PROGRAMMING NOTE: The Morning Cybersecurity newsletter will not publish on Monday, Oct. 8. Morning Cybersecurity will resume publication on Tuesday, Oct. 9.
LET’S PLAY ‘BRAINSTORMING DETERRENCE’ — Some cybersecurity experts and lawmakers have long called for the U.S. to develop a deterrence strategy for cyberspace. But what would actually deter some of America’s top rivals?
CATEGORY: RUSSIA — Robert Johnston, who investigated the DNC hack during the 2016 campaign, told MC in a recent interview that the U.S. needs to do two things to back Russia off. First, pursue financial crimes charges against Russian oligarchs, who would respond to that pressure by lobbying President Vladimir Putin to tone it down. Johnston, now CEO of Adlumin, said the U.S. also needs to develop and use the kind of tools Russia exploits: moderately sophisticated attacks that maintain a patina of deniability if discovered. Most U.S. offensive cyber tools are kept ultra-secret and used for espionage, Johnston said.
Information operations could also work against Russia, said Dmitri Alperovitch, chief technology officer at CrowdStrike, who spoke Tuesday at The Washington Post Cybersecurity Summit 2018 (along with some of the other folks mentioned below). And Michele Flournoy, a former top Defense Department official, said the information ops didn’t need to be deceptive: Accurate information that undermined Putin’s legitimacy would do the trick.
CATEGORY: IRAN — Similar ideas that could deter Russia might do the same in Iran, said Karim Sadjadpour, a senior fellow at Carnegie Endowment for International Peace. Spreading information about how much Tehran was spending on, say, Hamas rather than the poor would further foment sentiment on the streets of Iran against its rulers.
CATEGORY: NORTH KOREA — Trick category! Alperovitch said North Korea is, in fact, pretty well deterred by the U.S. Since the Sony hack in 2014, Alperovitch noted, Pyongyang has largely avoided targeting America, and some of the most damaging attacks from North Korea have been either elsewhere or buckshot that hit everyone, like WannaCry.
HAPPY WEDNESDAY and welcome to Morning Cybersecurity! Crochet Predator. It shouldn’t work, but it does. Send your thoughts, feedback and especially tips to our full team using the contact info below, and be sure to follow @POLITICOPro and @MorningCybersec.
MAYBE DON’T SPLIT ’EM — Former CIA Director David Petraeus, who also once led Central Command, isn’t sold on splitting Cyber Command and the NSA. “I'd want to see what the organizational architecture will look like after this, keeping in mind that Cyber Command, the four-star command, should be a headquarters,” he said. “Generally four-star commands aren't great operational entities.” That means it would be better to leave ops like Joint Task Force Ares, which was part of the cyber offensive against ISIS, to Army Cyber Command like it was when it was launched.
A separation from NSA would mean that Cyber Command could be split off from useful operational assets current dual-hatted chief Gen. Paul Nakasone has at his disposal. “For the time being I would still keep him dual-hatted, given that there's nothing equal to NSA when it comes to intelligence gathering, signals, cyber and some other domains,” Petraeus said.
ALL THE NOTIFICATIONS — Shockwaves from Facebook’s massive data breach that compromised the accounts of roughly 50 million users continues to reverberate around the globe.
The social media giant will brief lawmakers later this week about the incident and has begun warning business customers that their internal data may have been stolen. For now, Facebook says it sees no evidence that hackers have accessed third-party apps. Meanwhile, Ireland's Data Protection Commission said the company had informed it that less than 5 million of the accounts affected by the breach were based out of the European Union. Facebook faces a potential $1.63 billion fine in Europe if regulators determine the company violated the General Data Protection Regulation. In addition, India’s government has asked Facebook to provide an update about the breach’s impact on that country’s users.
RISKY BUSINESS — Risk management nerds rejoiced Tuesday as the technical standards agency NIST released the final draft of a major update to its Risk Management Framework. Among the major changes to the RMF in version 2.0 are incorporating privacy and supply chain concerns; demonstrating ways to align the document with NIST’s better-known Cybersecurity Framework; and connecting C-suite-level discussions of risk management to “the individuals, processes, and activities at the system and operational level.” The draft revision also modifies the document to make it easier for companies using the RMF to generate their own lists of security controls on top of the “baseline” controls. NIST is accepting public comments on the draft until Oct. 31.
CASH GRAB — DHS on Tuesday identified an ATM cash-out scheme being carried as part of North Korea’s digital warfare campaign, which the government has dubbed “Hidden Cobra.” “Since at least late 2016, HIDDEN COBRA actors have used FASTCash tactics to target banks in Africa and Asia,” DHS disclosed. “FASTCash schemes remotely compromise payment switch application servers within banks to facilitate fraudulent transactions.” The government said the people behind HIDDEN COBRA have gotten away with tens of millions of dollars, once simultaneously taking out cash from ATMs in 30 countries.
HALT, WHO GOES THERE? — California’s governor signed a bill into law late last week requiring bots to identify themselves when they interact with someone within the state online. The B.O.T. Act, SB. 1001, was introduced with the aim of fighting misinformation campaigns in elections or selling products. Bots can still interact, but their disclosure needs to be “clear, conspicuous, and reasonably designed.” Previous versions of the bill were more broad and drew criticism from the Electronic Frontier Foundation for violating the First Amendment. The bill goes into effect July 1, 2019.
RECENTLY ON PRO CYBERSECURITY — Voting integrity groups and security experts advised DHS and the Election Assistance Commission to tell states to remove wireless modems from voting systems. … DHS briefed voting vendors on the state of cyber threats.
— Nearly half of Americans don’t know whether their existing insurance plans cover risks associated with cyberattacks, according to a report released Tuesday. The survey by J.D. Power and the Insurance Information Institute found that only 15 percent of Americans knew that their property, home, or renters insurance policy covered cyber risks, while 43 percent said their policies didn’t cover cyber risk and 42 percent didn’t know either way. The vast majority of respondents (77 percent) said they wouldn’t be willing to pay more for a cyber “add-on” to their insurance policy. Meanwhile, nearly a third (32 percent) of respondents reported being the victim of identity theft.
TWEET OF THE DAY — We’re gonna need a bigger truck.
— Israel-based Morphisec won a DHS grant to develop technology to protect financial institutions from cyberattacks.
CORRECTION: A previous version of Morning Cybersecurity misidentified James Mulvenon. He is general manager of the special programs division at SOS International.