DHS’s cyber wing pledges to invest more in industrial control systems security

The goal is to use data analytics, enhanced training, and better technology to guard infrastructure from hacking.

The Department of Homeland Security’s cybersecurity division on Tuesday unveiled a strategy to help protect industrial control systems that support energy, transportation, and other critical sectors from being hacked.

The goal is to use data analytics, enhanced training, and better technology to help guard U.S. critical infrastructure operators from foreign hacking groups that have shown a steady interest in their networks.

“We’re going to ask more of the ICS community, but we’re also going to deliver more to you,” Chris Krebs, head of DHS’s Cybersecurity and Infrastructure Security Agency, said at a virtual meeting of the ICS Joint Working Group, a government-industry initative.

A better understanding of cybersecurity risk in the industrial space can lead to “being out in front of the adversary…putting friction into their plans so that they have to…develop new capabilities,” Krebs said.

“We’re going to develop deep data capabilities to analyze and deliver information the community can use to disrupt the ICS kill chain,” he added, referring to the different stages of a cyberattack on industrial systems.

U.S. critical infrastructure operators have continued to invest in defenses as multiple hacking groups have probed their systems in recent years. In late 2018, the group behind the infamous Trisis malware, which forced a Saudi petrochemical plant to shut down, expanded its targeting to include U.S. electric utilities.

Industrial organizations have studied those hacking techniques to boost defenses. For its part, CISA can do more to turn data from hacking incidents the agency responds to into security advice, Krebs said. That could mean more analyses like the one CISA released in February of a ransomware attack on a natural gas compression facility.

CISA has long appealed for collaboration with ICS security professionals, but the agency prioritized the effort after the federal government shutdown in December 2018 and January 2019. On Tuesday, Krebs pledged more frequent and in-depth discussions with industry executives to understand what they’re looking for from the federal government.

Krebs began the webinar by reflecting on the protests that have gripped the U.S. since the killing of George Floyd, an unarmed black man, by Minneapolis police last month.

“The recent events of civil unrest across the country really lay bare…a number of the concerns, the shortages, the lack of inclusivity and diversity that we have across the infosec and ICS security space and gives us a lot of time to reflect on where we are as a community,” Krebs said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure