmes, including gamification of content.
Notably, the updated version features an online Cyber Awareness Game accessible through the EU ACADEMY.
The updated version of AR-in-a-Box includes the existing catalogue of instructions, games and activities but has also been enriched with the addition of a new guide for the development of internal and external cyber crisis communication plans.
The cyber crisis communication guide aims to help organisations and experts improve their communicational preparedness and response, in times of a cybersecurity crisis. As such incidents may impact several aspects of their operations, the guide provides a holistic approach on their protection and mitigation of risks and damages.

Geopolitics Accelerates Need For Stronger Cyber Crisis Management

ENISA publishes a study on ‘Best Practices for Cyber Crisis Management’ that assists in preparation for crisis management. The study was conducted for the EU Cyber Crisis Liaison Organisation Network (CyCLONe) and is now available publicly.

The geopolitical situation continues to impact the cyber threat landscape also within the European Union. Planning for expected or unexpected threats and incidents is vital for good crisis management.
EU Agency for Cybersecurity Executive Director, Juhan Lepassaar underlined that “Sharing best practices for Member States is a step in successfully strengthening cyber crisis management. This report serves as a tool to assist with implementing the provisions of the NIS2 Directive. Crisis management processes for business continuity are paramount.”

The study outlines the framework and circumstances with cyber crisis scenarios and proposes a series of best practices that will enable the transition into the new requirements of NIS2 Directive, the EU-wide legislation on cybersecurity. The study aims to bring a heterogeneous ecosystem towards stronger harmonisation.

The proposed best practices are clustered into the four phases of the cyber crisis management cycle (prevention, preparedness, response and recovery) and refer to issues arising during each stage with an all-hazards approach.

Concluding with a list of recommendations, ENISA proposes steps to improve Member States’ capacity-building and operational cooperation in the context of cyber crisis management.

Cyber Crisis Management Framework through NIS2
The long history of the EU regarding cybersecurity, and particularly cyber crisis, proves its commitment in building a solid legislative framework to safeguard Member States from emerging threats. Built upon the first directive on Network and Information Security (NIS) that was set in 2016, the NIS2 entry into force marks a transformative period in the field of cybersecurity in the EU due to the new, upgraded provisions and obligations for Member States to incorporate into their national legislation. A key change brought by the adoption of NIS2 includes the reinforced role of ENISA in coordinating cybersecurity actors, such as EU-Cyber Crises Liaison Organisation Network (EU-CyCLONe) and the EU CSIRTs Network.

The European cyber crisis liaison organisation network (EU-CyCLONe)
Under NIS2 Directive, ENISA’s mandate has a role as the secretariat for Cyber Crises Liaison Organisation Network (EU CyCLONe), a network dedicated to enhance Member States’ national authorities’ cooperation in cyber crisis activities and management.

The network collaborates and develops information sharing and situational awareness based on the support and tools provided by ENISA. The network is chaired in turns by a representative from the Presidency of the Council of the EU.

Formed by the representatives of Member States’ cyber crisis management authorities, the EU CyCLONe intervenes together with the European Commission in case of large-scale cybersecurity incidents likely to have a significant impact on services and activities falling into the scope of the NIS2. ENISA also supports the organisation of exercises for EU CyCLONe members, such as CySOPex (played by officers) and as, in this case, BlueOLEx (played by executives).

ENISA pioneers the development of proper mechanisms and consistency for cyber incidents, crisis management and conducting cyber exercises. ENISA is tasked to roll-out the implementation of the Cybersecurity Support Action in 2022 that includes the provision of support to Member States to further mitigate the risks of large-scale cybersecurity incidents in the short term.

Shaping Cybersecurity Policy towards a trusted and secure Europe

European Union Agency for Cybersecurity (ENISA),the European Commission (DG CNECT) and the Belgian presidency of the Council of the European Union organised the 2nd EU Cybersecurity Policy Conference.
This year significant attention was dedicated to the ongoing implementation process of the latest EU cybersecurity policies, both from the national and EU perspective. Against the backdrop of evolving geopolitical developments and the ever-shifting cyber threat landscape, discussions also touched upon the complexities and hurdles within the cybersecurity world and how they will eventually shape the policy priorities.
The first panel covered the deployment of Active Cyber Protection (ACP) measures by Member States within the existing EU legislation and policy framework and the means to boost it by building smart regulatory mechanisms and collaborative implementation.
The second round of discussions addressed market and product challenges, and particularly the digital product and services certification requirements that have attracted the attention of the cybersecurity community.
The topic of certification was also approached in the light of the skills gap that we are facing and its link with building cyber resilience in the EU. On the occasion of the Cybersecurity Certification week and the current progress on the matter, the EU Agency for Cybersecurity is also holding the Annual Cybersecurity Certification Conference on in Brussels.
The Belgian State Secretary for Digitalisation, Mathieu Michel, highlighted that “Cybersecurity and its future policy is a topic of the utmost importance for Belgium, and for Europe, because it is a cornerstone for our future digital and economic growth. I don’t think it is a coincidence that our overall Presidency motto ‘Protect, Strengthen, and Prepare’, is so central to cybersecurity in general. In a world where technology is evolving at a rapid pace, where cyber threats are multiplying and becoming more complex, it is imperative that we adapt our cybersecurity approach to address unprecedented challenges. A flexible, adaptable, and proactive approach to cybersecurity is the guarantee to create vital trust in the ongoing digital transformation, and to make sure that new technologies are secure.”
EU Agency for Cybersecurity Executive Director, Juhan Lepassaar, stated that “Implementing the cybersecurity legal framework of the last two years and ensuring the operational capabilities to deal with emerging cyber challenges will be our measure of success. These ongoing discussions will enable the Agency to propose recommendations in the first ever State of Cybersecurity in the Union report that will direct Europe's strategic mission for a high common level of cybersecurity.”
Among the themes of the conference was the implementation process of the NIS2 Directive provisions and its impact on critical infrastructure sectors, the necessity for more synergies between defence and civilian cybersecurity communities, as well as the emergence of global cybersecurity threats, combined with the rise of new technologies, such as AI, and how policy foresight in this domain might contribute towards better cybersecurity preparedness.
In 2023, ENISA developed the NIS 360 methodology to do an assessment of NIS sectors on an annual basis, to understand better their overall maturity, criticality and to identify areas for improvement. The first edition covered 10 NIS sub-sectors. The policy framework in the finance sector is the most mature, while the telecoms, digital infrastructure, trust and finance sectors are scoring the highest in risk management.

CISA Unveils New Public Service Announcement – We Can Secure Our World

Cybersecurity and Infrastructure Security Agency (CISA) has launched We Can Secure Our World, the second PSA in its Secure Our World cybersecurity public awareness program. The PSA will be promoted widely across the U.S. on television, radio, digital ads, retail centers, social media platforms, and billboards throughout 2024. We Can Secure Our World builds on the success of CISA’s first ever public service announcement (PSA) which launched in September 2023.
A Pew Research Center survey conducted last year shows that 95% of American adults use the internet, 90% have a smartphone and 80% subscribe to high-speed internet at home. Additionally, the survey also reported nearly 70% of children and adolescents have been exposed to at least one cyber risk in the past year. With cyber threats increasing among Americans of all ages, CISA is working to empower all Americans to protect themselves from hackers getting into their devices through easy steps that anyone can do anywhere and anytime.
The Secure Our World cybersecurity public awareness program, initially launched in September 2023, with its first PSA receiving nearly 20,000 views on YouTube, and educational materials including “How to” videos and tip sheets, were downloaded approximately 50,000 times. CISA also had a video that aired at the NFL Experience in the week leading up to the Super Bowl. CISA had a Super Bowl-related social media campaign that garnered more than 200,000 views and reached audiences spanning America’s diverse population.
The Secure Our World program is designed to educate and empower individuals to take proactive steps in safeguarding their digital lives. Tapping into the nostalgia of beloved musical cartoon series from the 1970s and 1980s, the new PSA features lovable character Max from the first PSA and introduces “Joan the Phone” who teaches us how to stay safe online. Through engaging messaging encouraging simple steps to protect ourselves online, the program aims to raise awareness about the importance of cybersecurity and empower individuals to adopt best practices to mitigate online risks.
“Basic cyber hygiene prevents 98% of cyber attacks—why we’re on a mission to make cyber hygiene as common as brushing our teeth and washing our hands. BUT(!) “cyber” anything can seem overly technical and complicated to the vast majority of Americans from K through Gray—why we’re also on a mission to make such information more accessible,” said CISA Director Jen Easterly. “As someone who grew up with Saturday morning cartoons, I am super excited about what we’ve done with our new Secure Our World PSA to leverage a recognizable educational medium to promote cybersecurity best practices. We’re really excited to take public awareness of cyber safety to a whole new level of creativity.”

CISA Announces Secure by Design Commitments from Leading Technology Providers

CISA has announced voluntary commitments by 68 of the world’s leading software manufacturers to CISA’s Secure by Design pledge to design products with greater security built in.
“More secure software is our best hope to protect against the seemingly never-ending scourge of cyberattacks facing our nation. I am glad to see leading software manufacturers recognize this by joining us at CISA to build a future that is more secure by design,” CISA Director Jen Easterly said. “I applaud the companies who have already signed our pledge for their leadership and call on all software manufacturers to take the pledge and join us in creating a world where technology is safe and secure right out of the box.”
A list of the 68 companies, including leading software manufacturers, participating in the pledge can be found at the Secure by Design Pledge page, and statements of support for the pledge can be read here.
By catalyzing action by some of the largest technology manufacturers, the Secure by Design pledge marks a major milestone in CISA’s Secure by Design initiative. Participating software manufacturers are pledging to work over the next year to demonstrate measurable progress towards seven concrete goals. Collectively, these commitments will help protect Americans by securing the technology that our critical infrastructure relies on.
“A more secure by design future is indeed possible. The items in the pledge directly address some of the most pervasive cybersecurity threats we at CISA see today, and by taking the pledge software manufacturers are helping raise our national cybersecurity baseline,” CISA Senior Technical Advisor Jack Cable said. “Every software manufacturer should recognize that they have a responsibility to protect their customers, contributing to our national and economic security. I appreciate the leadership of those who signed on and hope that every technology manufacturer will follow suit.”
The seven goals of the pledge are:
- Multi-factor authentication (MFA). Within one year of signing the pledge, demonstrate actions taken to measurably increase the use of multi-factor authentication across the manufacturer’s products.
- Default passwords. Within one year of signing the pledge, demonstrate measurable progress towards reducing default passwords across the manufacturers’ products.
- Reducing entire classes of vulnerability. Within one year of signing the pledge, demonstrate actions taken towards enabling a significant measurable reduction in the prevalence of one or more vulnerability classes across the manufacturer’s products.
- Security patches. Within one year of signing the pledge, demonstrate actions taken to measurably increase the installation of security patches by customers.
- Vulnerability disclosure policy. Within one year of signing the pledge, publish a vulnerability disclosure policy (VDP) that authorizes testing by members of the public on products offered by the manufacturer, commits to not recommending or pursuing legal action against anyone engaging in good faith efforts to follow the VDP, provides a clear channel to report vulnerabilities, and allows for public disclosure of vulnerabilities in line with coordinated vulnerability disclosure best practices and international standards.
- CVEs. Within one year of signing the pledge, demonstrate transparency in vulnerability reporting by including accurate Common Weakness Enumeration (CWE) and Common Platform Enumeration (CPE) fields in every Common Vulnerabilities and Exposures (CVE) record for the manufacturer’s products. Additionally, issue CVEs in a timely manner for, at minimum, all critical or high impact vulnerabilities (whether discovered internally or by a third party) that either require actions by a customer to patch or have evidence of active exploitation.
- Evidence of intrusions. Within one year of signing the pledge, demonstrate a measurable increase in the ability for customers to gather evidence of cybersecurity intrusions affecting the manufacturer’s products.
Each goal has core criteria which manufacturers are committing to work towards, in addition to context and example approaches to achieve the goal and demonstrate measurable progress. To enable a variety of approaches, software manufacturers participating in the pledge have the discretion to decide how best they can meet and demonstrate the core criteria of each goal, but progress should be demonstrated in public.
CISA’s global Secure by Design initiative, launched last year, implements the White House’s National Cybersecurity Strategy by shifting the cybersecurity burden away from end users and individuals to technology manufacturers who are most able to bear it. CISA urges software manufacturers to review CISA’s Secure by Design guidance and Secure by Design alerts to build security into their products.

National Security Memorandum on Critical Infrastructure Security and Resilience

On April 30, 2024, the White House National Security Council (NSC) published the National Security Memorandum (NSM) on Critical Infrastructure Security and Resilience. This memo builds on the important work that the Cybersecurity and Infrastructure Security Agency (CISA) and agencies across the federal government have been undertaking in partnership with America’s critical infrastructure communities for more than a decade. It also replaces Presidential Policy Directive 21 (PPD-21) on Critical Infrastructure Security and Resilience, which was issued more than a decade ago to establish national policy on critical infrastructure security and resilience.
Why Now?
Image of infrastructure-related icons over glowing, streaks of blue and white  lights
The threat environment has significantly changed since PPD-21 was issued, shifting from counterterrorism to strategic competition, advances in technology like Artificial Intelligence, malicious cyber activity from nation-state actors, and the need for increased international coordination. This change in the threat landscape, along with increased federal investment in U.S. critical infrastructure, prompted the need to update PPD-21 and issue the new memo.
The NSM will help ensure U.S. critical infrastructure can provide the nation a strong and innovative economy, protect American families, and enhance our collective resilience to disasters before they happen, strengthening the nation for generations to come. This NSM specifically:
- Empowers the Department of Homeland Security to lead a whole-of-government effort to secure U.S. critical infrastructure, with CISA acting as the National Coordinator for the Security and Resilience of U.S. Critical Infrastructure. The Secretary of Homeland Security will be required to submit to the President a biennial National Risk Management Plan that summarizes U.S. government efforts to mitigate risk to the nation’s critical infrastructure.
- Reaffirms the designation of 16 critical infrastructure sectors and establishes a federal department or agency responsible for managing risk within each of these sectors.
- Elevates the importance of minimum security and resilience requirements within and across critical infrastructure sectors, consistent with the National Cyber Strategy, which recognizes the limits of a voluntary approach to risk management in the current threat environment.
PPD-21 pre-dates the establishment of CISA. CISA actively engaged in updating the framework established by PPD-21 to detail how the U.S. government secures and protects critical infrastructure from cyber and physical threats.
CISA has already been working toward the goals of the NSM. We have already re-established the Federal Senior Leadership Council, which has made impressive strides through the FSLC’s robust collaboration model toward meeting our shared goals. When the FSLC was re-chartered, the group not only took on new authorities, but a heavy lift to inform how we define, modernize, and protect our critical infrastructure sectors.
1 2 3 29