White House rolls out pipeline, supply chain security initiatives as companies pledge billions in cyber spending

Companies also will offer cyber tools and training after a private sector cybersecurity summit at the White House.

The Biden administration on Wednesday announced initiatives to bolster supply chain and natural gas pipeline security, following a White House private sector cybersecurity summit where major companies pledged billions of dollars in cyber spending.

The National Institute of Standards and Technology will collaborate with industry to develop guidelines for building secure technology, in the first of two administration initiatives. In the other, the administration formally expanded its industrial control systems cybersecurity initiative — under which 150 electric utilities agreed to deploy control system security tech — to natural gas pipelines.

Tech giants, insurance companies and educational organizations exit the summit with cybersecurity commitments large and small. Among those vowing the biggest dedication of dollars: Microsoft announced $20 billion over five years to integrate “cybersecurity by design,” which means incorporating security into products as they’re being built, while Google announced $10 billion over the same period to expand “zero trust” programs, secure the software supply chain and improve open source security.

The effort comes after a June ransomware incident in which hackers breached Colonial Pipeline, forcing the company to halt fuel transportation across parts of the U.S. for days. Before that, alleged Russian spies leveraged SolarWinds, using that federal contractor as a means of infiltrating nine U.S. agencies.

Before meeting with the industry leaders, Biden called cybersecurity “the core national security challenge the American people are facing, and our economy is facing.”

With so much critical infrastructure in private ownership, “The federal government can’t meet this challenge alone,” he said.

“I’ve invited you all here today because you have the power, the capacity and responsibility, I believe, to raise the bar on cybersecurity,” the president told attendees.

Other private sector pledges included IBM vowing to train 150,000 people in cyber skills over three years, Coalition offering free risk assessment tools and Code.org saying it would teach cyber concepts to 3 million students over three years.

Amazon said it would provide multi-factor authentication devices to Amazon Web Services account holders who spend at least $100 a month. Apple said it would work with its suppliers to promote mass adoption of event logging, incident response, multi-factor authentication, security training and vulnerability remediation.

Many of those steps reflect a May executive order that Biden signed to bolster security within the federal government.

IBM Chief Executive Officer Arvind Krishna mirrored Biden’s sentiments about working together in a LinkedIn post.

“No private company can face this monumental challenge alone,” he said. “Now is the time for the public and private sectors to step up their collective efforts to improve our nation’s cybersecurity for decades to come.”

Coalition, Google, IBM, Microsoft and Travelers will partner on the NIST framework, which will include assessment of security technologies.

“Based on our technical expertise and our established open processes, we can jointly build a framework that will offer sound technical, trusted, practical solutions to help the nation better manage cybersecurity risks,” said James Olthoff, who is serving as NIST director.

Updated, 8/25/2021: to include additional details of the meeting.

Dozens of tech companies pledge to build safer, more secure tech

The commitments are voluntary, but CISA officials said they are committed to measuring progress by the signatories across key commitments over the next year.

White House to give aviation executives classified cyberthreat briefing, latest in series of industry meetings

Saudi Arabia a critical partner in fighting cyberthreats, White House cyber official says

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure