House hearing will focus on cyber

The Department of the Treasury and the State Department will be the center of attention next week during a House Committee on Oversight and Government Reform subcommittee hearing on federal cybersecurity practices.

The Departments of State and Treasury will be in the hot seat next week during a planned House Committee on Oversight and Government Reform subcommittee hearing on federal cybersecurity practices.

In an obtained memo, full committee Chairman Rep. Jason Chaffetz, R-Utah, says the hearing will focus on detection and mitigation efforts related to two high-profile security incidents: the gaps found in the security of the State Department’s Consular Consolidated Database and the vulnerabilities revealed December in Juniper Networks’ firewall software. Treasury is one of many federal agencies that was using Juniper’s software, known as NetScreenOS, at the time.

Among the witnesses expected at the hearing are Treasury Chief Information Officer Sonny Bhagowalia, State CIO Steven Taylor, and Homeland Security Department’s Assistant Secretary for Cybersecurity and Communications Andy Ozment.

Last month, ABC News published a report stating that experts found security gaps in the State Department database that could have allowed hackers to doctor visa applications or pilfer sensitive data like photographs, fingerprints and social security numbers. That database — which holds biometric data from almost everyone who has applied for a U.S. passport or visa in the past two decades — has had technical issues in the recent past, going offline for a significant amount of time in 2014 and 2015.

[Read more: Congress demands info on Juniper backdoor]

In the wake of the Juniper vulnerability, the House Oversight committee sent letters to various government agencies asking if their IT security teams issued patches to systems using NetScreenOS. Last December, the company discovered ‘unauthorized code’ that would allow sophisticated hackers to control the firewall of un-patched Juniper products and decrypt network traffic.

The company’s products are used by a number of government agencies, including the departments of Defense, Justice and Treasury.

Also scheduled to appear at the hearing are Richard Barger, chief intelligence officer for ThreatConnect, and Charles Carmakal, vice president of Mandiant. Barger previously served as a U.S. army intelligence analyst while Carmakal’s expertise is in large and complex security incident response.

The hearing is scheduled for Wednesday, April 20 at 9:30 a.m.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure