CISA and FBI Launch Operation Flashpoint to Raise Awareness about How to Prevent Bomb Making

Agency News, Industry News, Power/Energy/Oil & Gas sector, Telecomms sector, Transport sector
The U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Justice’s Federal Bureau of Investigation (FBI) announced a new pilot program called “Operation Flashpoint” to build awareness in communities across the U.S. about how to prevent bomb attacks.
At the pilot’s launch today at Revell Ace Hardware in Clinton, Miss., CISA and FBI officials highlighted the threat posed by domestic violent extremists and others who can build improvised explosive devices (IEDs) from common household items found at retail stores across the country. Approximately 250,000 businesses in the U.S. sell, use or distribute materials that can be used to build bombs.
IEDs pose a significant threat in the U.S. In 2020 alone, there were 2,061 total bomb threat, suspicious package and device-related incidents across the nation, according to CISA’s Office for Bombing Prevention TRIPwire report. Major bombings can cause mass casualty events and cost hundreds of millions of dollars or more.
The 90-day Operation Flashpoint pilot, which will include events in other cities including Columbia, S.C.; Louisville, Ky.; and Orlando/Tampa, Fla., encourages businesses and the public to voluntarily report suspicious activities, such as buying large amounts of chemicals and materials (or a combination of these) that can be used to build bombs.
“Operation Flashpoint is a major milestone in implementing U.S. policy to thwart bomb threats,” said Dr. David Mussington, Executive Assistant Director for CISA’s Infrastructure Security Division. “It shows the strong unity in the federal government, between the Department of Justice and the Department of Homeland Security, to safeguard citizens and critical infrastructure.”
Leave a comment , , ,

Digital regulators need to collaborate to “build forward better” after COVID

Agency News, Industry News, Telecomms sector
​​​​​​​​Bold regulatory approaches are needed to guide ground-breaking technology uptake, foster collaboration, and drive digital transformation in the post-COVID world, according to participants at the latest Global Symposium for Regulators (GSR-21) organized by the International Telecommunication Union (ITU).
The meetings brought together regulators from around the world to tackle the persistent, growing, global digital divide. In part, this involved adopting new guidelines for inclusive information and communication technology (ICT) regulation to “build forward better" and drive post-COVID recovery.
“Following the global social and economic disruption brought about by the COVID-19 pandemic, regulators have a unique opportunity to rethink and reshape policy principles and regulatory best practices to build ubiquitous, open and resilient digital infrastructure," said ITU Secretary-General Houlin Zhao.
Focus on holistic digital transformation
COVID-19 has prompted countries to seek more holistic, future-ready agendas for digital transformation. Accordingly, regulators discussed the need for collaborative leadership to ensure trust in the digital space; sufficient connectivity and regulatory enablers; financing to ensure affordable connectivity, meaningful access, and widespread use; safe digital inclusion; and partnerships for digital transformation.
“Effective regulation matters not just in times of crisis," said Doreen Bogdan-Martin, Director of ITU's Telecommunication Development Bureau. “To build forward better in the post-COVID digital world, we need agile and ground-breaking approaches and tools for digital regulation to accelerate the sustainable and inclusive growth of ICTs. Connectivity, access and use are ultimately at the heart of the digital transformation. Along with fit-for-purpose regulatory approaches, these are the predominant enablers of competitiveness and key to the future prosperity of people, communities, countries and regions everywhere."
New GSR-21 Best Practice Guidelines
Innovative tools and approaches are outlined in the newly released GSR-21 Best Practice Guidelines: Regulatory uplift for financing digital infrastructure, access and use. ​
Approaches to ICT regulation need to be globally consistent yet flexible, allowing each national framework to be tailored to meet local needs, regulators taking part in GSR-21 agreed.
Mercy Wanjau, Acting Director-General of the Communications Authority of Kenya and Chair of GSR-21, said: “The regulatory Best Practice Guidelines crafted and adopted by regulators and policy makers at GSR have been guiding all of us through challenges and new endeavours. I call upon regulators everywhere to leverage the GSR-21 Guidelines in adopting and implementing globally agreeable approaches that are relevant to their national circumstances and leverage collaboration across the board."
The guidelines emphasise the need for a collaborative, whole-of-government approach to regulation, focusing particularly on the role of effective and agile financing, prototyping regulatory patterns and approaches, and transformational leadership, to drive faster and more inclusive connectivity and ensure safe digital inclusion for all in the wake of the pandemic.
Key recommendations include:
- Alternative mechanisms for funding and financing digital infrastructures across economic sectors. Regulators should encourage investment and help to create competitive markets for future-proof broadband and digital services. Investment is also needed in non-commercial areas to make digital services available and affordable for all, while ensuring that basic regulatory needs are met.
- Promotion of local innovation ecosystems that enable the development of emerging technologies and business models. Regulators must create a safe space for digital innovation and experimentation. New approaches to regulation should protect consumers while encouraging market growth and ensuring resilience in future networks and services.
- Spectrum innovation and efficient use. New approaches may be needed to enhance regulatory foresight, harness data to target interventions, and create space for regulators and industry to experiment together. Spectrum innovation is just one such example.
- Ambitious yet executable regulatory roadmaps. The proposed best practices from GSR 21, if widely adopted, could help countries leapfrog ahead in economic development, maximize the benefits of ICT uptake, and ensure that these immense opportunities reach everyone.
In addition to the GSR-21 Best Practice Guidelines, GSR-21 saw the release of several new publications and platforms​:  Financing Universal Access to Digital Technologies and Services, Econometric Modelling in the context of COVID-19, collaborative case studies, and ICT Regulatory Tracker 2020​.
Leave a comment , , ,

Coordinated Action Cuts Off Access to VPN Service Used by Ransomware Groups

Agency News, Cyber Security CII sector, Industry News
Law enforcement and judicial authorities in Europe, the US and Canada have seized the web domains and server infrastructure of DoubleVPN. This is a virtual private network (VPN) service which provided a safe haven for cybercriminals to attack their victims.
This coordinated takedown, led by the Dutch National Police (Politie), under jurisdiction of the National Public Prosecutor’s Office (Landelijk Parket), with international activity coordinated by Europol and Eurojust, has now ended the availability of this service.
Servers were seized across the world where DoubleVPN had hosted content, and the web domains were replaced with a law enforcement splash page. This coordinated takedown was carried out in the framework of the European Multidisciplinary Platform Against Criminal Threats (EMPACT).
DoubleVPN was heavily advertised on both Russian and English-speaking underground cybercrime forums as a means to mask the location and identities of ransomware operators and phishing fraudsters. The service claimed to provide a high level of anonymity by offering single, double, triple and even quadruple VPN-connections to its clients.
DoubleVPN was being used to compromise networks all around the world. Its cheapest VPN-connection cost as little as €22 ($25).
INTERNATIONAL COORDINATION
International cooperation was central to the success of this investigation as the critical infrastructure was scattered across the world.
- Europol’s European Cybercrime Centre (EC3) supported the investigation from the onset, bringing together all the involved countries to establish a joint strategy. Its cybercrime specialists organised over 30 coordination meetings and four workshops to prepare for the final phase of the takedown, alongside providing analytical and crypto-tracing support. A virtual command post was set up by Europol on the action day to ensure seamless coordination between all the authorities involved in the takedown.
- Eurojust facilitated the judicial cross-border cooperation and coordination, to ensure an adequate response in order to take down the network. For this purpose, and since October last year, six dedicated coordination meetings took place, organised by Eurojust, and set up a coordination centre during the action day, during which the operation was rolled on the ground by the various national authorities involved.
Leave a comment , , ,

Countries ramp up cybersecurity strategies

Agency News, Cyber Security CII sector, Industry News
ITU releases fourth edition of the Global Cybersecurity Index; key 2020 data points to increased commitment
​​​​The latest Global Cybersecurity Index (GCI) from the International Telecommunication Union (ITU) shows a growing commitment around the world to tackle and reduce cybersecurity threats.
Countries are working to improve their cyber safety despite the challenges of COVID-19 and the rapid shift of everyday activities and socio-economic services into the digital sphere, the newly released 2020 index confirms.
According to GCI 2020, around half of countries globally say they have formed a national computer incident response team (CIRT), indicating an 11 per cent increase since 2018. Rapid uptake of information and communication technologies (ICTs) during the COVID-19 pandemic has put cybersecurity at the forefront.
“In these challenging times, the unprecedented reliance on ICTs to drive society, economy and industry, makes it more important than ever before to secure cyberspace and build confidence among users," affirmed ITU Secretary General Houlin Zhao. “Governments and industry need to work together to make ICTs consistently safe and trustworthy for all. The Global Cybersecurity Index is a key element, offering a snapshot of the opportunities and gaps that can be addressed to strengthen every country's digital ecosystem."
Some 64 per cent of countries had adopted a national cybersecurity strategy (NCS) by year-end, while more than 70 per cent conducted cybersecurity awareness campaigns in 2020, compared to 58 per cent and 66 per cent, respectively, in 2018.
Addressing the cyber gap
Many countries and regions lag in key areas. These include:
- ​Cybersecurity skills training, which must be tailored to the needs of citizens, micro-, small-, and medium-sized enterprises (MSMEs);
Finance, healthcare, energy, and other key sectors, which require dedicated measures to close cybersecurity gaps;
- Critical infrastructure protection, which requires enhancement to meet new and evolving cyber threats;
- Individual data protection, which requires continual reinforcement as online activity expands.
Growing reliance on digital solutions necessitates ever stronger, yet also accessible and user-friendly, data protection measures.
Leave a comment , , ,

NSA Releases Guidance on Securing Unified Communications and Voice and Video over IP Systems

Agency News, Cyber Security CII sector, Industry News
NSA released a Cybersecurity Technical Report that provides best practices and mitigations for securing Unified Communications (UC) and Voice and Video over IP (VVoIP) call-processing systems. The comprehensive report, “Deploying Secure Unified Communications/Voice and Video over IP Systems,” also describes potential risks to UC/VVoIP systems that aren’t properly secured.
To complement the larger report, NSA published an abridged Cybersecurity Information Sheet to capture key takeways and introduce the steps organizations should take when securing their UC/VVoIP systems.
UC and VVoIP are workplace call-processing systems that provide a variety of collaboration tools as well as the flexibility to communicate using voice, video conferencing and instant messaging. The access to advanced call-processing features and centralization of management have made UC and VVoIP popular in enterprise environments, including National Security System, Department of Defense and Defense Industrial Base networks.
The IP infrastructure that enables UC/VVoIP systems also presents risks that were less prevalent in the prior generation of call centers. If UC/VVoIP systems are not properly secured, they are susceptible to the same malicious activity targeting existing IP systems through spyware, viruses, software vulnerabilities or other malicious means. Malicious actors could penetrate the IP networks to eavesdrop on conversations, impersonate users, commit toll fraud and perpetrate denial of service attacks. High-definition room audio and video could also be covertly collected.
To securely deploy UC/VVOIP systems, NSA provides best practices to use when preparing networks, establishing network perimeters, using enterprise session controllers and adding endpoints to deploy a UC/VVOIP system.
Methods to minimize the risk to UC/VVOIP systems include segmenting the networks to limit access to a common set of devices, ensuring timely patching, authentication and encryption of all signaling and media traffic, and verifying the security of devices before adding them to a network.
Leave a comment , , ,

Microsoft update on brute force and password spraying activity

Agency News, Cyber Security CII sector, Industry News
The NCSC has issued advice to organisations following an update from Microsoft on malicious cyber campaigns.
Microsoft has revealed that it had identified new activity from an Advanced Persistent Threat (APT) known as NOBELIUM targeting organisations globally.
The Microsoft Threat Intelligence Center says that this activity was mostly unsuccessful.
The NCSC has observed an increase in activity as part of malicious email and password spraying campaigns against a limited number of UK organisations. We are supporting those affected and would urge all organisations to familiarise themselves with our guidance on mitigating phishing attacks, including how to block phishing emails and how to implement two-factor/multi-factor authentication:
- Phishing attacks: defending your organisation
- Multi-factor authentication for online services
- Identity and access management (part of the 10 steps to cyber security collection)
- Home working: preparing your organisation and staff
The following blog posts from Microsoft provide further details, including IoCs, detection and mitigation advice:
- New Nobelium activity – Microsoft Security Response Center
- Investigating and Mitigating Malicious Drivers – Microsoft Security Response Center
- Nobelium Resource Center – updated March 4, 2021 – Microsoft Security Response Center
Leave a comment , , ,

NSA Funds Development, Release of D3FEND

Agency News, Cyber Security CII sector, Industry News
D3FEND, a framework for cybersecurity professionals to tailor defenses against specific cyber threats is now available through MITRE.  NSA funded MITRE’s research for D3FEND to improve the cybersecurity of National Security Systems, the Department of Defense, and the Defense Industrial Base. The D3FEND technical knowledge base of defensive countermeasures for common offensive techniques is complementary to MITRE’s ATT&CK, a knowledge base of cyber adversary behavior.
D3FEND establishes terminology of computer network defensive techniques and illuminates previously-unspecified relationships between defensive and offensive methods. This framework illustrates the complex interplay between computer network architectures, threats, and cyber countermeasures.
MITRE released D3FEND as a complement to its existing ATT&CK framework, a free, globally-accessible knowledge base of cyber adversary tactics and techniques based on real-world observations. Industry and government use ATT&CK as a foundation to develop specific cyber threat models and methodologies.
Complementary to the threat-based ATT&CK model, D3FEND provides a model of ways to counter common offensive techniques, enumerating how defensive techniques impact an actor’s ability to succeed. By framing computer network defender complexity of countermeasure functions and techniques as granularly as ATT&CK frames computer network attacker techniques, D3FEND enables cybersecurity professionals to tailor defenses against specific cyber threats, thereby reducing a system’s potential attack surface. As a result, D3FEND will drive more effective design, deployment, and defense of networked systems writ large.
Frameworks such as ATT&CK and D3FEND provide mission-agnostic tools for industry and government to conduct analyses and communicate findings. Whether categorizing adversary behavior or detailing how defensive capabilities mitigate threats, frameworks provide common descriptions that empower information sharing and operational collaboration for an ever-evolving cyber landscape.
Leave a comment , , ,

WMO Executive Council endorses unified data policy

Agency News, Industry News, Water sector
In a milestone decision, the World Meteorological Organization’s Executive Council has endorsed a unified policy on the international exchange of Earth system data to help its Members meet the explosive growth in demand for weather, climate and water services as the world grapples with the dual challenges of climate change and the increasing frequency of extreme weather events.
The draft data policy resolution, which must be adopted by the full 193-Member World Meteorological Congress extraordinary session scheduled for October 2021, paves the way for a sweeping update of policies on the free and unrestricted exchange of data that have been the bedrock of WMO since it was established more than 70 years ago.
The WMO Unified Policy for the International Exchange of Earth System Data is based on WMO’s strategic integrated Earth system approach to all monitoring and prediction of weather, climate, water and related environmental phenomena, and it will serve as the foundation of a wider push to strengthen the global observing networks and help overcome regional disparities.
“In order to meet the demand for services and forecasts, it is paramount to improve the exchange of weather, climate, water and ocean data. Severe gaps in data and weather observations, especially in Africa and island states, have a major negative impact on the accuracy of early warnings both locally and globally,” said WMO Secretary-General Prof. Petteri Taalas.
“A revision of WMO’s data policy will leverage benefits for the whole of society and will allow our global community to work better together to deliver services that protect life, livelihoods and property,” said Prof. Taalas.
“It is a very, very important step to have such a unified data policy for WMO,” said WMO President Gerhard Adrian. “We have many decisions on data policy, and now we have a united approach where all these parts are collected.”
“This is a great milestone, and a historical moment,” said Michel Jean, President of WMO’s Infrastructure Commission, which had developed the data policy resolution approved.
Numerical Weather Prediction
Delivery of weather and climate services depends on routine international exchange of weather and climate data, 24/7, 365 days per year, often within minutes of real time.
Observations are ingested into numerical prediction models, and the output from these models is used as a basis for weather and climate services. A primary aim with the establishment of WMO in 1951 was to create a coordination mechanism for the acquisition and international exchange of such data.
WMO’s current data policies are laid out in three separate Congress resolutions - Resolution 40 (Congress-XII, 1995, covering weather) and two subsequent resolutions (Resolution 25 (Cg-XIII) and Resolution 60 (Cg-17)) covering water and climate.
The new WMO Unified Data Policy resolution, in comparison, covers seven domains and disciplines - covering all WMO-relevant Earth system data - in a single policy statement, and it thus extends beyond the traditional areas of weather, climate and water data to incorporate also the areas of atmospheric composition, oceans, cryosphere and space weather.
Increasing the volume of observations that are shared internationally for use in global and regional Numerical Weather Prediction (NWP) models will help significantly improve the quality of these data products. The policy will also provide developing countries with better access to these key data products. The resulting improvement in forecasts and other services will be felt everywhere on the globe, but it will be especially pronounced in areas where the current observational data coverage is poor, including in many developing countries.
In addition, the data policy resolution expands from addressing just national meteorological and hydrological services to endorsing relevant data exchange among all partners, including agencies beyond meteorological and hydrological services, the rapidly growing private sector and academia.
Leave a comment ,

Climate Risk and Early Warning Systems mobilizes more funding

Industry News, Water sector
The Climate Risk and Early Warning Systems (CREWS) Initiative is mobilizing an additional US$ 28 million to deliver early warning systems in Least Developed Countries (LDCs) and small island developing States (SIDs) to protect lives and livelihoods from the impacts of severe weather.
Countries and regions that have early warning systems as a priority in their climate change nationally determined contribution and adaptation plans are identified as priorities for future funding decisions based on their high level of eligibility, ownership and readiness.
The decision to provide financing of US$ 28 million was made possible thanks to new contributions this year to the CREWS Trust Fund by member countries and a recent announcement by the European Commission, Directorate-General for International Partnerships of a Euro 10 million commitment to the CREWS Initiative.
A further encouraging decision for least developed countries, is the proposed establishment of a new financing window to address critical, time-bound climate-relevant early warning services. The proposed CREWS Strategic Support Window will address emerging needs and deliver a flexible array of fully funded technical and knowledge services by experts and advanced national meteorological and hydrological agencies. This proposed new service will be available to countries by the end of the year.
The above decisions support the roll-out of the CREWS Operational Plan 2021-2025 which provides the template for scaling up support to LDC and SIDS for early warnings that are impact-based and people-centered. The Operational Plan set a blueprint for a stronger participation of the private sector in country operations. The CREWS Operational Plan was formally approved during the meeting.
Countries that contribute to the CREWS Initiative are Australia, Finland, France, Germany, Luxembourg, the Netherlands, Switzerland and the United Kingdom.
Leave a comment ,

GAO Cybersecurity Report and Recommendations for HHS

Agency News, Cyber Security CII sector, Industry News
The Government Accountability Office (GAO) wants HHS to improve cybersecurity efforts by strengthening collaboration within the department and with the broader healthcare sector.
Health care organizations' IT systems are critical to the nation's well-being. Cyberattacks on them could, for example, put patient privacy at risk or disrupt essential telehealth services. (The nation's cybersecurity is on our High Risk List.)
The Department of Health and Human Services coordinates with health care organizations and others to support cybersecurity efforts. Its policies and procedures clearly describe roles and responsibilities, which is good for collaboration.
GAO is making seven recommendations to HHS to improve its collaboration and coordination within the department and the sector:
1. The HHS secretary should have the CIO overseeing the coordination and sharing of cybersecurity information between the Health Sector Cybersecurity Coordination Center and Healthcare Threat Operations Center.
2. The HHS secretary should order the CIO to monitor, evaluate and report on the progress and performance of the HHS Chief Information Security Officer Council, Continuous Monitoring and Risk Scoring Working Group, and Cloud Security Working Group.
3. HHS should direct the assistant secretary for preparedness and response to monitor, evaluate and report on the progress and performance of the Government Coordinating Council's Cybersecurity Working Group and HHS Cybersecurity Working Group.
4. HHS should have the CIO regularly monitor and update written agreements that describe how the HHS Chief Information Security Officer Council, Continuous Monitoring and Risk Scoring Working Group, and Cloud Security Working Group will collaborate and ensure that officials review and approve the updated agreements.
5. HHS should direct the assistant secretary for preparedness and response to ensure that authorizing officials review and approve the charter describing how the HHS Cybersecurity Working Group will manage collaboration.
6. HHS should have the assistant secretary for preparedness and response do the following: finalize written agreements that include a description of how the Government Coordinating Council's Cybersecurity Working Group will work together; identify the working group's roles and responsibilities; monitor and update the written agreements on a regular basis; and ensure that authorizing officials leading the working group approve the final agreements.
7. HHS should tell the assistant secretary for preparedness and response to update the charter for the Joint Healthcare and Public Health Cybersecurity Working Group for the current fiscal year and ensure that authorizing officials overseeing the group review and approve the updated charter.
Leave a comment , , ,
1 … 32 33 34 35 36 … 60