Congress looks to expand CISA's role, adding responsibilities for satellites and open source software

Lawmakers advanced four on Wednesday that would broaden the Cybersecurity and Infrastructure Security Agency's portfolio.

Lawmakers on Wednesday passed a series of bills to give the Cybersecurity and Infrastructure Security Agency new responsibilities when it comes safeguarding open source software, protecting U.S. critical infrastructure and expanding the cybersecurity workforce.

The Senate Homeland Security and Governmental Affairs Committee advanced a bill that would require CISA to maintain a commercial public satellite system clearinghouse and create voluntary cybersecurity recommendations for the space sector. Additionally, the committee advanced legislation requiring CISA to create a pilot civilian cyber reserve program to respond to incidents.

The House Homeland Security Committee advanced legislation that would require CISA to work with the open source community to better secure it as well as create a framework to assess the general risks of open source components for federal agencies. The House advanced another bill that would give CISA the authority to train employees at DHS that aren’t currently in cybersecurity positions to move to such a role.

The slew of legislation and the focus on CISA comes as both the Biden administration and Congress are trying to address the litany of cybersecurity risks that threaten critical infrastructure as a result of decades of inaction from government and industry’s overall lack of responsiveness to patching vulnerable systems. The agency has been propped up as the go-to solution and coordinator for all things cyber, but many Republicans in both the House and Senate scoffed during Wednesday’s markups at giving CISA more responsibilities and authorities.

Sen. Rand Paul, R-Ky., said Congress should be limiting CISA’s power “not expanding them.” Concerns about CISA’s authorities is likely to be a growing pressure point among Republicans that have expressed concerns about CISA becoming a regulatory agency.

The Securing Open Source Software Act of 2023 which is also a Senate companion bill, was a direct response by the Log4Shell vulnerability found in the popular open source tool from Apache’s Log4J logging tool that is used throughout industry.

“This bipartisan, bicameral effort is critical to improving how the Federal government manages its risk stemming from the use of open source software, the bedrock of our digital ecosystem,” said Chairman Mark Green, R-Tenn.

The issues protecting open source programs, which are largely driven by volunteer developers, was a key consideration by the Biden administration which held a summit with leaders in the community. Additionally, the Log4Shell vulnerability was the inaugural topic for DHS’s Cyber Safety Review Board.

The bill would require CISA to engage with the open source community, hire employees who have experience with open source programs and help both federal agencies and the private sector with coordinated vulnerability disclosures. Additionally, it would require CISA to develop a framework to assess the risks of open source components, including an assessment of each open source software component used “directly or indirectly by federal agencies.”

The satellite bill would also require the Comptroller General to report to Congress on federal efforts to protect satellite systems. CISA would also be required to create voluntary cybersecurity recommendations for the satellite systems, which also include transmission links between satellites and ground support. The National Space Council, meanwhile, is required to establish a strategy outlining federal roles and responsibilities for agencies.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure