Weekly News Roundup: February 5, 2018
Federal Cybersecurity News
We saw many federal cybersecurity news items last week. Here’s a quick roundup:
- Trump administration wants larger role in shaping international data laws (CyberScoop): “The Trump administration plans to take an increased role in shaping rules surrounding internet governance over the next year in the wake of various international security and privacy laws being enacted, according to White House Cybersecurity Coordinator Rob Joyce.”
- Senior Executive Service Announcements (US Department of Defense): “Maj. Gen. (ret.) Burke ‘Ed’ Wilson has been selected for appointment to the Senior Executive Service, and for assignment as the deputy assistant secretary of defense for cyber policy. Wilson most recently served as the deputy principal cyber advisor and senior military advisor for cyber policy.”
- Who Is Paul Nakasone? Army Cyber Warfare Chief May Head NSA Soon (International Business Times): “Lt. Gen. Paul Nakasone, head of the Army’s digital warfare branch — United States Army Cyber Command — is likely to be nominated by President Donald Trump to lead the National Security Agency (NSA), reports said.”
- WH cybersecurity coordinator seeks more ‘naming and shaming’ of hackers (Federal News Radio): “[White House Cybersecurity Coordinator Rob Joyce] said he’s urged lawmakers to craft legislation that would make U.S. companies responsive to foreign subpoenas, and allow the federal government to pull offshore data from U.S.-based companies.”
Auto-ISAC Signs Cybersecurity Agreement with DHS
According to a press release, the Auto-ISAC has signed a Cooperative Research and Development Agreement (CRADA) with the U.S. Department of Homeland Security (DHS) to collaborate and improve vehicle cyber-threat information sharing and analysis. The agreement could facilitate access to DHS' National Cybersecurity and Communication Integration Center (NCCIC), a security operations watch center. The agreement also provides ISAC personnel with eligibility for security clearances to view classified threat information.
House Small Business Committee Hears About Cyberthreats from FBI and DHS
The Hill reported on a House Small Business Committee hearing that featured testimony from Howard Marshall, deputy assistant director at the FBI's cyber division and Richard Driggers, deputy assistant secretary at the Department of Homeland Security's National Protection and Programs Directorate (NPPD). According to The Hill, “Lawmakers […] explored cyber threats to small businesses and focused on how the federal government shares information with the private sector to prevent and respond to cyber threats from foreign and other actors. During the hearing, officials from the FBI and Department of Homeland Security agreed that small businesses are underprepared to counter threats like ransomware, phishing scams, and other attacks, underscoring the need for these organizations to be more willing to work with the federal government to reduce their risk.”
Summary of Cybersecurity Reports and Surveys
Many great cybersecurity reports and surveys came out last week, and we rounded up a few:
- Ransom Where? Malicious Cryptocurrency Miners Takeover, Generating Millions (Talos): “Talos has observed botnets consisting of millions of infected systems, which using our previous logic means that these systems could be leveraged to generate more than $100 million per year theoretically.”
- Cyber Incident & Breach Trends Report (Online Trust Alliance): “OTA analyzed reported breaches through Q3 2017 and found that 93% were avoidable, which is consistent with previous years’ findings. Of the reported breaches, 52% were the result of actual hacks, while 11% were due to lack of internal controls resulting in employees’ accidental or malicious events.”
- Malwarebytes Cybercrime Tactics and Techniques: 2017 State of Malware Report (Malwarebytes): “Ransomware against consumers went up more than 93 percent while ransomware against businesses increased 90 percent.”
- 2018 Global Cloud Data Security Study (Ponemon Institute): “Despite the importance of cloud computing, one-third of respondents are unsure or do not agree that their organization is committed to protecting confidential or sensitive information in the cloud. Further, 57 percent do not believe their organization is careful about sharing that information with third parties.”
- Robert Walters Salary Survey 2018 (Robert Walters via SecurityIntelligence): “…salaries for cybersecurity jobs around the world will rise by 7 percent in 2018. In addition, the recruitment firm estimated that all IT roles will see an average increase of 2 percent in salary.”
Cybersecurity Acquisition Roundup
Several cybersecurity acquisitions were announced last week, including:
- GitLab to Acquire Open Source Security Company Gemnasium: “[Gemnasium] provides software to help developers mitigate security vulnerabilities in open source code. GitLab is acquiring both Gemnasium’s technology and its team of experts, who will come on board to implement robust security scanning functionality natively into GitLab’s CI/CD pipelines.”
- RELX Group to Acquire ThreatMetrix: “ThreatMetrix is a leader in the global risk-based authentication sector, headquartered in San Jose, California and founded in 2005. ThreatMetrix’s technology analyses connections among devices, locations, anonymized identity information and threat intelligence, and combines this data with behavioral analytics to identify high-risk digital behavior and transactions in real time.”
- Bomgar Acquires Lieberman Software: According to a company announcement, “The acquisition of Lieberman Software, a leading privileged identity and credential management technology provider, enables Bomgar to take a big leap forward to create a best-in-class Privileged Access and Identity portfolio.”