We need more than "do-it-yourself" approaches to threats that clearly rise to the level of national security issues.

Jon Miller, CEO & Co-Founder, Halcyon

April 9, 2024

4 Min Read

Source: Christophe Coat via Alamy Stock Photo

COMMENTARY

The US government is ramping up efforts to stem the increasingly disruptive scourge of ransomware attacks. For example, the State Department recently offered up to $15 million for information on LockBit, and $10 million for information on the BlackCat/ALPHV or Hive ransomware gangs. 

Where these bounties might be most effective is in enticing operators to "out" rival threat actors, or disgruntled affiliates to exact some revenge if they are cheated out of their cut of a ransom. However, the conditions that need to be met in order to collect these bounties are rigorous, and the payouts represent a tiny fraction of the revenue ransomware operators and their partners are realizing, leaving little incentive to cooperate with authorities.

So, is the government doing enough? Is a criminal law enforcement approach to this threat really going to make a dent in attacks? Are adversarial nations taking advantage of this big gray area that is the nexus of cybercriminal and nation-state operations? 

**Ransomware Operators as Nation-State Proxies**

We know rogue nations like Russia support ransomware operations, and they provide a safe harbor for attackers. A recent report by Chainalysis assessed that 74% of all the illicit revenue generated by ransomware attacks during 2021 went to Russia-linked attackers, the lion's share of ransomware proceeds. 

We cannot discount the potential dual nature of many of today's ransomware attacks. There is plenty of overlap between cybercriminal activity and nation-state operations, as evidenced by shared tooling and attack infrastructure. Using ransomware gangs as proxies provides plausible deniability for nations like Russia, while leveraging them in a larger geopolitical strategy. 

Nations like Russia have zero interest in relinquishing such valuable assets to Western authorities. Don't let the faux "takedowns" the Russian government has touted fool you — they are purely a publicity stunt, and no more.

**Designating Some Ransomware Attacks as Terrorism**

Ransomware attacks targeting critical infrastructure providers like healthcare organizations have crossed the line from cybercriminal activity to a serious national security threat. It's no longer just speculation as to whether ransomware attacks are threatening lives. 

When remote attackers disrupt systems critical to care and hold dozens of healthcare providers and their patients to ransom, we simply call it an IT security event and the government response is to offer more guidelines and frameworks. But if hundreds of gunmen coordinating with an adversarial nation entered dozens of hospitals and held the staff and patients hostage, preventing the administration of care for days on end, would offering the hospital guidelines on how to detect gunmen be an acceptable government response?

A recent report by Ponemon found a direct link between ransomware attacks and negative patient outcomes: 68% of survey respondents said ransomware attacks disrupted patient care; 46% noted increased mortality rates; 38% noted more complications in medical procedures. Other research found that between 2016 and 2021, ransomware attacks contributed to between 42 and 67 patient deaths, as well a staggering 33% increase in death rates per month for hospitalized Medicare patients. There is definitely a case to be made to designate some of these attacks as acts of state-supported terrorism. 

Some might argue that the lack of a clearly stated political motive behind ransomware operations means that, while an attack on a hospital that disrupts patient care and leads to negative outcomes could be described as inflicting terror, it would not necessarily meet the definition of terrorism.

However, executive order 13224, issued by the George W. Bush administration in September 2001, does not support that conclusion, and seems to be clearly applicable to some ransomware attacks, such as those against healthcare providers:

"For the purpose of the Order, 'terrorism' is defined to be an activity that (1) involves a violent act or an act dangerous to human life, property, or infrastructure; and (2) appears to be intended to intimidate or coerce a civilian population; to influence the policy of a government by intimidation or coercion."

Cybercriminal activity is the purview of law enforcement. They investigate, collect evidence of a crime, indict, and prosecute when possible. So far this has only resulted in a few arrests, mostly of low-priority suspects. But if we designate these attacks as threats to national security, there are different rules of engagement that would go far beyond mere indictments, and can include offensive actions deemed appropriate and proportional, both cyber and kinetic. 

**The Hard Truth: Guidelines and Frameworks Are Not Enough**

Organizations that are the victims and potential victims of these attacks have largely been left to fight this battle on their own while getting little to no protection from the government. Unless and until the US and allied governments make this determination, there are few real consequences for these threat actors while targeted organizations are still left to fend for themselves. While guidelines and frameworks are useful, they are still "do-it-yourself" approaches to a threat that clearly rises to the level of a national security issue. 

We need more than vanilla government public relations programs to combat ransomware attacks. It is imperative that the US government and allied nations that are the targets of these attacks differentiate at least a portion of them by reclassifying them as terrorist acts so we can leverage some new tools in this fight. Otherwise, it will be a long, hard, lonely road ahead for ransomware victims.

**About the Author(s)**

CEO & Co-Founder, Halcyon

Jon Miller is the CEO & Co-founder of Halcyon with 25+ years working in the cybersecurity industry. Prior to Halcyon, Jon was the CEO & Co-founder of Boldend, a next-generation defense contractor focused on building offensive tools for the US Government. Previous to Boldend, Jon held the title of Chief Research Officer of Cylance (now Blackberry) where he focused on malware and product efficacy. Prior to Cylance, Jon was employee number 70 at Accuvant (now Optiv) where with a group of others he helped build and lead the largest technical consultancy at the time Accuvant LABS, working with over 95% of the Fortune 500 as an offensive security expert. Before Accuvant, Jon was a ten year veteran penetration tester, serving as one of the first in the industry working for the Internet Security Systems (now IBM) X-Force.

Frameworks, Guidelines &amp; Bounties Alone Won't Defeat Ransomware

Novacoast's Apex Program prepares individuals with visual impairments for cybersecurity careers.

Source: Sueddeutsche Zeitung Photo via Alamy Stock Photo

When David Mayne first started looking for a job in cybersecurity, the recruiter at his first-choice company told him no. With only one eye, how could Mayne spend all day looking at a computer screen?

But he didn't let that stop him. Mayne had already overcome tremendous hardship, losing his eye and his leg following a severe car accident, then finding a way to raise his four children on his own. He had earned a degree that qualified him for cybersecurity work, and he was not going to take no for an answer.

Mayne landed at Novacoast, a cybersecurity company specializing in IT services and software development. After the company moved from Santa Barbara, Calif., to Wichita, Kansas, Mayne reached out to state and city organizations to recruit for Novacoast's training program. That's how he met the team at Envision, a local organization that helps people who are blind or visually impaired (BVI) through employment, outreach, rehabilitation, education, and research.

"In meeting with them, light was shed on the employment situation for people who are blind or visually impaired," Mayne says. "I had no clue how bad that actually was."

According to Envision, 70% of people who experience low vision are unemployed. Mayne saw an opportunity.

**Curriculum Adapts to the Tools**

With the right tools — such as a computer with a screen reader and a Braille keyboard — BVI individuals can work in cybersecurity and IT roles, such as a SOC analyst, help-desk engineer, or network administration, Mayne realized. And organizations needed to broaden their search to address a national shortage in trained cybersecurity workers. So with the support of Novacoast CEO Paul Anderson, Mayne led the development of the Apex Program, an online, on-demand course to prepare VBI students for cybersecurity certification exams.

About 25 students have enrolled in the program since its inception in May 2023, and Mayne says he hopes to register 100 this year. While the course is designed to last 10 weeks, students can work at their own pace. Apex supports students through the course and exam processes, then helps them find work.

"We will stay with them until they get to the end," Mayne says.

The program is free, its $7,500 cost covered by state grants. So far, 16 states have partnered with the Apex Program, with Florida and Texas expected to join the fold this year, Mayne says.

The training materials are delivered in several different ways to accommodate student needs: audio-only, text-only, and PowerPoint and Word document versions that auto advance or advance manually (which is preferred by JAWS, or Job Access with Speech, a common screen-reader program that renders text as speech or in Braille). Content contains both text and video, and students participate in hands-on labs and quizzes.

Creating a curriculum that was accessible and still tackled the challenging topics completely was challenging, Mayne says.

"There's binary math in the class and subnetting, and it took me over a month to figure out how to teach that without using a blackboard," he says.

Mayne is currently updating the materials, as the exams will be updated in July. The course prepares students for CompTIA's Network+ or Security+ certification exam. Students can request accommodations for the exam, such as screen readers, extra time, or even human readers.

"All of our exams are computer-based, and we have gone through the effort with multiple versions to ensure 100% compatibility with JAWS," says Carl Bowman, senior vice president of exam services at CompTIA.

Because tests are taken in a locked-down browser, the software has to be configured to allow the screen readers to run. But Bowman says it's important to make sure that BVI individuals who want to take the exams have equal access.

"Fairness is one of the underlying themes across the board when you look at our entire operation," Bowman says.

**Training Pays Off for Students and Employers**

So far, four students have completed the Apex Program course. One of the first graduates, Curtis Jackson, recently joined Novacoast as a SOC 1 Analyst, the company's first direct hire from the program.

Finding the Apex Program through a Facebook ad was a game-changer for Jackson, who was born blind due to congenital glaucoma. The father of two, who had worked as a telemarketer for nearly two decades, dreamed of working in tech but felt locked out due to his disability.

Now, however, he not only has a new job, he has a career.

"I definitely have more earning potential," Jackson says. "But the real opportunities will come when accessibility comes and I have a chance to advance and move up in the company, just like everybody else."

For Mayne, bringing Jackson on board was important for both the company and the success of the Apex Program.

"We drink our own Kool-Aid," he says. "We don't want to be out there telling everyone they need to hire BVI employees but we do not."

Once graduates successfully pass the CompTIA exams, their resumes are given to Novacoast's staff augmentation arm, which helps companies hire tech professionals. So far, about 70 organizations have said they are willing to interview the program's graduates. They're from a variety of industries, including local businesses, federal agencies, vehicle manufacturers, and software firms. Graduates can work anywhere that "has an IT department," Mayne says.

**Cybersecurity Is a Career, Not Just a Job**

Mayne has been working with the White House's Office of the National Cyber Director to spread the word about the program, which also was featured in a recent short film from WorkingNation, a nonprofit media organization that explores the future of work in the US.

WorkingNation's Melissa Panzer, the short film's director, says that she hopes the film inspires business leaders to look to unlikely talent pools and expand who they consider for opportunities.

"I tell a lot of stories about people who are marginalized, and I always come back to the same thing: I believe that people who are marginalized, their work ethic is strong, their dedication is strong," she says. "They just want a chance."

The Apex Program plans to expand beyond its focus on BVI individuals to veterans and disabled veterans, which could open the program up to 500 to 800 students a year, Mayne says.

"We're bringing people to careers, not just to jobs. And we want them to be financially secure as well as have a career that they enjoy," Mayne says. "We're bringing students that are excited to get into this field, that are go-getters. We would like the people in the IT world to give these people a shot. That's what doesn't exist today."

**About the Author(s)**

Contributing Writer

Jennifer Lawinski is a writer and editor with more than 20 years experience in media, covering a wide range of topics including business, news, culture, science, technology and cybersecurity. After earning a Master's degree in Journalism from Boston University, she started her career as a beat reporter for The Daily News of Newburyport. She has since written for a variety of publications including CNN, Fox News, Tech Target, CRN, CIO Insight, MSN News and Live Science. She lives in Brooklyn with her partner and two cats.

Ambitious Training Initiative Taps Talents of Blind and Visually Impaired

With a complex attack chain and using Telegram for its command and control, CoralRaider targets victims in Asian countries — and appears to have accidentally infected itself as well.

Source: incamerastock via Alamy Stock Photo

A newcomer cybercrime group linked to Vietnam has targeted individuals and organizations in Asia, attempting to steal social media account information and user data.

CoralRaider, which first appeared in late 2023, relies heavily on social engineering and legitimate services for data exfiltration, and it develops custom tools for loading malware onto victim systems. Yet the group has also made some rookie mistakes, such as inadvertently infecting their own systems, which exposed their activities, threat researchers with Cisco's Talos threat intelligence group stated in a new analysis on CoralRaider.

While Vietnam has become increasingly active in cyber operations, this group does not appear to be working with the government, says Chetan Raghuprasad, security research technical leader for Cisco's Talos group.

"The main priority is financial gain, and the actor is attempting to hijack the victim’s social media business and advertis\[ing\] accounts," he says. "The potential exposure for follow-on attacks, including delivering other malware, is also possible. Our research has not seen any examples of other payloads being delivered."

Vietnam threat actors frequently focus on social media. The infamous OceanLotus group — also known as APT32 — has attacked other governments, dissidents, and journalists in Southeast Asian countries, including in Vietnam. A military-associated group, Force 47 — linked to the Vietnamese army's official television station — regularly attempts to influence social media groups.

CoralRaider, however, appears to be connected to profit motives rather than nationalist agendas.

"At this moment, we do not have any evidence or information on signs of CoralRaider working with the Vietnamese government," Raghuprasad says.

**Multistage Infection Chain**

A CoralRaider campaign typically starts with a Windows shortcut (.LNK) file, often using a .PDF extension in an attempt to fool the victim into opening the files, according to the Cisco analysis. Following that, the attackers move through a series of stages in their attack:

1.  Windows shortcut downloads and executes an HTML application (HTA) file from an attacker-controlled server
    
2.  HTA file executes an embedded Visual Basic script
    
3.  VB script executes a PowerShell script, which then runs three more PowerShell scripts, including a series of anti-analysis checks to detect if the tool is running in a virtual machine, a bypass for the system's User Access Controls, and code that disables any notifications to the user
    
4.  Final script runs RotBot, a loader that performs detection evasion, conducts reconnaissance on the system, and downloads a configuration file
    
5.  RotBot then typically downloads XClient, which collects a variety of user data from the system, including social media account credentials
    

In addition to credentials, XClient also steals browser data, credit card account information, and other financial data. And lastly, XClient takes a screenshot of the victim's desktop and uploads it.

Meanwhile, the researchers say there are indications that the attackers had targeted individuals in Vietnam as well.

"The \[XClient\] stealer function maps the stolen victim's information to hardcoded Vietnamese words and writes them to a text file on the victim machine's temporary folder before exfiltration," the analysis stated. "One example function we observed is used to steal the victim's Facebook Ads account that has hardcoded with Vietnamese words for Account rights, Threshold, Spent, Time Zone, and Date Created."

**Shooting Themselves in the Foot**

The CoralRaider group used an automated bot on the Telegram service as a command-and-control channel and as well as to exfiltrate data from victims' systems. However, the cybercriminal group appears to have infected one of their own machines, because the Cisco researchers discovered screenshots of the information posted to the channel.

"Analyzing the images of the actor's Desktop on the Telegram bot, we found a few Telegram groups in Vietnamese named 'Kiém tien tử Facebook, 'Mua Bán Scan MINI,' and 'Mua Bán Scan Meta,'" Cisco Talos stated in the analysis. "Monitoring these groups revealed that they were underground markets where, among other activities, victim data was traded."

CoralRaider's arrival on the cyber threat scene is not surprising: Vietnam is currently facing an increase in threats from account-stealing malware, says Sakshi Grover, research manager in IDC's Cybersecurity Services group for the Asia/Pacific region.

"While historically less associated with cybercrime compared to other Asian nations, Vietnam's rapid adoption of digital technologies has made it more susceptible to cyber threats," she says. "Advanced persistent threats (APTs) are increasingly targeting government entities, critical infrastructure, and businesses, utilizing sophisticated techniques like custom malware and social engineering to infiltrate systems and steal sensitive data."

Because economic conditions vary across Vietnam — with some areas experiencing limited job opportunities, resulting in low wages for highly skilled roles — individuals can be incentivized to engage in cybercrime to make money, Grover says.

**About the Author(s)**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Vietnamese Cybercrime Group CoralRaider Nets Financial Data

Industry experts share how to implement comprehensive security strategies necessary to secure the software supply chain in Dark Reading's latest Tech Insights report.

Software supply chain attacks are relatively easy to conduct and have a significant payoff for attackers, so it's little wonder why they're top-of-mind for CISOs.

"This is especially the case if the vulnerable hardware or software has a high adoption across enterprise organizations," says ReliaQuest CISO Jeff Music.

While some software supply chain attacks, such as the ones involving MOVEit and SolarWinds, garner considerable attention, there are many software supply chain attacks occurring every day that don't get their moment in the spotlight. And no one beyond their victims ever hear about what happened.

But whether well-known or obscure, they create considerable risk for organizations.

For Dark Reading's latest Tech Insights report, "How Supply Chain Attacks Work and How to Secure Them," we interviewed experts who shared how to implement the comprehensive security strategies necessary to defend against these attacks. They include managing vendor risk, implementing security frameworks, conducting software composition analysis, and ensuring adequate DevSecOps practices are in place.

**Can't Blindly Trust Software**

In software supply chain attacks, malicious code or components are inserted into legitimate software applications or dependencies. The malicious software then enables attackers to infiltrate organizations that use those compromised systems.

Unfortunately, enterprises can't blindly trust their technology environments — from their end-user endpoints to third-party suppliers or the open-source components they rely on. These software supply chain attacks are insidious and have the power to compromise vast amounts of enterprise data and disrupt essential services across all business sectors.

In the case of MOVEit, for example, the attacks compromised the personal data of millions of people and affected more than 1,050 organizations, including those in the federal government, healthcare, education, finance, and insurance.

The stakes are high, and CISOs and security teams are grappling with these risks. Download a copy of our new report to learn from industry experts about how to implement the comprehensive security strategies necessary to defend against supply chain attacks.

**About the Author(s)**

An award winning writer and journalist, for more than 20 years George Hulme has written about business, technology, and IT security topics. He currently freelances for a wide range of publications, and is security blogger at InformationWeek.com.

Tips for Securing the Software Supply Chain

SaaS vendor to blame for exposing employee data that was ultimately leaked on Dark Web forum, according to the home improvement retailer.

Source: Ian Dagnall via Alamy Stock Photo

A hacking forum leak has led Home Depot to confirm that its employee data was compromised via a third-party software vendor.

Home Depot did not identify the breached software-as-a-service (SaaS) vendor but said an error exposed the names, corporate IDs, and email addresses of a "small sample" of its employees, according to reports. Now up for sale on the Dark Web, this is the type of data that could be used to fuel targeted phishing cyberattacks.

The incident highlights how selecting SaaS vendors with strong cybersecurity protections is critical for enterprises, according to Tamir Passi, director of product with DoControl.

**Software Supply Chain Cyber Risk**

Passi recommends testing a third-party supplier's workflow before providing them access to your data.

"Ideally, real employee data should not be used to test a new vendor's workflow," Passi explained in a statement. "In general, system testing and validation should be done with non-production data sets unless all the necessary and same security and privacy protocols are in place for production as for testing."

Passi cautioned that once data is handed over to a partner, it's too late to do anything about its security.

In addition to due diligence and vetting prior to selecting a SaaS vendor, Mika Alto, co-founder and CEO of Hoxhunt, recommends regular audits.

"The threat landscape is always changing, so continuous training on security best practices are vital," Alto said in a statement. "Employees and security professionals at all levels should be equipped to recognize and respond to potential threats, including those that may arise from third-party sources."

A decade ago Home Depot experienced a much larger data breach where customer credit card data related to purchases at stores across the US and Canada was compromised.

Home Depot Hammered by Supply Chain Data Breach

RansomHub, which is speculated to have some connection to ALPHV, has stolen 4TB of sensitive data from the beleaguered healthcare company.

Source: Lenetstan via Shutterstock

Change Healthcare reportedly is facing another attack, this time by ransomware gang RansomHub, just weeks after it became a victim in an ALPHV/BlackCat cyberattack.

RansomHub is demanding an extortion payment for an alleged 4TB of data it stole from the company; otherwise, it's threatening to sell the data to the highest bidder in 12 days.

The stolen information contains the sensitive data of US military personnel and patients, as well as medical records and financial information, among other things.

"Change Healthcare and United Health, you have one chance in protecting your clients data," RansomHub reportedly said. "The data has not been leaked anywhere and any decent threat intelligence would confirm that the data has not been shared nor posted."

This puts Change Healthcare, a subsidiary of United Healthcare, in what likely is a difficult position in having to decide whether or not paying the ransom is its best option when it has only just gotten back on its feet from the last attack. 

According to Malachi Walker, security adviser at DomainTools, whose team has been following ALPHV/BlackCat's activity, "this new information supports a few theories that our team has suggested; but no matter the case, it's unfortunate that Change Healthcare is caught in the middle of this conflict between two rival gangs," he said in an emailed statement.

"Even if not connected to BlackCat, RansomHub could be claiming ties to their victims to scare them into making a payment," he added. "There is a vast underground economy booming around the ransomware scene today where affiliate programs recruit on hacker forums, initial access brokers sell footholds into organizational networks, and ransomware groups collaborate to share information."  

Though there is significant speculation regarding whether ALPHV rebranded to RansomHub, or if there is any connection at all, Walker said there is no confirmation, as it's too early to tell.

**About the Author(s)**

Round 2: Change Healthcare Targeted in Second Ransomware Attack

PRESS RELEASE

Washington, D.C. – Following a new report about how shambolic cybersecurity practices by a federal technology contractor enabled a massive hack of the U.S. government systems, Senator Ron Wyden, D-Ore., released draft legislation today to set mandatory cybersecurity standards, save taxpayers money, and break the anti-competitive lock-in effect caused by proprietary, walled-garden software. 

Multiple disastrous hacks of U.S. government systems have been enabled by poor cybersecurity practices by Big Tech companies providing services to the government. Most recently, the Department of Homeland Security Cyber Safety Review Board cited a “cascade” of errors by Microsoft, allowing Chinese hackers to breach federal email systems. 

The Secure and Interoperable Government Collaboration Technology Act would require the government to set new secure, open standards for collaboration software, which would also promote competition and save taxpayer dollars. 

“My bill will secure the U.S. government’s communications from foreign hackers, while protecting taxpayer wallets. Vendor lock-in, bundling, and other anticompetitive practices result in the government spending vast sums of money on insecure software,” said Wyden. “It’s time to break the chokehold of big tech companies like Microsoft on government software, set high cybersecurity standards and reap the many benefits of a competitive market.” 

While phone calls and email messages allow users to communicate no matter which mobile network or email provider they use, collaboration software is frustratingly walled off. Although video conferencing software like Zoom, Webex, and Microsoft Teams offer similar functionality, users cannot communicate across platforms. Similar barriers exist for chat services like Slack and document editors like Google Docs and Microsoft Office. As a result, agencies often become locked into expensive, insecure walled gardens that result in wasted time and taxpayer dollars as government employees switch constantly between different collaboration software products.

The Secure and Interoperable Government Collaboration Technology Act would –

Require the National Institute of Standards and Technology (NIST) to identify a set of interoperable standards, requirements, and guidance for each of these collaboration technology features, based on a set of required collaboration technology features identified by the General Services Administration (GSA).

Require that, to the fullest extent possible, the standards use end-to-end encryption and other technologies to protect U.S. government communications from foreign surveillance.

Require that collaboration technologies used by federal agencies enable those agencies to comply with federal record-keeping requirements.

Four years after NIST identifies the standards, require that collaboration technology procured by the federal government be capable of communicating using the NIST standards. 

Tasks the Department of Homeland Security with conducting cybersecurity reviews of collaboration technology products widely used by the federal government.

Create a GSA and Office of Management and Budget working group to produce biennial reviews of collaboration tech used by the federal government to suggest additions or improvements to the standards.

The draft legislation is endorsed by Accountable Tech, Demand Progress, Fight for the Future, Proton, Nym, the Matrix.org Foundation, and Cory Doctorow.

“Interoperability - the ability to plug something new into a technology, with or without permission from the manufacturer - is the key to defeating Big Tech,” said Doctorow. “This bill will require public funds to be spent on technology that anyone can fix, extend, or improve, preventing tech companies from locking in and ripping off the US government. The most amazing part is that this isn't already the way it's done.”

“Through this legislation, the federal government has the opportunity to set an example for workplaces, organizations, and institutions across the country on how to fundamentally improve online safety. Protecting digital communication with end-to-end encryption is essential to data privacy and security, and should be the standard across the board. Without it, messages can be intercepted and abused by hackers, repressive law enforcement agencies, foreign governments, or the company that owns the platform itself. Everyone from the former director of the NSA, to Big Tech companies, to human rights defenders working under authoritarian regimes have highlighted the life-saving importance of end-to-end encryption. The issue of data privacy has never been more urgent, and decisive lawmaker action is needed in this moment to bring about tech platform policies that truly center our privacy and needs as users—not corporate profits,” said Leila Nashashibi, campaigner at Fight for the Future. 

Wyden is accepting feedback on the draft legislation at \[email protected\]

The text of the draft bill is available here. 

A one-page summary of the bill is here.

Wyden Releases Draft Legislation to End Federal Dependence on Insecure, Proprietary Software

PRESS RELEASE

DALLAS – April 9, 2024 – StrikeReady, the AI-pioneer advancing the way modern security teams operate, today announced $12 million in funding. The Series A round was led by 33N Ventures, with participation from Hitachi Ventures, Monta Vista Capital and industry luminaries Brian NeSmith, executive chairman and former CEO at Arctic Wolf; and Rod Beckstrom, former CEO of ICANN and Founding Director of U.S. National Cybersecurity Center (now CISA). 

StrikeReady is revolutionizing cybersecurity with its groundbreaking, vendor-neutral AI security operations platform. This one-of-a-kind solution seamlessly integrates with organizations existing security tools, unifying the entire tech stack. StrikeReady’s command center makes SOC teams more efficient and effective by uniting, centralizing and operationalizing security, fostering smarter, faster decision-making and proactive security defense.

SOC environments are complex and the tools traditionally used to manage security have proven ineffective and inefficient in bringing disparate technologies together and keeping companies ahead of threats. Further complicating the issue is the perpetual shortage of skilled security professionals, which hampers the ability to manage and respond to security incidents, leaving organizations vulnerable to cyber threats.

These challenges are driving the growth of StrikeReady, which is transforming the way modern security teams operate by reinventing how everything works together, while delivering a comprehensive, trustworthy view of security threats.

“Our security management platform up-levels and scales the capability of any SOC by making best-of-breed AI automation accessible and affordable for everyone,” Founder and CEO Yasir Khalid said. “The platform leverages AI to streamline and automate the routine and empower better, faster response to complex threats. Until now, our customers have referred to StrikeReady as a ‘well-kept secret’, but this funding will accelerate market awareness and growth.”

StrikeReady has secured Series A funding amidst challenging investment conditions, a testament to the sophistication of its AI solution and the pressing cybersecurity challenges it addresses. Despite turbulent times, StrikeReady’s innovative approach to how security teams work has garnered significant investor confidence, positioning the company as a leader in cybersecurity. StrikeReady intends to use its new funding to extend its product leadership in AI-based SOC technology, ramp its global go-to-market team, and continue scaling its infrastructure.

"StrikeReady is breaking the mold of conventional security solutions. We refuse to believe that security-centric companies should be confined to one platform. Instead, we champion the idea that teams should have the freedom to utilize the best-of-breed technology available,” said Carlos Moreira da Silva, co-founder and partner at 33N Ventures. “StrikeReady turns this belief into reality through its dedication to seamless integrations, ensuring compatibility with the diverse array of tools utilized by SOC teams today and tomorrow.”

“StrikeReady pioneers a groundbreaking AI-powered Security Command Center. Their hybrid model augments human intuition with cutting-edge AI and ML technologies. The mission: Streamlining tool sprawl, bridging the cybersecurity skills gap, all while placing humans – equipped with unparalleled guidance and automation – firmly at the helm of the cyber defense arsenal,” said Galina Sagan, Principal at Hitachi Ventures.

About StrikeReady:

Founded in 2019, StrikeReady is an AI pioneer in cybersecurity. StrikeReady introduces the first unified, vendor-agnostic, AI-powered security command center, purpose-built for modern SOC teams to optimize, centralize and accelerate a company’s threat response.

StrikeReady remains at the forefront of advancing beyond traditional AI and large language model (LLM) to a proprietary large action model (LAM), which takes actions across the technology stack based on a user’s prompts. The company’s forward-thinking AI technology has earned several external accolades, including validation from Gartner, which called the company out as the only Virtual Security Assistant in its Gartner Emerging Technologies: Tech Innovators in Advanced Virtual Assistants report.

The platform’s user-centric approach uplevels the entire security team into a proactive AI-powered cyber task force by dynamically centralizing, informing and advising security teams with a smarter, holistic and actionable defense against an ever-evolving threat landscape.

StrikeReady helps companies simultaneously reduce cyber threats and overcome the cyber talent deficit. For CISOs and security leaders who want more information on StrikeReady’s unified AI-powered security platform:

 Request a demo or Learn more.

About 33N:

33N is a specialized cybersecurity and infrastructure software European venture capital fund investing globally in €1-€10M ARR companies. 33N is made up of an experienced and established international team investing in the space for the last 10 years. The fund is supported by a strong Strategic Committee and Advisory Board encompassing +40 top entrepreneurs, experts and decision-makers spread worldwide and across the industry. Find more about 33N at https://33n.vc

StrikeReady Raises $12M for AI Security Command Platform

As manufacturers sprint to add software-defined features for vehicles, the ability for third-party maintenance and repair falls behind, leaving businesses with few choices to manage their cybersecurity.

Source: Open Studio via Shutterstock

When Israel-based REE Automotive designed its P7 electric vehicle chassis, it worked from the software out: The flat vehicle chassis is totally configurable with four independent modules near each tire for steering, braking, suspension, and power train, each driven by an electronic control unit (ECU) customizable through software.

It has drive-by-wire, steer-by-wire, and brake-by-wire — and data collection as a service — giving the company the ability to tailor the vehicle to the customer's application, but also potentially making the platform a hacker's dream.

Securing a vehicle fleet is a major effort, requiring cybersecurity for the design and development teams, the factory floor, and the connected vehicles themselves, says Yaron Edan, CISO for the automotive technology company. Cybersecurity teams not only have to monitor cyber threats, but also manage the security of the supply chain, the operation technology (OT) in the factory, and the vehicle network used to monitor and update the platform.

"My headache, my concern, is basically divided in two: our network \[which supports the creation of the platform\], but that is not enough," he says. "We need to figure out what are the threats, and monitor \[for those\] all day long for each vehicle through our SOC."

Such security efforts, however, have another challenge: The success of "right to repair" efforts to open up all kinds of consumer and enterprise technology to allow customers to fix the devices that they buy. The passage of a Massachusetts law, for instance, calls for auto manufacturers and automotive-technology makers to share information and data produced by vehicles to allow consumers and third parties to maintain, repair, and even modify their vehicles.

While the National Highway Traffic Safety Administration (NHTSA) initially ruled that existing federal safety regulations preempted the laws — saying, "\[f\]ederal law does not allow a manufacturer to sell vehicles that it knows contains a safety defect" — the state and federal governments eventually came to an agreement over implementation: Automakers would be required to give third parties the ability to locally access data and systems to the vehicles they own, but the remote diagnostic and update networks can remain closed, the regulators ruled.

**EVs Bring Great Flexibility and Risk**

Whether the agreement will help companies with large fleets of vehicles, especially electric vehicles, remains an open question. Software-defined vehicles really took off with EVs — and the example of Tesla's success — and the most significant software-based capabilities will likely remain with electric vehicles.

EV makers can build their platforms starting with initial design using software that can be updated to change the configuration and performance of the vehicles all the way through deployment and beyond, says Alex Oyler, director for North America at SBD Automotive, an auto supply chain consultancy.

The ability to effectively and quickly respond to cybersecurity events will likely remain with those manufacturers, not third parties, he says.

"If there's a really critical zero-day, and that needs to be patched as soon as possible, those product cybersecurity teams \[at auto manufacturers\] are running the show, coordinating stakeholders across the business and accelerating timelines to patch things," he says. "It's not an easy process today, that's for sure."

Some manufacturers may outsource the cybersecurity function, however. The United Nations passed an amendment for product safety requiring the countries which are part of the UN Economic Commission for Europe have regulatory approval of the cybersecurity management systems used in vehicles.

**Connectivity Will Only Grow**

Vehicles have been connected for decades, whether as part of an in-vehicle maintenance system or driver assistance. Yet, software-defined vehicles have expanded that connectivity, such as remote start via a smartphone app and tracking limited diagnostics for the consumer — essentially turning cars into Internet-of-things (IoT) devices. As automobile manufacturers offer more accessibility through APIs, more risk will follow, says Shira Sarid-Hausirer, a vice president at Upstream, an automotive cybersecurity and data management firm.

"Opening up to the ecosystem is what has probably introduced the most risk," she says, pointing to various cybersecurity hacks of Tesla vehicles. "What happens when OEMs started to open up their APIs to other third-party apps that can now send commands into your vehicle? ... The vehicle is becoming a hub for technology."

Giving companies access to some of that data to allow fleet management may be enough, while the agreement in the Massachusetts Right to Repair law allows some third parties to offer vehicle maintenance services — although, probably at great cost. Whether those restrictions will ameliorate in the future, as the fast pace of SDV innovation slows, remains to be seen, SBD Automotive's Oyler says.

"It's somewhat fair for both NHTSA and automakers to raise some flags, but that said, there is a secure way to share diagnostic information, and the software defined vehicle actually provides a way to do that through those secure channels," he says.

**Cyberattacks Unlikely to be Catastrophic, Mostly**

Automakers' recent focus on cybersecurity has resulted in much more secure platforms over the past decade. But the focus for the future needs to be on delivering that security and safety, while offering more transparency to customers, Oyler says. As enterprise customers and individual vehicle owners demand more maintainability and reusability in their devices, automakers will need to follow.

Properly designed platforms can also drastically reduce the risk of a widespread cyberattack, says Upstream's Sarid-Hausirer. The company already handles threat intelligence and incident response for some manufacturers and most incidents are not safety-related, but the company does classify half of all incidents as massive or high severity, according to the company's "2024 Automotive Cybersecurity Report."

"I can tell you that the vast majority of incidents that we see do not necessarily jeopardize safety, because there needs to be a reason to jeopardize your safety, and attackers don't work that way — they're out there to make money," she says. Instead, the company has seen a lot of attacks on availability. "They manipulate the app, so that you cannot start your trucks or get into your trucks in the morning. It could be ransomware, it could be other forms, but availability and fleets is something that has to be discussed."

Other attacks have used ride-hailing apps to cause traffic jams in Moscow and hacks for remote start apps. Those availability issues are less to do with diagnostic systems, such as the information necessary for right to repair, and more to do with the management systems, she says.

**About the Author(s)**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Software-Defined Vehicle Fleets Face a Twisty Road on Cybersecurity

Investing in cybersecurity skills creates a safer digital world for everyone.

Source: Mopic via Alamy Stock Photo

COMMENTARY

The recent movie The Beekeeper begins with a cyberattack against a victim unfamiliar with the tactics and techniques attackers use in today's technology-driven world. The film's protagonist, Adam Clay, played by Jason Statham, then goes on a digital vendetta to find the responsible adversaries and ensure they can't continue extorting victims through common cybercrimes.

As much as our security teams would love to do threat hunting like Clay, we lack the physical physique and combat skills. And we know spreading awareness is a far more effective approach. Keeping the workforce fully educated can be a monumental task. However, it's the one thing that can entirely mitigate threats that target individuals. Some of the new ways of training involve old techniques.

**Adaptable > Repeatable**

In cybersecurity, technology operates predictably, but humans do not. As security professionals, we need help remembering this. The distinction underscores the need for person-led training during an employee's onboarding. Interactive training acknowledges human complexity, emphasizing the importance of adaptability in response to new threats and individual learning styles. Unlike automated training, person-led approaches can quickly adjust to address unique challenges and learner needs, making them more effective in promoting a deep understanding of security practices.

How quickly can your organization adapt to AI-based threats? Since human error accounts for almost 90% of all data breaches, organizations that prioritize their work and resources on risk will have a difficult time finding anything more important than an educated workforce. Train people with people. Use security champions if your team needs more resources or has time zone constraints. But overall, try to do something other than automate the process. 

**Build Storytellers**

Creating a solid cybersecurity culture involves enabling employees to share their personal experiences with security issues openly. Most people have learned their most valuable security lessons based on stories from other people. Sharing security stories may not come naturally to employees, and we need to teach and promote this behavior. During training, ask employees to discuss how cybersecurity has personally affected them in the past. Ask them about their familiarity with safe password hygiene or social media posts. This open-discussion initiative can help them feel at ease with the topic and understand that the organization encourages it. 

**Test the Response**

Implementing specific tests and monitoring employee behavior is essential to gauge the effectiveness of a security program. We know new employees will receive the fake text message from the CEO requesting gift card purchases. Try a simple smishing or phishing simulation with new employees to see if they proactively reach out after detecting the attempt. If employees actively communicate with each other about phishing campaigns, share security-related news, or discuss various security topics, it shows they have a sense of confidence and proper education in cybersecurity. This level of engagement and vigilance among staff members highlights the program's effectiveness in fostering a proactive security culture. When you see it, be quick to reward it. 

**Conclusion**

Unlike The Beekeeper, we won't be able to hunt down the adversaries and kick some butt. Instead, developing a robust security culture through awareness is our fight against cybercrime. Encouraging employees to share their experiences with security enables a sense of community and vigilance. Personalized training plays a critical role in this ecosystem. It's not just about delivering information; it's about tailoring the learning process to meet diverse needs and respond to emerging threats. We can assess how prepared our employees are to identify and counteract potential threats through testing.

The benefits of these strategies extend beyond the office walls. We're not merely educating our workforce; we're equipping them with knowledge that transcends the professional environment. This empowerment boosts their confidence, making them safer and more adept Internet users, at work and in their personal lives. By investing in their cybersecurity skills, we're contributing to a safer digital world for everyone.

Source

DARKReading