Category: Government Information

Dec 13 2017

NIST Releases Draft Update To Cybersecurity Framework

In 2014, the National Institute of Standards and Technology (NIST) released its first version of the Framework for Improving Critical Infrastructure Cybersecurity (Cyber Framework). The Cyber Framework was originally developed as a voluntary framework to help private organizations and government agencies manage cybersecurity risk in the critical infrastructure space (e.g., bridges, power grid, etc.). Since then, it has been widely adopted across industry as a benchmark standard for measuring an enterprise’s cybersecurity readiness.

Following feedback NIST received in December 2015 from a Request for Information, and comments from attendees at the Cybersecurity Framework Workshop in 2016 held at the NIST campus in Maryland, NIST released a draft update to the Cyber Framework in January 2017 called Version 1.1. Some of the key changes in the draft update included:

  • Adding a new section on cybersecurity measurement to discuss the correlation of business results to cybersecurity risk management metrics and measures;
  • Expanding the use and understanding of cyber supply chain risk management frameworks;
  • Accounting for authentication, authorization, and identity proofing in the access control section of the framework; and
  • Better explaining the relationship between the various implementation tiers and profiles.

Last week, NIST released a second draft of Version 1.1, which is open for public comment through January 20, 2018. The new draft expands on issues such as supply chain security and vulnerability disclosure programs. It also emphasizes the need for companies using the framework to develop metrics to quantify their progress. NIST says it hopes to finalize Version 1.1 in the spring of 2018.

If you are interested in submitting comments on the new draft of Version 1.1, or learning more about its proposed changes that will likely take effect in 2018, the Dentons Privacy and Cybersecurity Group is ready to assist.

Dentons is the world’s largest law firm, a leader on the Acritas Global Elite Brand Index, a BTI Client Service 30 Award winner, and recognized by prominent business and legal publications for its innovations in client service, including founding Nextlaw Labs and the Nextlaw Global Referral NetworkDentons’ Privacy and Cybersecurity Group operates at the intersection of technology and law, and has been singled out as one of the law firms best at cybersecurity by corporate counsel, according to BTI Consulting Group.  

Jul 11 2017

DHS and FBI – Hackers Are Targeting US Nuclear, Energy, and Manufacturing Facilities

According to a new joint report issued by the US Department of Homeland Security (DHS) and Federal Bureau of Investigation (FBI), hackers have been penetrating the computer networks of companies that operate nuclear power stations, energy facilities, and manufacturing plants in the US since May 2017. The joint report carried an urgent amber warning, which is the second-highest rating for the sensitivity of a threat. The report was publicized by the New York Times last week.

According to the report, an “advanced persistent threat” actor was responsible for the attacks, which has included thus far:

  • Hackers writing targeted email messages containing fake resumes for control engineering jobs and then sending them to senior industrial control engineers who have access to critical industrial control systems. The resumes were Microsoft Word documents that contained malicious code. Once the recipient clicks on the document, the attackers copy the recipient’s credentials and access the network.
  • Hackers compromising websites they know their victims visit (watering hole attack).
  • Hackers redirecting the victims’ internet traffic through their own machines (man-in-the-middle attack).

The report does not say whether the cyber intrusions are an attempt at espionage, or part of a plan to cause physical damage. Nor is there any indication as to how many facilities were compromised. The report does state, however, that the hackers appear to be mapping out computer networks for future attacks.

In a joint statement issued by the DHS and FBI, a spokesperson for the DHS said “There is no indication of a threat to public safety, as any potential impact appears to be limited to administrative and business networks.” John Keeley, a spokesperson for the Nuclear Energy Institute (which works with the 99 utilities that operate nuclear plans in the US), said nuclear facilities are required to report cyber attacks that relate to their safety, security and operations. None have reported any cyber attacks thus far.

On May 11, as the attacks were ongoing, President Trump signed an executive order to strengthen the cybersecurity of federal networks and critical infrastructure.

If you or your enterprise is engaged in the energy or manufacturing sectors, cyber threat preparation and monitoring is your first line of defense against bad actors. Dentons’ team of cybersecurity experts can assist you in establishing and implementing an effective and compliant incident response plan and set of programs to monitor internal and external threats, including threat intelligence and access control and vulnerability assessments.

Dentons is the world’s largest law firm, a leader on the Acritas Global Elite Brand Index, a BTI Client Service 30 Award winner, and recognized by prominent business and legal publications for its innovations in client service, including founding Nextlaw Labs and the Nextlaw Global Referral Network. Dentons’ global Privacy and Cybersecurity Group operates at the intersection of technology and law, and was recently singled out as one of the law firms best at cybersecurity by corporate counsel, according to BTI Consulting Group.  

May 23 2017

President Trump’s Budget Requests $1.5B For Homeland Security Cyber Unit

President Trump’s new budget includes a request to increase cybersecurity personnel and funding across several federal departments, including $1.5 billion for the Department of Homeland Security’s (DHS) National Protection and Programs Directorate (NPPD). The NPPD is a DHS unit responsible for protecting US infrastructure from cyber threats. The DHS is responsible for protecting critical infrastructure and federal networks from cyber intrusions.

The budget document, released by the Office of Management and Budget earlier this morning, states: “The Budget supports the President’s focus on cybersecurity to ensure strong programs and technology to defend the Federal networks that serve the American people, and continues efforts to share information, standards, and best practices with critical infrastructure and American businesses to keep them secure[.]” The budget document also proposes to increase law enforcement and cyber personnel at DHS, the FBI and Department of Defense.

The President’s budget comes on the heels of his recent Executive Order aimed at strengthening cybersecurity across federal networks, critical infrastructure, and the nation writ large. It also comes in the wake of federal departments and agencies, such as DHS, Health and Human Services, and the Securities and Exchange Commission, focusing their efforts on cybersecurity in medical devicesmobile devices, financial services, and the Internet of Things (IoT).

 

May 19 2017

US Government Accountability Office Releases New Report On The Internet of Things (IoT)

On May 15, 2017, the US Government Accountability Office (GAO) released a new report entitled “Internet of Things: Status and implications of an increasingly connected world.” In the report, the GAO provides an introduction to the Internet of Things (IoT), describes what is known about current and emerging IoT technologies, and examines the implications of their use. The report was prepared by reviewing key reports and scientific literature describing current and developing IoT technologies and their uses, concentrating on consumers, industry, and the public sector, and interviewing agency officials from the Federal Trade Commission (FTC) and Federal Communications Commission (FCC). The GAO also convened a number of expert meetings during the drafting process, bringing together experts from various disciplines, including computer science, security, privacy, law, economics, physics, and product development.

Technological Advancements Leading To IoT Surge

The GAO identified four technological advancements that have contributed to the increase in IoT devices:

  • Miniaturized, inexpensive electronics. According to the GAO, the cost and size of electronics are decreasing, making it easier for the electronics to be embedded into objects and to be enabled as IoT devices. For example, the price of sensors has significantly declined over the past decade. One sensor called an accelerometer cost an average of $2 in 2006. The average price of the unit in 2015 was $.40.
  • Ubiquitous connectivity. The GAO notes that the expansion of networks and decreasing costs allow for easier connectivity, and for IoT devices to be used almost anywhere. The proliferation of Wi-Fi options and Bluetooth creates a more expansive space for IoT to operate.
  • Cloud computing. Cloud computing allows for increased computer processing. Because IoT devices create a large amount of data, they require large amounts of computing power to analyze the data. The increase and availability of cloud computing is helping IoT devices expand.
  • Data analytics. New advanced analytical tools can be used to examine large amounts of data to uncover hidden patterns and correlations. According to the GAO, advanced algorithms in computing systems can enable the automation of data analytics, and allow for valuable information to be collected by IoT devices.

Common Components Of IoT Devices

The GAO identifies three major components that make up nearly all IoT devices: (1) hardware, (2) network connectivity, and (3) software. The hardware used in IoT devices generally consists of embedded components, such as sensors, actuators, and processors. Sensors generally collect information about the IoT environment, such as temperature or changes in motion. Actuators perform physical actions, such as unlocking a door. And processors serve as the “brains” of the IoT device. The network component of an IoT device connects it to other devices and to networked computer systems. And the software in IoT devices perform a range of functions, from basic to complex. These three components are common across the IoT industry, and serve as the bedrock foundation for understanding the security challenges facing the IoT space.

Benefits and Uses

According to the GAO, the benefits and uses of IoT for consumers, industry and the public sector are widespread. From wearable IoT devices, such as fitness trackers, smart watches and smart glasses, to smart homes, buildings and vehicles, IoT is changing the landscape of consumer products and how people interact with their space. IoT is also impacting supply chain and agriculture industries, enhancing productivity and efficiency.

Potential Implications

With these benefits comes potential risk. The GAO report identifies five risk categories presented by the onset of new IoT technology: (1) information security; (2) privacy; (3) safety; (4) standards; and (5) economic issues.

  • Information security. The IoT brings the risks inherent in potentially unsecured information technology systems in homes, factories, and communities. IoT devices, networks, or the cloud servers where they store data can be compromised in a cyberattack.
  • Privacy. Smart devices that monitor public spaces may collect information about individuals without their knowledge or consent.
  • Safety. Researchers have demonstrated that IoT devices, such as connected automobiles and medical devices, can be hacked, potentially endangering the health and safety of their owners.
  • Standards. IoT devices and systems must be able to communicate easily. Technical standards to enable this communication will need to be developed and implemented effectively.
  • Economic issues. While impacts such as positive growth for industries that can use the IoT to reduce costs and provide better services is a beneficial outcome, economic disruption is also possible, such as the need for certain types of businesses and jobs that rely on individual interventions, including assembly line work or commercial vehicle deliveries.

As IoT technology increases, so too will the regulatory landscape governing its use. Although there is no single US federal agency that has overall regulatory responsibility for IoT, various agencies oversee or regulate aspects of the IoT, such as specific sectors, types of devices, or data. If you or your business is operating, or plans to operate in the IoT space, the Dentons’ global Privacy and Cybersecurity group can help you navigate this fast-paced, and shifting environment.

Dentons is the world’s largest law firm, a leader on the Acritas Global Elite Brand Index, a BTI Client Service 30 Award winner, and recognized by prominent business and legal publications for its innovations in client service, including founding Nextlaw Labs and the Nextlaw Global Referral Network. Dentons’ global Privacy and Cybersecurity Group operates at the intersection of technology and law, and was recently singled out as one of the law firms best at cybersecurity by corporate counsel, according to BTI Consulting Group.