Democrats’ big win on Election Day, which saw them take control of both the House and Senate, has ramifications for the Cybersecurity and Infrastructure Security Agency, artificial intelligence, surveillance policy and much more.

Here’s what lawmakers and cybersecurity experts have to say about the short-term and long-term prospects on Capitol Hill.

Leadership plans ahead

Maggie Hassan, D-N.H. is in line to take the gavel on the Senate Homeland Security and Governmental Affairs Committee, with Sen. Gary Peters, Mich., retiring.

“Our government’s number one job is to keep people safe, and the Senate Homeland Security and Governmental Affairs Committee must work to ensure that our country remains safe, secure and free from all kinds of threats,” Hassan said in a statement to CyberScoop. “That work involves protecting against terrorism and fentanyl trafficking, but it also includes guarding against emerging threats like artificial intelligence security risks and strengthening our cybersecurity.”

“The Trump-Vance administration has undermined our security on these fronts, including by diverting resources away from combatting fentanyl trafficking and gutting CISA,” she continued. “We need to reverse these cuts, confront these challenges and put public safety first.”

Rep. Bennie Thompson, D-Miss., is poised to return once again as chair of the House Homeland Security Committee, said Democrats are taking over at a “pivotal time for CISA,” with it looking to add staff after cutting back by nearly one-third.

“First and foremost, we will aim to work with CISA to expedite its critical re-staffing effort and to ensure it has the expertise necessary to support stakeholders as they defend against the scale and velocity of AI-enabled cyber-attacks,” he said in a statement to CyberScoop. “Advances in AI can help defenders, but it will also accelerate the consequences of deferred investments in security and CISA must be well-positioned to help critical infrastructure owners and operators rapidly improve their cybersecurity posture.”

“We will prioritize getting resources straight into the hands for defenders — by extending the State and Local Cybersecurity Grant Program and improving support of under-resourced sectors, especially water,” he continued. “We will work to ensure CISA re-establishes its cross-sector coordination capacity, which was diminished when the Trump administration- terminated CIPAC, by making sure the Anchor-CI is eventually up and running and meets the needs of stakeholders. Finally, we will make sure CISA is well-positioned to support the secure development and deployment of AI.”

What happens in the lame-duck session

Before the GOP relinquishes control of the House and Senate to Democrats, though, there’s a lame-duck session ahead. 

Long-term renewal of the Cybersecurity Information Sharing Act of 2015 (CISA 2015) is a bipartisan and industry priority, with it set to expire Dec. 11. Current Senate Homeland Security and Governmental Affairs Chairman Rand Paul, R-Ky., has been the biggest obstacle to reauthorization, but he could get “rolled” by GOP leadership on an extension, said Michael Garcia, a former government cyber official and vice president of the cybersecurity practice at Monument Advocacy. Possible vehicles for CISA 2015 to hitch a ride include an omnibus funding bill or the annual defense policy bill.

The Department of Homeland Security, and its subagency CISA, are currently operating on a continuing resolution that’s also set to expire Dec. 11, where lawmakers could temporarily extend CISA 2015 if a long-term solution can’t be reached in the lame duck. Another continuing resolution before Dec. 11 in lieu of an omnibus spending bill is an option for the lame duck. Both a CR and omnibus spending bill would theoretically include DHS funding, although the agency’s funding has been made more difficult in the past by the presence of Immigration and Customs Enforcement within the department.

Republicans have talked about wanting to get the fiscal 2027 National Defense Authorization Act done in the lame duck. Besides the possibilities of CISA 2015 being included in the bill, Nicholas Leiserson, senior vice president for policy at the Institute for Security and Technology, said the Senate version of the legislation has a pair of very noteworthy cyber provisions: a “very broad” authorization for contractor-owned, contractor-operated offensive cyber operations, and a requirement that every artificial intelligence product sold to the Defense Department have an AI bill of materials.   

Additional leadership shuffle

While Paul is losing his gavel, he’s shown he can be a disruptive force on passing cybersecurity legislation through the Senate in the minority. That makes what he does next possibly determinative for cyber bills, Leiserson and Garcia said. “If he leaves HSGAC, let a thousand cyber bills flourish!” Garia quipped on social media. Paul could opt to become the top Republican on the Senate Health, Education, Labor and Pensions Committee instead of HSGAC.

Nebraska Sen. James Lankford would take over for Paul as top HSGAC Republican in that scenario, and an industry source said he’s viewed as a supporter of CISA 2015.

On Senate Intelligence, the panel’s leadership goes to a lawmaker who has placed a big emphasis on cybersecurity in his congressional career: Mark Warner, D-Va. 

On the House side, while Rep. Andrew Garbarino, R-N.Y., moves to the minority on the Homeland Security panel, he has proven willing to collaborate with Democrats on cybersecurity issues. Rep. Delia Ramirez, D-Ill., is poised to take the gavel of the panel’s cybersecurity subcommittee, and Rep. Vince Fong, R-of California looks set to become the subcommittee’s top Republican and has his own history of bipartisanship. Fong would replace current subcommittee chair Andy Ogles, the far-right Tennessee Republican who lost in the primaries.

One thing to watch in the House, Leiserson said, is how the House looks to tackle AI — through existing committees, a select committee or some other structure. Democrats haven’t put forward a unified front on AI guardrails yet.

With AI models uncovering as many vulnerabilities as they are, “highly capable frontier models are going to drive a lot of discussion” about AI and cybersecurity, said Craig Albright, the Business Software Alliance’s senior vice president for U.S. government relations.

Appropriations, oversight, legislation

If the NDAA or a CISA 2015 extension don’t pass in the lame duck, they’d be priorities in 2027, too.

“CISA 2015 has to happen, and if we can’t get it done, then we can’t move to the next thing,”  said Henry Young, BSA’s policy director. “Once we get it done, there’s an open question about which of these priorities that we’ve talked about gets to be number one. Is it post-quantum cryptography? Is it government IT modernization? Is it frontier AI cybersecurity systems? We don’t know that yet, and we can’t know until we pass this law.”

How damaged the agency CISA is by Trump administration’s budget cuts is something Democrats are expected to scrutinize closely. Another top budget issue is what to do with the expired State and Local Cybersecurity Grants Program housed at DHS, since even if it’s reauthorized, it will require appropriators taking steps to invest in it.

Democrats could take a look at a variety of other Trump administration changes at DHS and CISA, on topics like election security, the Cyber Safety Review Board, the Joint Cyber Defense Collaborative and more. 

More broadly, Leiserson said an area of Democratic cyber oversight is likely to be the Department of Government Efficiency that cut cyber personnel at agencies at and beyond CISA, and “particularly the integrity of systems that DOGE touched when they were given very high privileged access to federal systems.”

If the White House puts forward a permanent nominee for director of CISA, Democrats would be poised to vet that person. They also would have a say in who leads the Office of the National Cyber Director, should the incumbent, Sean Cairncross, depart.

So far, Democrats haven’t put forward a unified posture on expired surveillance authorities known as Section 702, although both Warner and incoming House Intelligence Chairman Jim Himes, D-Conn., have fought in the past for its renewal. The surveillance program is operating similarly still due to a court order, but that order only lasts through next spring.

The post What Democratic control of Congress means for cybersecurity appeared first on CyberScoop.

An attacker with a working credential may find the system already open to them.

That is the uncomfortable reality behind the Cybersecurity and Infrastructure Security Agency’s (CISA) new strategy, “CISA 2030: Defend, Harden, Prevail.” The strategy prioritizes operational technology security, software supply chain integrity and continuity of essential services. It also acknowledges that strong defenses cannot guarantee that intrusions will stop.

Federal agencies face these dependencies in building controls, research facilities and other operational systems. A compromised contractor credential or unverified update can turn an infrastructure problem into a mission disruption.

How much infrastructure still trusts a device, software update or machine identity simply because it was approved once? Meeting CISA’s goals requires examining those approvals, including those no one remembers granting.

Yesterday’s approval becomes today’s exposure

A controller can stay in service for decades while its firmware, credentials, suppliers and connections change around it. A maintenance contractor leaves. A remote connection outlives its purpose. The hardware remains in place. The original reason for trusting it may no longer hold.

An inventory is a starting point. Knowing a controller exists says little about whether its software is authentic, who can change its configuration or which systems depend on its credentials.

Those questions cross organizational boundaries. Device security, software assurance and identity management may each have an owner. If every team owns one piece of trust, who owns the failure between them?

CISA’s goals for operational technology visibility, anomaly detection and supply chain integrity should push operators to answer that question. Someone must be accountable for how devices, code and identities interact throughout their operational lives.

That means verifying software before deployment, protecting signing keys and reassessing access when suppliers or roles change. Even then, authenticity has limits. A valid signature can confirm software origin and integrity. Whether the software is safe for a particular environment is a separate question.

AI turns access into operational authority

That distinction matters more when software can initiate action. Consider an AI agent evaluated for equipment diagnostics and maintenance. Reading diagnostic data and changing an equipment setting carry very different consequences. An authenticated agent with excessive permissions is still a threat to operations.

Before deployment, operators should define which models, tools and data the agent may use, which credentials it can obtain and which actions require human approval. Those restrictions must be enforced when the agent acts. Records should show what it did, whose authority it used and whether required approvals were obtained.

A model’s willingness to follow instructions cannot be the security boundary. Controls should stay consistent when models change or work moves between cloud platforms. Otherwise, each upgrade risks reopening access decisions that security teams thought were settled. Better technology must preserve control over what it can access or change.

Make resilience an acceptance test

Federal technology and acquisition leaders should make those controls a condition of acceptance. Buyers should ask suppliers how they provision device identities, verify updates, retire credentials and help customers recover after a compromise. Contracts should assign responsibility for maintaining those capabilities after deployment.

Investment should follow CISA’s focus on consequences. Which credential could interrupt a federal research facility’s operations? Which signing key could distribute a compromised update across a fleet? Which agent could alter a process affecting worker safety?

Then test whether those permissions can be withdrawn safely.

If withdrawing one compromised credential brings down an essential service, the architecture has failed its resilience test. Exercises should expose those dependencies by testing isolation, credential replacement and restoration of verified software while essential functions continue. Legacy equipment may need compensating controls until it is replaced.

CISA has committed to an implementation and outcome-measurement approach within 180 days. One measure should be whether operators can identify compromised trust, revoke access and restore verified systems while keeping essential services running.

That requires governing trust throughout the life of every device, software component and identity, including AI agents. Approval must come with enforceable limits, continuing verification and a tested way to withdraw it. An agency that cannot safely revoke access remains dependent on the very trust an attacker can exploit. CISA’s strategy will prove its value when operators can break that dependency before it causes an outage.

The post CISA’s new strategy runs into America’s blind trust problem appeared first on CyberScoop.

The Office of the National Cyber Director has rolled out its second regional cyber pilot program, this one focused on rural hospitals.

National Cyber Director Sean Cairncross visited South Carolina on Monday to debut the six-month program, Project Lifeline 250, which connects industry with rural hospitals. The concept is similar to the first pilot program in Texas that connected industry with the water sector.

“Project Lifeline 250 connects the world-leading American industry with rural hospitals and uses the greatest American tools and capabilities to defend hospital networks; deploy physical back up devices after an initial incident to ensure an impacted hospital can still provide critical care; and identify high-risk and legacy devices and replace them,” Cairncross said in a statement.

The health care sector had a record year for breaches last year, with 804 large breaches reported to the Health and Human Services Department’s Office for Civil Rights that affected more than 140 million people. The FBI identified the sector as the top target for ransomware and other hackers in 2025.

Rural hospitals, like the water sector, lack resources compared to other kinds of critical infrastructure.

Besides industry and the ONCD, the effort is a project that draws in the South Carolina Critical Infrastructure Cybersecurity program, the South Carolina Law Enforcement Division and local governments in the state.

“Cyber threats are a rising challenge to our nation’s security, and we must remain vigilant to protect the systems our communities depend on,” said South Carolina Gov. Henry McMaster. “Project Lifeline 250 is another important step toward ensuring South Carolina’s rural hospitals have the resources they need to defend against cyberattacks and continue providing critical care.”

Some of the same companies involved in providing free services in the Texas pilot are involved in the South Carolina pilot, too, along with some new participants. Among the participating firms: Abnormal AI, Cisco, Cyera, Microsoft, Rilian Partners, Trellix and Zscaler.

“The stakes for critical infrastructure are getting higher and higher,” said Yotam Segev, cofounder and CEO of Cyera. “There’s real urgency in bringing cyber expertise from some of the world’s largest and most complex enterprises to rural hospitals through Project Lifeline 250. When a hospital knows where its patient data lives and who can reach it, it can reduce the leverage behind ransomware. Every community should have that clarity, no matter the size of the hospital or its IT team.”

Members of Congress also have introduced legislation designed to aid rural hospital cybersecurity.

The ONCD hasn’t said what will happen at the end of the six-month pilots. And so far it has only partnered, or publicly discussed partnering with, GOP-led states.

The post National cyber director rolls out latest pilot in South Carolina, this time for rural hospitals appeared first on CyberScoop.

The Cybersecurity and Infrastructure Security Agency published a strategy Monday that focuses on taking a leading role in cyber defense, prioritizing protection of critical infrastructure and building the ability to withstand attacks.

The 10-page strategy — “CISA 2030: Defend, Harden, Prevail” —  largely reaffirms existing roles for the agency, but CISA will begin reviewing its core services and capabilities within 60 days to make sure they meet key objectives, followed by implementation over the next 180 days and an update on its progress after one year.

Acting CISA Director Nick Andersen said in a foreword that the agency needs to act with “renewed purpose” in the face of threats.

“The threat landscape we face today is not static,” he said. “Nation-state actors and other malicious adversaries continue to grow more sophisticated in their efforts to compromise our networks, and there is no guarantee that a strong defense will eliminate intrusions. As President Trump has reminded us, resilience must be the foundation of our approach. We must ensure that when adversaries gain a foothold, we are prepared to detect them quickly, evict them decisively, and keep critical operations running without interruption.”

The strategy is also meant to align with the administration’s broader cyber strategy, published in March, and last year’s executive order on state and local preparedness.

“I call on every company and organization in the critical infrastructure community — from owners and operators to vendors and technology manufacturers — to act now,” Andersen said in a comment released with the strategy. “CISA 2030 provides a focused roadmap to strengthen defenses, eliminate adversarial footholds, and deny them any advantage that could endanger the nation’s security, economy, or public health.”

Within each section of the strategy, there are other goals listed.

Under “defend: lead national cyber defense,” the key objectives are to integrate state, local and industry cyber defense; protect operational technology; developing guidance and best practices on software security; and assess and develop emerging technologies.

Under “harden: prioritize national infrastructure security,” the key objectives are to coordinate intelligence for critical infrastructure; analyze infrastructure data; work with international partners; and emphasize strengthening the nation’s most important infrastructure.

Under “prevail: mobilize national resilience,” the key objectives are to invest in critical infrastructure resilience; strengthen national communications interoperability; modernize planning and exercises; and build next-generation interoperable infrastructure.

Critics say much of CISA has been badly diminished by budget cuts at the agency by the Trump administration, including many of them specifically a focus of the new strategy, that have left it understaffed.

The last strategic plan at the agency, published in 2023, also had three pillars: address immediate threats, harden the terrain and drive security at scale.

The post CISA publishes strategy with eye on the next four years appeared first on CyberScoop.

Bojan Lepic reports: A cyber extortion group has threatened to publish data it claims it stole from 38 shipping, port, and logistics companies unless they pay multimillion-dollar ransoms by October 19. Cybersecurity firm SOCRadar said the group, known as n0n, added the 38 organisations to its dark web leak site in a single batch on...

Source

Anthropic announced a new program Thursday that will combine its AI tools with outside cybersecurity companies to find and fix cybersecurity vulnerabilities in critical infrastructure and open-source software.

Advertised as part of a new, “long-term commitment” to cybersecurity, the critical infrastructure defense program will pair Claude models, Anthropic engineers and threat research with the expertise of cybersecurity companies, including Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation.

“Defenders of critical infrastructure and the [open-source software] community have decades of security experience but have faced severe resource shortages that are exacerbated by this moment,” Anthropic wrote in a blog post. “We are recognizing their expertise in these domains and offering our support.”

Anthropic said it has offered frontier models and technical support to more than half the states in the U.S., as well as large operators of critical infrastructure to scan and patch code or assist in incident response and red teaming activities.

“Critical infrastructure is hard to defend in many ways that AI cannot fix, but we believe that frontier models can help find and repair weaknesses before those weaknesses are used to cut off power or make water unsafe, the company wrote. “Our first step is to work with a small cohort of providers to learn which strategies are most effective and practical.”

The company said it has engaged in similar work with maintainers of large open-source software projects, and some organizations asked for everything the model had found in their software, even unreviewed findings.

That spurred Anthropic to create a new opt-in scanning service for open source software, where organizations can get free, periodic scans of their projects with a proof of concept, explanation and suggested patching options. Anthropic noted that under this program, organizations will receive their reports faster but they may contain inaccuracies.

The long-term goal is to automate most triage and patching and develop new security architectures and coding standards.

As AI models have developed increasingly powerful cybersecurity capabilities, such as finding and exploiting known vulnerabilities, frontier AI companies have worried that bad actors could gain access to the tools faster than legitimate organizations. Anthropic and OpenAI have since both started programs funneling their tech to businesses and governments, free of charge, for defensive cybersecurity.

The post Anthropic rolls out program for ‘long-term commitment’ to secure critical infrastructure, open source software appeared first on CyberScoop.

The Justice Department and FBI announced that they had seized two hacking tools connected to the Chinese government-linked group Flax Typhoon and a China-based company that the U.S. government has repeatedly taken action against, including with a new multi-agency advisory Thursday.

The domain name seizures were meant to deny hackers access to the vulnerability scanning tool Microscan and the spearphishing tool FishHub created by the Chinese firm Integrity Technology Group, which the United States sanctioned last year. The U.S. government in 2024 also made the company the focus of a takedown operation, saying it was behind a massive botnet.

Authorities were granted the court-authorized seizures in the Western District of Pennsylvania, the FBI and DOJ announced Thursday in unsealing documents in the case.

U.S. agencies paired the announcement of the seizures with an advisory from the FBI, Cybersecurity and Infrastructure Security Agency and National Security Agency.

“Chinese government-linked cyber threat actors, enabled by the Integrity Technology Group, are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, including U.S. critical infrastructure sectors,” the advisory reads. “These actors exploit vulnerabilities by using scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers, while establishing persistence through VPN software and exfiltrating emails and credentials using scripts.”

Similar to previous allegations, law enforcement said Integrity Tech leaned on a Mirai-variant botnet of internet-of-things devices, in this case to facilitate Microscan.

Microscan targets have included a South Carolina power company, airports in Japan and Poland, critical infrastructure companies and universities in Taiwan and others, according to the FBI and DOJ. Victims of FishHub, which downloads malware on their networks after gaining access through spearphishing, include Taiwanese universities.

“Chinese government-affiliated actors continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the aim of disrupting critical functions at a future time of their choosing,” said Chris Butera, acting executive assistant director for cybersecurity at CISA. 

“Under the FBI Cyber Strategy, we pursue both the actors who threaten critical infrastructure and the enterprises that support them,” said Brett Leatherman, head of the FBI’s Cyber Division. “Integrity Technology Group, a China-based company with ties to the Chinese government, is one of those enterprises, acquiring or developing cyber tools and hosting infrastructure for actors targeting networks worldwide.”

The post DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub appeared first on CyberScoop.

Federal government contractors that handle sensitive information could soon face a “sea change” in rules about how they protect that information and report when it has been part of a breach.

Pending federal regulations on the handling of “controlled unclassified information,” or CUI, a category of sensitive data that falls short of classified — including people’s personal information such as Social Security numbers, information that could expose vulnerabilities in critical infrastructure and more — could arrive as soon as the end of this year, but likely no later than the end of President Donald Trump’s term, attorneys who specialize in federal procurement rules said. The changes are part of a larger overhaul of federal contracting rules.

As currently written, the proposed CUI rules mandate that unauthorized access of such data, including as a result of a cyberattack, would have to be reported to the federal government within 72 hours of discovery. The rules are a companion for most federal agencies to existing  Defense Department rules that cover the same subject. The 72-hour notice also is deliberately aligned with forthcoming rules from the Cybersecurity and Infrastructure Security Agency (CISA) for critical infrastructure owners and operators to report major cyber incidents under the Cybersecurity Incident Reporting for Critical Infrastructure Act (CIRCIA).

The CUI rules require contractors to adhere to minimum electronic security standards for protecting that sensitive information. Experts said the rules could expose contractors who fail to comply with cybersecurity guidelines to penalties under the False Claims Act, a lever that the federal government has been using increasingly since 2022 to punish contractors over lackluster cyber safeguards.

It’s “going to be a sea change for a lot of companies,” said Trayce Howard, a government contracts partner at Wiley Rein. 

“If it’s finalized in the form that it’s in now, it will be a fairly significant change for federal contractors,” said Ryan Burnette, a partner at Covington focused on government contracts and technology.

Susan Cassidy, another partner at Covington who advises government contractors, said the proposed regulation is part of a journey that began as far back as an executive order in 2010, when officials realized they couldn’t have sufficient, consistent requirements for protecting CUI given that so many agencies used different terminology for it: “sensitive but unclassified,” “for official use only,” and more.

The proposed rule is intended to “make it easier for contractors to comply with one set of standards, rather than many different types of standards” for the protection of CUI and the reporting on CUI incidents such as breaches, she said.

One industry source who spoke on condition of anonymity was candid about the difficulties CUI poses.

“CUI can be painful for many industry stakeholders because it’s not always clear what constitutes CUI,” the source said. “Many contractors will say they don’t necessarily know exactly what CUI is, despite their best efforts. Information from agencies isn’t always clearly marked as CUI.”

The reporting requirements

An earlier draft of the rule gave industry groups more heartburn: It had an 8-hour standard for reporting CUI incidents, rather than 72, and it required reporting of suspected incidents as well.

Still, a number of industry groups objected to the 72-hour standard, despite it being part of a much-sought after attempt to align federal breach reporting notification standards under CIRCIA.

The Aerospace Industries Association, for instance, said in filed comments that it “reiterates concerns with these compressed timelines which will be difficult and costly for industry to comply with,” in reference to the 72-hour standard. “AIA recommends extending these timelines to 30 calendar days to accommodate improved reporting while reducing compliance costs.”

The industry source said that “72 hours is largely a policy decision, based on extensive public-private deliberation,” rather than one based on any study of what’s best.

Another point of discussion about the reporting rule as written is where contractors report incidents.

“While the 72-hour reporting window is a significant improvement over the 8-hour window in the January 2025 proposal, the June 2026 rulemaking still appears to require reporting to agency -specific points of contact … rather than to a single centralized hub,” the Chamber of Commerce wrote in its comments.

Cassidy said “it will be interesting to see how centralized reporting into CISA, which is the other place where civilian agencies go, is handled, and whether there’s coordination with DOD or whether or not we still see two separate streams going through.”

The standards

The other major aspect of the proposed rule is that contractors handling CUI would have to abide by certain cybersecurity standards set by the National Institute of Standards and Technology known as SP 800-171, which Howard and her Wiley coauthors said would be imposed “on a broader group of contractors than ever before.” Some contractors might also have to meet other cybersecurity requirements, too.

“Another thing that will affect contractors is they’re going to have to flow down these requirements to their subcontractors,” she said. “So they’re going to have to identify what CUI am I giving to my subcontractors, and do some sort of oversight to make sure that their subcontractors are appropriately handling CUI.”

Howard and other experts predict that the rules could expand who might be subjected to False Claims Act punishments.

“I do think that this creates some significant False Claims at risk for contractors,” she said. This is going to encompass a whole new universe of contractors that may not be quite ready for that… contractors that have been working for civilian agencies exclusively have not been subject to this before.”

Final steps

The next steps aren’t 100 percent clear. Howard said a final rule could arrive by the end of the year. Cassidy said either an interim rule could take effect soon, or a final rule could be issued. Burnette said a final rule might be farther away, though the Trump administration has made it clear it wants everything finalized before the end of its term.

That means contractors need to get ready, he said.

“I think contractors should really be looking at this, preparing for it in certain ways, at least by recognizing at a high level, where this is headed and the types of activities and steps they need to be doing internally,” Burnette said. “Some of the minutia and the details, those are still subject to ironing out. But generally speaking, if you look at this rule compared to the rule that we saw early last year, they are much more similar than they are different. So we are starting to see  some crystallization here of the requirements, and we’re starting to get an idea what might change and what is most likely baked at this point.”

The Office of Management and Budget did not respond to requests for comment.

The post Major rules for federal contractors handling sensitive data are nearing the finish line appeared first on CyberScoop.

Justin Doubleday reports: The Department of Homeland Security is preparing this year to award a major cloud, cybersecurity and network services contract aimed at further centralizing the management of IT services across DHS. In a notice posted to Sam.gov last month, DHS laid out the notional timeline for award of the Network, Cloud and Cybersecurity...

Source

Collaboration with industry is key to balancing AI security risks and benefits, as well as staying ahead of China and other adversarial nations, National Cyber Director Sean Cairncross said Thursday.

The Trump administration is facing pressure from some quarters of Capitol Hill and even some artificial intelligence executives to establish regulations or embrace legislation to guard against the technology’s risks, something the president himself has rejected.

“We’ve never faced a world where our adversaries have the frontier in this space, and so our attempts to optimize that innovation and security is is something that is ongoing, but is increasingly efficient, and it depends on our relationship with industry and our ability to work collaboratively among the the interagency,” Cairncross said at the AI Edge event hosted by The Washington Post.

That collaboration is ever-increasing, he said, such as with the National Institute of Standards and Technology’s Center for Advancing Innovation and Standards for Super Intelligence (CAISSI).

“Industry coordination on this, across critical infrastructure sectors, is improving both on industry-to-government and within industry,” he said. “There is collaboration with CAISSI and others as well to do evaluation and testing on these models. That includes work on guardrailing, sandboxing, et cetera.”

But “we’ve seen in the past, once the government is introduced into this space directly, there is a tendency for the government to start to want to adjust the dials directly, and it is difficult to reverse that,” he said. “I think that would slow, at this point, the innovation cycle that is to our benefit.”

One of the things that has increased the calls for stronger government action is when OpenAI acknowledged that its AI agents went outside testing to hack Hugging Face in July.

“Since that incident,” Cairncross said, “the engineering work that’s gone into improving systems awareness of that has increased by an order of magnitude.”

But the AI companies need to secure themselves against China for the United States to stay in the lead, he said.

“Both on the hardware side and on the computer science side and engineering, we’re in the lead. I think our lead is significant,” Cairncross said. “The Chinese have designed a sort of fast follow that relies quite a bit on distillation efforts … And I think industry is increasingly aware of this: that their systems are secure, that the technology, as it’s being developed, is protected.”

Other administration officials have called out China for allegedly using distillation to train its models. In July, Michael Kratsios, who leads the White House Office of Science and Technology Policy, claimed that Moonshot AI, a Beijing, China-based AI company, had distilled Anthropic’s recently released Fable model to develop its own K3 model.

On Wednesday, OpenAI said clusters of activity tied to Moonshot AI were part of a “coordinated” distillation campaign.

Cairncross said earlier this week that the U.S. government is collaborating with industry to integrate AI into critical infrastructure for security purposes. 

Cairncross said the Trump administration wants to make sure national security systems do the same. One of his office’s pilot programs is with the Defense Department and the Cybersecurity and Infrastructure Security Agency “that touches on the defense infrastructure in particular,” in addition to a pilot on rural hospitals.

The post National cyber director: Government-industry collaboration vital to managing AI risks, competition with nations appeared first on CyberScoop.

The computers that automate water treatment systems across the country were built for durability, not for an internet-connected world. Many still accomplish their fundamental function, but as cyberattacks on the sector mounted this summer, water industry officials say those aging systems, especially internet-exposed operational technology and programmable logic controllers, remain among the easiest ways for adversaries to break in.

Tom Dobbins, executive director of the Water Information Sharing and Analysis Center or WaterISAC, told CyberScoop the sector’s biggest ongoing weaknesses include exposed OT, vulnerable PLCs, insecure connections through integrators and poor cyber hygiene at smaller utilities, which have pushed the center to make threat sharing faster across the sector.

“We have been under attack, and our enemies, the threat actors, are stepping up their activity as the U.S. is involved in a number of conflicts around the world,” Dobbins said.

That includes not only threats from Iran, the nation the U.S. government reportedly believes is behind this summer’s water facility attacks, but also China and Russia, he said.

WaterISAC is announcing a partnership with Cyware Wednesday to use its threat intelligence platform, selecting the company in part because of its existing relationships with other industry ISACs, Dobbins said. The ISAC already has a partnership with the National Rural Water Association to serve 20,000 of the water sector’s smallest utilities, and Dobbins said Cyware would help its analysts further.

It’s a sector that faces myriad challenges, seen by many as further behind on protecting its systems due to financial and technological constraints.

“OT systems that are exposed to the internet are a major challenge, and many of these systems that are older generation need to be not accessible to the internet,” Dobbins said.

Furthermore, programmable logic controllers (PLCs) are “obviously” a “vulnerability point,” he said. 

Those two vulnerabilities were the ones most commonly linked to this summer’s attacks.

Across the sector, PLCs have been the “main point of entry” for hackers, in part because they date back to a “simpler, gentler time,” Dobbins said.

“A lot of the equipment was developed pre-cyber threats and activities,” he said. “The equipment, it’s still valuable, it still is operational, so there’s not a huge reason for or incentive for utilities to upgrade it.”

President Donald Trump has disputed the notion that Iran was behind this summer’s attacks, despite alerts from the Cybersecurity and Infrastructure Security Agency.

“Let’s put it this way: I saw a recent CISA release that pointed to Iran as threat actors, and I know that the president kind of implied that it was not Iran, but I’ll say that CISA maybe is more expert in this area than maybe the president,” Dobbins said. “The president may not have been fully briefed when he made that comment.”

But CISA has also warned of potential threats from Russia and China, he said.

Two other sources of vulnerability for the sector are external — integrators — and internal — employees.

“If those integrators are working and they have a connection into an OT system that’s not managed discretely, then a threat actor can come in through an integrator and get into a system,” he said. 

Then there’s someone “who’s actually a good employee who’s tried to do the right thing and opens an email that has a malicious link in it, so they become subject to a phishing attack,” Dobbins said.

At smaller utilities, it can be difficult to keep up with basic cyber hygiene as well, he said: changing passwords, implementing multifactor authentication.

One way that Cyware might be able to help is by leveraging its relationships with other ISACs, said Tom Stockmeyer, managing director of government and critical infrastructure at Cyware.

“We’re thrilled to add water to the portfolio and start enabling cross-sector sharing,” he said.

The post WaterISAC reckons with range of threats after summer of cyberattacks appeared first on CyberScoop.

The U.S. government is working with critical infrastructure operators to integrate artificial intelligence into the nation’s most vital systems and strengthen cyber defenses, National Cyber Director Sean Cairncross said Tuesday.

“We have been working closely, and I believe it is functioning well to get models deployed throughout sectors as quickly as possible, and they can be used to secure systems,” he said at a USTelecom event. But he said business leaders need to pay close attention to how AI is being used.

“What CEOs should be thinking about is the agents that run on these systems and in your supply chain — having insight and visibility into who has authorization, what they are authorized to access, and where they are running in your system…  it is an important thing to be on the radar,” he said.

Cairncross made his comments before attending a lunch at the White House featuring top AI tech leaders along with President Donald Trump, Vice President J.D. Vance, and House Speaker Mike Johnson, R-La. The expected discussion topics included weighing the necessity of regulatory guardrails that AI executives have been discussing versus voluntary measures that Trump and Johnson have favored.

Some lawmakers have proposed stricter rules.

“What we’re looking for are pathways where our systems and the services they provide, the daily life that is supported by these systems, can be protected, can be upscaled, can use the the best in class technology as quickly as possible,” Cairncross said about the administration’s approach to regulation and innovation.

“The Mythos moment” in the spring, when that AI model debuted, “crystallized” the administration’s work since, he said: “I think there’s been an enormous amount of work that’s gone in across the interagency, working with industry to get those pathways in place.”

Another key component in AI and cybersecurity is less “sexy,” Cairncross said, which is creating incentives to replace aging, unsupported systems.

Cairncross made his remarks in response to questions from Jonathan Spalter, CEO of USTelecom.

“We know that just in the last six months, the effectiveness of AI models being embedded in much of our critical infrastructure has increased to a stunning degree,” Spalter said.

The post US is looking to weave AI into critical infrastructure for cybersecurity, national cyber director says appeared first on CyberScoop.

Biotechnology doesn’t fall neatly into any one of the 16 government-designated critical infrastructure sectors that receive specialized and focused attention from feds, leading some lawmakers to worry that it’s not getting the protection from cyberattacks and other risks that it needs.

That’s why a bipartisan group of senators and representatives announced legislation Thursday that would place an emphasis at the Cybersecurity and Infrastructure Security Agency on defending biotechnology, biomanufacturing and biological data.

The Protecting Biotechnology and Biomanufacturing as Critical Infrastructure Act and the Protecting Biological Data Act are two separate bills with the same group of cosponsors. Both bills would weave biotech into the law that established the Department of Homeland Security.

The former would direct DHS to come up with plans to make sure biotech and biomanufacturing are protected as critical infrastructure, but not as a whole new sector. The plans would identify key biotech players, conduct outreach to them and develop steps to update the National Infrastructure Protection Plan this year to incorporate biotech sector input.

The latter would make sure that systems handling genomic sequences and sensitive biometric data are covered as critical infrastructure and integrated into the national cyber strategy, that CISA would work with biotech players on security steps like joint exercises and that the agency would get new personnel to handle biometric data security.

In the last two months, biotech giants Boston Scientific and Amgen have revealed that they suffered recent cyberattacks.

Sponsors of the measures include leaders and members of the National Security Commission on Emerging Biotechnology, a legislative advisory group.

“Biotechnology infrastructure and data are becoming vital to America’s economic and national security,” said Commission Chair Senator Todd Young, R-Ind. “Just as we are serious about where the sensitive data of Americans is stored and who can access it, we should be equally serious about protecting our biological data and infrastructure. Designating biotech as critical infrastructure is about recognizing its strategic importance and making sure the capabilities America will depend on tomorrow remain resilient and protected from foreign threats.”

Notably, however, the bills do not seek a separate critical infrastructure category for biotech to add to the 16. Currently, biotech cuts across a number of existing sectors, including the health, agricultural and industrial sectors.

Some industry groups and experts have lobbied for the inclusion of new critical infrastructure sectors, such as space or artificial intelligence.

“Protecting biomanufacturing infrastructure and the most sensitive biological data of Americans is essential for our national security,” said commissioner Rep. Ro Khanna, D-Calif. “These bipartisan bills will help ensure we are protecting this sector from physical and cyber threats while keeping America as the world leader in biotechnology.”

The bill’s sponsors in the House are Khanna, Stephanie Bice, R-Okla. and Scott Peters, D-Calif., and in the Senate the sponsors are Young and Maggie Hassan, D-N.H.

You can read the text of the bills below.

The post House and Senate members propose legislation for CISA to step up cyber defenses for biotech appeared first on CyberScoop.

The foundation for modern society in America is under attack. State and local governments, entities that often oversee critical natural resources, schools, and hospital systems, are routinely targeted and breached by state-backed threat actors. Their budgets are simply too slim to provide the digital bulwarks required to fend off such attacks.

The problem is growing. In August, the Cybersecurity and Infrastructure Security Agency issued a joint advisory detailing an “active threat” against Siemens S7 series programmable logic controllers (PLCs), ruggedized industrial devices that read field sensors, execute control logic on a fixed cycle, and drive equipment like valves, motors, and pumps. Siemens S7 PLCs, widely used across industries, are under attack from malicious actors looking to sabotage American infrastructure vital to the functioning of sewers, hospitals, and other industrial operations.

In 2024, Russian-affiliated actors exploited a similar vulnerability, breaching the water system for a small town in Texas, causing the water tank to overflow. The town’s entire revenue in 2023 was $3.37 million, with no dedicated line item for cybersecurity. This was, in effect, a trial run. How and when the detection occurred was an education for the Russians.  

American state and local governments are unlikely to organically grow their budgets to the level needed to invest in software that can reliably secure their infrastructure. The U.S. government has a proven option here: clarify that existing tax code already supports increased, iterative purchases of necessary cybersecurity software.

State and local governments are increasingly responsible for cybersecurity, with the same, or even fewer, resources than they had in the past. A plurality of state chief information security officers reported stagnant or reduced cybersecurity budgets for 2026. The picture at the local level is often worse, where a single operator often owns asset inventory, patching, and incident response for an entire utility. The Center for Internet Security in 2024 found that, out of the thousands of local agencies it surveyed, about one-third were doing minimal to no cybersecurity activities. In Minnesota, specifically Braham, Plymouth, South St. Paul, and Maple Plain, threat actors used this to their advantage.

Braham in particular identified $22.98 million in water infrastructure needs, well over 10 times its annual city budget of $2.2 million. A state bond appropriation covered $10.22 million, but the money was earmarked for a wastewater treatment plant upgrade, water main replacement, and well replacement. None of these funds covered the cybersecurity infrastructure needed to secure a plant from a state-backed threat actor: no security software, no network monitoring, no cybersecurity staff. Last month, they were one of many cities and municipalities discovered to have been targeted by actors allegedly acting on behalf of Iran.

State-backed adversaries understand that most of America is like Braham. While Anthropic’s and OpenAI’s cybersecurity efforts are admirable, they are aimed at the upper echelons of the American economy, not the wider array of smaller organizations with similar cybersecurity profiles. 

State and local governments cannot defend against state-backed actors alone. Federal tax incentives for cybersecurity software investment offer a faster solution than creating new government programs. This approach gives these organizations the tools to harden infrastructure while avoiding bureaucratic delays.

Bonus depreciation under the One Big Beautiful Bill should cover cybersecurity software and hardware. Digital infrastructure should also qualify for full expensing. Without these tax incentives, critical infrastructure remains vulnerable. A new factory without cybersecurity is essentially undefended.

Clarity on whether the implementation of cybersecurity software could apply to Section 174A expenses would also be useful. An affirmative interpretation could unlock private sector cybersecurity solutions for businesses and infrastructure operators, particularly those in rural areas. A recent letter from Sen. Tom Cotton to Treasury Secretary Scott Bessent asks for clarification of several aspects of tax law for such a purpose. 

There are discoveries and risks when deploying new cybersecurity tools. Organizations often don’t know the scope of their own inventory, and given the age of the equipment, bespoke software needs to be developed so customers can use the cybersecurity software. Pilot programs, iterative testing, and development are currently cost-prohibitive for many infrastructure operators. Affirmative interpretations could make this emergent threat into an opportunity to secure the infrastructure that Americans depend on every day.

An affirmative interpretation would benefit all Americans. State and local governments would protect themselves from state-backed threat actors. Firms would be more willing to invest in cybersecurity software, as the cybersecurity software market would grow significantly. Rapid investment is needed now, as AI today is being used to attack critical infrastructure.  

State and local governments now, more than ever, need cybersecurity software to face a world where they are on the front lines of cyberwarfare. The current administration needs to provide them with as much support as quickly as possible to ensure that American critical infrastructure is not reduced to scrap by enterprising malicious actors. 

The post How tax policy can stop threat actors from breaching US water systems appeared first on CyberScoop.

OpenAI and the Ukrainian government have agreed to a partnership that will provide AI tools and subsidized computing resources to better protect the nation’s critical infrastructure from cyberattacks.

The agreement, announced Wednesday at OpenAI’s New York office, will provide Ukrainian cybersecurity officials with access to advanced AI models designed for cybersecurity work through the company’s Daybreak program. OpenAI said it is also pledging over $1 billion in subsidized tokens to support the initiative.

During a panel discussion Dmytro Kushneruk, consul general of Ukraine in San Francisco, outlined how the tools would be used for cybersecurity automation, including functions such as incident response, threat triaging, login analysis, inventorying systems, code analysis and validating vulnerabilities.

In nearly all cases, Kushneruk said the primary benefit was carrying out those functions at machine speed. But this speed is meant to complement, not replace, Ukrainians’ human expertise.

In regard to incident response Kushneruk said humans must view “thousands and thousands of these logs and they have to find what’s really important, that’s why AI can give capable defenders really much greater advantage and leverage.” 

“This is why the object is not to replace the cyber defender with AI, but to make sure the cyber defender acts faster,” he added.

Kushneruk said that for Ukraine, the partnership “is really not about protecting computers, it is about actually keeping our country running.”

Ukraine faces approximately 6,000 cyberattacks per year, or about 15 per day, according to Kushneruk. Over the past twelve years, the country’s critical infrastructure, including electricity and water systems, has endured sustained attacks from Russia in the form of cyberattacks and physical strikes.

Since Russia’s 2022 invasion, Ukraine’s critical infrastructure has been under constant threat. While missiles remain the primary concern, Kushneruk said Ukraine has been preparing to protect vital services since Russian GRU hackers shut down the country’s power grid in 2015. 

He added that while the country was “maybe not so much prepared” to deal with the fallout in 2015, it improved over time, including the resilience displayed in 2025 when trains kept running after Russian hackers attacked Ukraine’s railway system.

Some national security experts and congressional committees have explicitly cited the resilience of Ukrainian critical infrastructure as a model for U.S. industry.

Naz Durakoğlu, minority staff director of the U.S. Senate Foreign Relations Committee, said there is “pretty much across the board” agreement between the parties in favor of similar adoption of defensive AI tools by U.S. critical infrastructure operators, though issues like regulation remain sticking points.

“This is something that’s already happening, and frankly, it’s just kind of a basic duty of government to make sure that when you turn the tap on, water comes out, the electricity doesn’t go out, and hospitals keep running and treating patients,” said Durakoğlu. “So there is a broad understanding that this is a major issue, and I will say seeing what Ukraine has to go through day-to-day is also a huge wake-up call to our members on a bipartisan basis.”

OpenAI has publicly pushed for its product, and AI at-large, to be used to solve these types of problems. Company president and co-founder Greg Brockman signed an open letter released earlier this year calling for “collective action” and widespread use of AI models to find and fix vulnerabilities before the rest of the world,  including foreign governments and cybercriminals, got access to the same capabilities.

According to Politico, OpenAI CEO Sam Altman met with U.S. power companies in July to discuss using AI to protect the nation’s electrical grids.

On Wednesday, OpenAI’s national security policy head, Sasha Baker, said the company felt “urgency” to try to strike similar agreements with other governments and industries.

“There’s this period of time where we’re really rushing to get [these tools] in the hands of critical infrastructure operators, of governments around the world, of people who want to patch systems, defend their networks, remediate vulnerabilities because we know as these tools proliferate out there in the ecosystems, there are going to be bad guys out there that also try to use them,” said Baker. “So, we have this window of time to take action and we’re really motivated by the idea that we need to act with some urgency.”

The post OpenAI, Ukraine partner on ‘Daybreak’ program to protect power grids and water systems  appeared first on CyberScoop.

A House Democrat tapped to lead his party’s efforts on artificial intelligence has introduced legislation that would establish a test program within the Cybersecurity and Infrastructure Security Agency to give critical infrastructure operators free access to frontier AI models to protect their systems.

Rep. Josh Gottheimer, D-N.J., introduced the AI Cyber Defense Act Monday, inspired by the series of cyberattacks on water facilities in recent months. “If we don’t get ahead of it, it can mean a disaster for our families,” he said at a news conference when he first announced the measure and others tackling water cybersecurity.

Gottheimer holds a couple of posts relevant to the legislation: He’s one of three co-chairs of the House Democratic Commission on Artificial Intelligence, and the top Democrat on the House Intelligence Committee’s cyber subcommittee. He also has bipartisan support for the bill, with co-sponsors Reps. Don Bacon, R-Neb., Zach Nunn, R-Iowa, Hillary Scholten, D-Mich., and Greg Landsman, D-Ohio.

The bill directs the Department of Homeland Security, through CISA, to create a program “through which owners and operators of critical infrastructure that participate in the Program are able to securely utilize artificial intelligence procured through the Secretary and technical assistance provided by the Secretary to protect against, detect, test for, and remediate vulnerabilities in the cybersecurity of such critical infrastructure.”

AI-tinged, water-focused cybersecurity pilot programs are all the rage lately. The introduction of Gottheimer’s legislation is adjacent to, but different from, a test program that the Office of the National Cyber Director recently announced in Texas.

One criticism of that program is that private sector companies offered their cyber and AI services through it on a purely voluntary basis, with no significant budget to bolster the pilot. Gottheimer’s bill would authorize $100 million for the pilot program from 2027 to 2031 before it ends, although appropriators would have to follow through on providing the actual dollars. The Trump administration has significantly cut CISA funding in its second term.

“Right now federal funding for critical infrastructure has an uncertain future and many of our local communities just don’t have the resources they need to pay for AI tokens to do the patching they need,” Gottheimer said when he introduced the bill. “It’s expensive to bring the AI in to analyze your system and find those vulnerabilities.”

Critical infrastructure owners and operators could apply for the pilot program, which the bill directs to give priority to nonprofit, publicly owned, rural and small-sized organizations.

“The same technology that can help a small town’s IT guy find and patch a gap in cybersecurity can also help a hostile government find a hundred more it hasn’t even discovered yet,” Gottheimer said when he announced the bill. “AI didn’t create this threat, but it’s accelerated it, and our defenses have to keep up.”

The post After water attacks, Capitol Hill offers its own proposal for an AI-cyber test program appeared first on CyberScoop.

A group of leading House Democrats introduced legislation Monday requiring the Cybersecurity and Infrastructure Security Agency to conduct an assessment of its workforce to determine whether it’s up to the task after the exit of around 1,000 employees during President Donald Trump’s second term.

The concept of a force structure assessment is more common in military branches, including one that Congress previously ordered for Cyber Command. The CISA Force Structure Assessment Act would order the agency to carry out a review of whether the agency still has the necessary personnel, training and certifications after budget cuts and other Trump-era departures.

“America’s cyber defenses are only as strong as the people behind them,” Rep. James Walkinshaw, the Virginia Democrat serving as lead sponsor of the bill, said in a news release. “As cyber threats grow more sophisticated and technologies like artificial intelligence and quantum computing reshape the threat landscape, Congress needs a clear accounting of whether CISA has the workforce, skills, and resources required to keep Americans safe and enable mission delivery. This legislation will identify critical gaps and give Congress concrete information to address them.”

Also sponsoring the bill are the top Democrat on the House Homeland Security Committee, Bennie Thompson of Mississippi, and the top Democrat on its cybersecurity subcommittee, Delia Ramirez, D-Ill.

Additional elements of the force structure assessmewould include a review of the security of federal IT systems and support for state and local governments; the risks posed by AI, quantum computing and other cutting edge technologies; CISA’s threat-hunting and incident response capabilities; support for critical infrastructure and operating technology, including CISA’s role as a sector risk management agency for a number of industry sectors; the operation of the Joint Cyber Defense Collaborative; and international cooperation.

Some lawmakers and other observers have worried those areas have been greatly impacted by staffing cuts, ultimately hurting CISA’s ability to carry out its core functions.

Ramirez dinged GOP lawmakers for “a lack of interest in safeguarding our nation’s cybersecurity and our residents’ civil rights and privacy” in going along with the CISA cuts and other developments at the Department of Homeland Security.

Lawmakers on both sides of the aisle have voiced concern about the scope of cuts at CISA, but Republicans have approved some of them while pushing back on others. CISA itself is currently seeking to hire hundreds of new personnel, even as its latest budget blueprint calls for yet more funding reductions.

“With Iran targeting our critical infrastructure and frontier AI models creating new cyber risks, we must ensure we have a cybersecurity workforce to counter these growing threats,” Thompson said. “After Trump has spent the past two years targeting and slashing CISA’s workforce, we need the agency to assess if it has [the] right personnel in place to fulfill its mission.”

National Cyber Director Sean Cairncross has discussed White House plans to develop a cybersecurity academy meant to consolidate and enhance existing federal cyber training and education programs, with the aim of addressing cyber workforce shortages. His office has reportedly drafted an executive order that would establish that academy.

The post Dems seek top-to-bottom assessment of CISA workforce appeared first on CyberScoop.

Alayna Alvarez reports: Foreign actors last month breached two small Colorado water utilities and manipulated equipment used to control drinking water systems. The two privately owned utilities, each serving fewer than 200 people, were breached in late August, Gov. Jared Polis’ office told Axios. The hackers changed equipment settings, disabled remote access and alarms, and...

Source

There is little reason to believe the war with Iran will end anytime soon. Even as efforts to resolve the conflict continue, Iran remains unpredictable, with an enduring ability to disrupt shipping and energy markets via actions in the Strait of Hormuz.

So what does a prolonged conflict mean for cybersecurity here at home? U.S. agencies need to prepare for sustained Iranian cyber operations and conduct defensive wargames now.

I spent part of my career in Navy intelligence supporting expeditionary and special warfare operations. This experience taught me to look beyond individual attacks to the larger objectives they serve. Iran’s likely objectives are relatively straightforward: impose enough pain on critical infrastructure, businesses, and public services to increase pressure on Washington, while disrupting the industrial and civilian systems that allow the U.S. to sustain military operations.

Iran may not be a top-tier cyber power like China or Russia, but it doesn’t have to be. We recently mapped 130 documented attack techniques used by five Iranian threat groups. Much of their playbook relies on well-known, repeatable techniques rather than advanced capabilities. Success does not require extraordinary capabilities, only the ability to create enough disruption, uncertainty, and delay is enough.

America’s greatest vulnerability may not be any single network or piece of critical infrastructure, but the links in between. 

Critical infrastructure: Prepare for volume, not just catastrophe

When Americans imagine a cyberattack on critical infrastructure, we tend to think of catastrophic events, such as a large-scale blackout, a poisoned water supply, or some other digital Pearl Harbor.

But in an extended conflict, the more realistic possibility is persistent attacks across many targets. Small water systems, manufacturers, transportation providers, energy infrastructure, and local governments all serve as disruptive targets. The recent string of attacks on mostly smaller water utilities across 12 states is a prime example; so too is the four-day outage of a small-scale power plant in the UK.

Attackers do not need to destroy these systems. Any intrusion that manipulates industrial systems, interrupts operations, or forces operators to determine whether equipment can still be trusted consumes valuable time and resources. Multiply that across dozens of organizations, and federal, state, local, and private-sector response capacity will be stretched thin.

The cumulative strain on the country’s ability to respond may be more important than any single attack. Iran does not need the world’s most sophisticated cyber force if its affiliated hacking groups can generate problems faster than cyber defenders can investigate and remediate them.

Defense contractors must prepare for destructive attacks

Defense contractors have long faced espionage threats targeting military secrets.  While that threat remains, the war has significantly changed Iran’s motives and risk calculus.

The same access used to steal information from the defense industrial base (DIB) can also be used to destroy data and disrupt operations. Destructive malware such as wipers and ransomware could destroy engineering files, disable production systems or force manufacturers offline, directly affecting the military’s ability to replenish equipment and supplies.

An attacker does not have to shut down production to disrupt it. Consider a compromised calibration setting, altered test result, or unauthorized change to engineering data. Discovering that an adversary had persistent access to a manufacturing environment raises difficult questions: Which files were touched? Which designs can still be trusted? Which components were manufactured from them?

The incident quickly becomes a production problem as parts must be quarantined, engineering data re-validated, and products retested.

NIST SP 800-171 and CMMC provide an essential security baseline, which makes the current pause in CMMC implementation particularly concerning. However, contractors must also be prepared to operate through destructive attacks and establish that their systems, data, and products can still be trusted. This preparedness must extend down the supply chain, where a smaller manufacturer, software provider, or managed service provider may present a greater vulnerability than a well-defended prime.

The military attack surface extends far beyond DoD networks

The U.S. military is extraordinarily capable at defending its own networks, but its operations depend on infrastructure it doesn’t own or control. Troops and equipment move on commercial railroads, materiel flows through commercial ports, and military airlift can depend on commercial carriers. Military installations and defense contractors also depend on commercial power, telecommunications, and other infrastructure.

In an ongoing conflict, those dependencies become part of the attack surface. An adversary like Iran does not have to penetrate military command-and-control to interfere with these operations. At a time when speed matters most, cyberattacks that disrupt port scheduling, corrupt logistics information, or degrade power and communications can introduce critical delays and uncertainty that hamper operations.

This is why the line between civilian and military infrastructure becomes blurred during a conflict. A commercial railroad carrying military equipment to a strategic port may be civilian infrastructure administratively, but operationally it is part of the nation’s ability to operate its military power. The same is true of the utilities, communications providers, and other civilian infrastructure supporting military installations and defense production. Their resilience can quickly become a matter of military readiness.

Cyber defense must cross organizational boundaries

American cybersecurity is organized around sectors, organizations, and authorities that make administrative sense, but aren’t necessarily designed for wartime. The boundaries between them can become a serious liability.

Our adversaries in Tehran do not care about administrative boundaries. They care about weak spots. A vulnerability anywhere in the chain connecting civilian infrastructure, industrial production, transportation, communications, and military operations can affect everything downstream.

We need to ask: Who is responsible for the cyber resilience of a commercial railroad essential to a military deployment? Who ensures the utility serving a critical defense manufacturer can withstand a sustained nation-state campaign? Who identifies the supplier whose failure could disrupt multiple defense programs? And who coordinates the response when several are attacked simultaneously?

Those questions should shape how we prepare. Critical infrastructure exercises should assume simultaneous incidents across multiple sectors and regions. We should also be extremely cautious about weakening the incentives driving cybersecurity improvements across the DIB, such as the current pause on CMMC. Additionally, defense manufacturers should also test their ability to operate through destructive attacks and determine whether their engineering data, production systems, and finished products can still be trusted.

DoD exercises should treat civilian infrastructure, including rail, ports, energy, and communications, as a routine part of the operating environment and an attractive target for adversaries. Catastrophic scenarios deserve attention, but exercises should also account for lower-level attacks that are less spectacular but still highly consequential.

Iran does not need overwhelming cyber capability to impose significant costs. Persistent disruption at home can increase political and economic pressure surrounding the war, while disruption of defense production and military logistics can make it harder for the U.S. to sustain operations abroad.

We have spent years strengthening the individual pieces of America’s cyber defenses. A prolonged war with Iran may test the links between them.

The post America’s cyber strategy overlooks the infrastructure that actually keeps the military moving appeared first on CyberScoop.

For the first time, the Cybersecurity and Infrastructure Security Agency is advising critical infrastructure owners and operators on how to set up phony systems, accounts and data to deceive would-be hackers into being distracted and discovered.

The Wednesday guidance, “Using Cyber Decoys to Strengthen Detection and Response,” arose from internal discussions with CISA’s threat hunters and penetration testers about how decoys can be a cheap, effective way to disrupt attackers, said Chris Butera, acting executive director of the cybersecurity division.

‘We’ve been looking at it for a while, and we believe that decoys can be both a very low-cost but actually high-fidelity way to detect an adversary who’s already gained access to networks,” Butera told CyberScoop at Google Cloud’s Cyber Defense Summit 26.

It’s especially complementary for zero-trust (maintaining that no user or device is trustworthy by default) and assume-compromise (assuming that hackers have already gotten into a network) approaches, Butera said.

While the guidance is “really relevant for everyone,” it’s something that can be especially useful in critical infrastructure sectors that don’t have the most personnel or money, he said.

“This could be something to prioritize as a lower cost solution,” Butera said. “You can create your own honey tokens yourself.”

The 22-page guidance includes decoy principles and goals, definitions of the different kinds of decoys and how to use them and scenarios for deployment.

Honeytokens, for instance, are “Data elements or logical objects with no legitimate business use (e.g., fake records, credentials, or files) planted to detect unauthorized access or exfiltration. Any interaction strongly suggests malicious or otherwise unauthorized activity.”

“Cyber decoys used in a proactive cyber defense strategy help make critical infrastructure networks unfriendly places for adversaries and enhance resilience to compromise, even against living-off-the-land techniques,” Butera said in a news release. “With this guide, CISA is raising awareness of cyber decoy techniques and enabling any defensive team regardless of skill level to understand the value and steps to implementing decoy operations. CISA encourages critical infrastructure organizations to review this guide and implement a cyber decoy strategy.” 

The post CISA promotes a fresh way to deter cyberattackers: Lie to them appeared first on CyberScoop.