‘Cyber Storm’ drill for critical infrastructure focuses on corruption of key IT services

It is the subtle manipulation of these IT services that advanced hacking campaigns often exploit in the real world.

In a drill this week that drew some 2,000 participants, the Department of Homeland Security tested the ability of companies in the health care, manufacturing and other key sectors to withstand hypothetical hacking campaigns that compromise the trust users place in key internet services.

The seventh iteration of Cyber Storm, as the biannual exercise is called, focused on what could go wrong when some of the pillars of the internet are corrupted. It is the subtle manipulation of these IT services that advanced hacking campaigns often exploit in the real world.

The simulation featured compromised certificate authorities, which deem software trustworthy, attacks on the Border Gateway Protocol, the internet’s basic routing mechanism, and the subversion of domain name system (DNS) records, which help send a user to a website that is not malicious.

“[I]t was clear that many organizations do not have a full understanding of their reliance on third-party services,” said Brian Harrell, assistant director of DHS’s Cybersecurity and Infrastructure Security Agency who was partly responsible for planning the exercise. “Just because you think you are compliant and secure doesn’t necessarily mean that the folks that you rely on in your time of need are equally as secure.”

But on the whole, Harrell said, critical infrastructure companies have improved their defenses in response to the years of drilling.

Participants, which also included state and local officials and U.S. law enforcement and intelligence representatives, had to respond to “a nationally significant incident where companies lost control” of their DNS registries, Harrell told reporters Friday.

Ransomware, denial-of-service attacks and insider threats all played a part in the scenario, which featured varied hacking groups with different skill levels that were bent on undermining confidence in IT systems. Participants used information-sharing centers to map malicious behavior and piece together the attacks that were unfolding.

DNS records have been an abiding concern for CISA, which monitors the security of civilian agencies of the U.S. government. In January 2019, CISA issued an “emergency order” for agencies to secure their domain login credentials following reports of a cyber-espionage campaign that manipulated DNS records.

The coronavirus pandemic forced Cyber Storm to move from the spring to August. But it also gave exercise planners a chance to alter the scenario to account for another threat. CISA officials and private-sector analysts have repeatedly warned of how hackers are targeting virtual private networking software and other technology that companies use to telework during the pandemic.

“Corporations have transformed their traditional workplace model…under the strain of COVID,” Harrell said. “We saw that during the exercise.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure