ICD Brief 46.
19.06.2017. – 25.06.2017.
Welcome to our 46th ICD Weekly Edition with updates from USA, Australia, Estonia, China, Germany, India, Israel, Japan, Netherlands, Poland, Russia, South Korea and the UK.
By far the most startling news came Friday (June 23, 2017), in a ‘deeply sourced’ Washington Post article that revealed President Obama approved cyber weapons in response to Russian attacks. “The authorization, by a US President, to inseminate Russian infrastructure with back doors, in preparation for escalation, is the most significant move to a cyberwar footing we have seen to date,” said Richard Stiennon, renowned industry thought leader and author most recently of There Will Be Cyberwar .
Our Featured Article: “Cyber Pearl Harbor Is Not Yet Here”, By Károly Gergely in Magyar Nemzet June 7, 2017, includes interviews with Keir Giles, director, the Conflict Studies Research Centre (CSRC) in Cambridge, UK and former Michigan CSO Dan Lohrmann. We bring it to you exclusively in English translation by its author and our reporter Károly Gergely .
USA
Obama approved ‘cyber weapons’ in response to Russian attacks: report
In its final months, the Obama administration debated dozens of options to punish Russia for its cyber campaign to disrupt U.S. democracy, according to a new report. The Washington Post published a deeply sourced article Friday morning on former President Barack Obama’s secret campaign to make Moscow pay for attempting to influence and discredit last year’s presidential election.
For DHS Cybersecurity Funding, Congress Asks Why States Are Bypassing Millions
“A House bill now under evaluation would examine why states that identify cyberattacks as a “top-tier risk” are using only a small portion of Department of Homeland Security funds to fight back.”
Federal Cybersecurity Regulations Called Inconsistent, Redundant
“Both members of the private sector and state governments are struggling under the burden of inconsistent and overlapping Federal cybersecurity regulations, according to experts who spoke before the Senate Homeland Security and Government Affairs Committee.”
State Election Officials Resisted Federal Cybersecurity Assistance During 2016 Election
“State and local election authorities resisted federal cybersecurity assistance during 2016, President Obama’s Homeland Security secretary told lawmakers Wednesday. As attacks against election targets became increasingly visible in 2016, Jeh Johnson, who was secretary into early 2017, floated the idea of designating election infrastructure as critical infrastructure, making it a top security priority for DHS and give it the benefit of domestic and international cybersecurity protections.”
Under pressure, Western tech firms bow to Russian demands to share cyber secrets
Western technology companies, including Cisco, IBM and SAP, are acceding to demands by Moscow for access to closely guarded product security secrets, at a time when Russia has been accused of a growing number of cyber attacks on the West, a Reuters investigation has found.
US Companies Create Principles for Cybersecurity Risk Ratings
“On June 20, 2017, the U.S. Chamber of Commerce announced that a consortium of more than two dozen chamber member companies, including prominent big banks, big-box retailers, and technology giants released a set of principles designed to promote fair and accurate cybersecurity ratings. The creation of the “Principles for Fair and Accurate Security Ratings” comes in response to the recent emergence of several companies, such as BitSight Technologies, CyberGRX, RiskRecon and SecurityScorecard, that collect and analyze publicly accessible data to develop a rating of a company’s cybersecurity risk posture.”
Australia
Aussie Big Business CEOs Investing More in Cyber Than Global Counterparts
“Australia’s top chief executives are more concerned about cyber security threats and are spending more money to defend against them than their global counterparts, according to new research from KPMG. Figures extracted from the big four accounting firm’s latest Global CEO Outlook study showed that 71 per cent of Australian business leaders running companies turning over more than $500 million were investing in cyber security, compared to 53 per cent of chief executives globally.”
Cisco Tackling Human Element of Security with Cyber Training Course
“With one of the most commonly cited threats to an enterprise being the human element, the Australian arm of Cisco is investing in cyber-focused courses to bring people up to date with the role they can play in preventing an attack.”
Baltics/Estonia
Estonia Expects European Commission to Renew Cybersecurity Strategy
“At a meeting of the EU General Affairs Council in Luxembourg on Tuesday, Estonian Deputy Minister for EU Affairs Matti Maasikas said that Estonia expects a renewed cybersecurity strategy from the Commission this fall. Maasikas said it is important for Estonia that the European Council discuss the current situation of the digital single market and provide guidelines for further development.”
China
Three Weeks On: What We Know About Enforcement of China’s Cybersecurity Law
“On June 1, 2017, China’s new Cybersecurity Law (the “Law”) finally went into effect. It is the first Chinese law that systematically lays out the regulatory requirements on data privacy and cybersecurity, subjecting to government scrutiny many activities in cyberspace that were previously unregulated or addressed in a sector-by-sector fashion. Three weeks after the Law took effect, we examine the latest developments in this three-part post. This post will clarify which key features of the Law are ready to be enforced immediately and which provisions are still awaiting clarification in the form of implementing regulations or standards.”
How China’s Cyber Command Is Being Built to Supersede Its US Military Counterpart
“As U.S. leaders contemplate a proper definition for “cyberwar,” their counterparts in China have been building a unit capable of fighting such a large-scale conflict. China’s rival to U.S. Cyber Command, the ambiguously named Strategic Support Force (SSF), is quietly growing at a time when the country’s sizable military is striving to excel in the digital domain.”
Germany
Germany’s BSI Says Company Executives Being Targeted By Cyber Attacks
“Germany’s federal cyber-security agency, BSI, said on Friday the private email inboxes of German executives and government employees were being targeted by professional cyberattacks. Selected executives are being sent deceptively real-looking “spear-phishing” emails. They claim to have noticed irregularities in the use of the inbox or offer new security functions, the BSI said in a statement.”
DT in Cybersecurity – Good but Could Do Better
“Around 1,000 delegates attended Deutsche Telekom’s second two-day “Magenta” cybersecurity event for customers and partners in Munich this week. That 1,000-delegate number makes it a pretty strong candidate for Europe’s largest ever telco-hosted cybersecurity event.”
India
India’s Power, Industrial Facilities Warm Up to Cybersecurity Systems
“Industrial facilities in India, particularly the power sector, are showing early signs of higher demand for cyber security systems as operations increasingly turn digital. Engineering companies say such systems are mostly being provided now as an added service in the operations and maintenance segment.”
CLP India Selects Siemens Cyber Security Solution
“CLP India has selected Siemens’ cyber security solution to protect the automation system of its Paguthan power plant in the state of Gujarat. Designed to detect, analyse, and draw attention to threats that move laterally from information technology (IT) to operational technology (OT) networks, the solution features dedicated endpoint protection to prohibit execution of malicious applications.”
Israel
Intel Looks to Israel for Next Big Thing in Cybersecurity
“Intel has joined Team8, an Israeli creator of cybersecurity startups, as a strategic partner and will help with the formation of companies that address the largest cybersecurity problems, Team8 said on Wednesday. Intel, the world’s largest chipmaker, joins Team8’s syndicate members Microsoft, Cisco, Qualcomm, AT&T, Citigroup, Accenture, Nokia, Bessemer Venture Partners and Alphabet executive chairman Eric Schmidt’s Innovation Endeavors.”
Japan
Japanese Telecom Giant Invests $100m. in Israeli Cybersecurity Firm
“Israeli cybersecurity firm Cybereason has raised $100 million from Japanese telecommunications giant SoftBank Corp., the company announced on Wednesday. Cybereason secured SoftBank’s investment in the firm’s fourth financing round, bringing total investments to for the past two years to $189m. Based in Boston, with a research and development center in Tel Aviv and offices in London and Tokyo, Cybereason provides automated cyber-attack endpoint detection and response.”
Netherlands
Netherlands Falling Behind on Cybersecurity Warns Counterterrorism Director
“Dutch companies, government institutions and citizens are not responding fast enough against growing digital threats, according to National Coordinator for Counterterrorism and Security Dick Schoof. At home and at work Dutch people often opt for the fastest solution, instead of the most secure one. Which means that the gap between threats and security measures is getting larger instead of smaller, Schoof said in the Netherlands Cyber Security Image 2017, ANP reports.”
Poland
Welcome to the New European X-Force Command Center in Wroclaw, Poland
“This week, IMB opened its newly refurbished and greatly expanded X-Force Command Center in Wroclaw, Poland. It is the latest addition to IBM’s global X-Force footprint.”
Russia
Russia’s Cyberwar on Ukraine Is a Blueprint For What’s to Come
“The clocks read zero when the lights went out. It was a Saturday night last December, and Oleksii Yasinsky was sitting on the couch with his wife and teenage son in the living room of their Kiev apartment. The 40-year-old Ukrainian cybersecurity researcher and his family were an hour into Oliver Stone’s film Snowden when their building abruptly lost power.”
South Korea
South Korea in “Emergency Mode” Over Cyber Threat to Banks
“Authorities in South Korea are in “emergency mode” as they scramble to head off a threatened cyberattack on the nation’s biggest banks. A hacker group known as the Armada Collective on Wednesday said it would hit the country’s seven main lenders with distributed denial-of-service — or DDoS — attacks if they failed to pay a ransom in virtual currency bitcoin.”
UK
Parliament Hit by Cyber-Attack
“The UK Parliament has been hit by a cyber-security attack. MPs were reportedly informed about the hack on Friday night and later told of difficulties in accessing their emails away from the Westminster estate. A parliamentary spokeswoman said the lack of email access was not a result of the cyber-attack but part of the steps being taken to manage the issue.”
Breach at UK.gov’s Cyber Essentials Scheme Exposes Users to Phishing Attacks
“The operation behind the UK government’s Cyber Essentials scheme has suffered a breach exposing the email addresses of registered consultancies, it told them today. The scheme’s badges are required by suppliers bidding for “certain sensitive and personal information-handling [government] contracts”.”
Cyber Pearl Harbor Is Not Yet Here
In relation to the WannaCry virus, which infected more than 230,000 computers in 150 countries, we asked Keir Giles, the director of the Conflict Studies Research Centre (CSRC) in Cambridge and Dan Lohrmann, the former CSO of Michigan about cybersecurity, viruses, and what to do.