CISA starts identifying targets most necessary to protect from hacking

The agency isn't going to wait for Congress to act, CISA Director Jen Easterly said.

The Cybersecurity and Infrastructure Security Agency has begun working to map out the U.S. critical infrastructure that, if hacked, could result in serious consequences for national security and economic interests, CISA Director Jen Easterly said Friday.

Labeling such infrastructure is the subject of a proposal of the Cyberspace Solarium Commission, a congressional committee, which recommended identifying “systemically important critical infrastructure,” or SICI. Lawmakers have introduced SICI legislation in recent months, but Easterly said her Department of Homeland Security agency is proceeding ahead with or without a bill.

“Notwithstanding whether this ends up in legislation or not, and I certainly hope it does, we are already thinking through the model,” she said at an event hosted by the Center for Strategic and International Studies. “We’re in a state now where a critical infrastructure is much more vulnerable than it should be. And frankly, that’s what I worry about most every day.”

CISA is dubbing the effort, rather than SICI, “primary systemically important entities.” The criteria will be based on a preexisting method the agency has used to examine critical infrastructure, and how risk is intertwined.

“We’re prototyping a variety of different approaches in our National Risk Management Center, ” Easterly said, “to try and start identifying those entities that are in fact systemically important, and we’re doing it based on economic centrality, network centrality and logical dominance in the national critical functions.”

There are limits to what CISA can do on its own, however. While the agency might be able to begin categorizing infrastructure without Congress, legislation would need to address another facet of the Solarium proposal: imposing a mix of federal “benefits and burdens” for companies that receive the label, such as meeting required baseline security standards or receiving liability protections.

New York Rep. John Katko, the top Republican on the House Homeland Security Committee, has proposed one such bill, which excludes burdens for any critical infrastructure owners in favor of starting the labeling and prioritizing CISA services for owners and operators.

House Homeland Security Committee Democrats have signaled some support for Katko’s SICI legislation, although Katko lamented that panel leadership left it off a recent markup session.

“I think that what John is doing through his legislation really distills us to the elements that we must, must, must focus on in order to build out a robust protocol to address what we know are the constant bombardment of our critical infrastructure,” Rep. Yvette Clarke, D-N.Y., who chairs the panel’s cybersecurity subcommittee, said in October.

CISA’s ideal budget

Easterly agreed with Katko’s assertion that CISA needs a bigger budget. The agency sits at $2 billion now, although some policymakers are pushing for increases. Katko said CISA needs to be a $5 billion agency.

“Maybe it’s a $5 billion agency,” Easterly said. “As we are a very young agency and as we are transforming, we are making sure that we are putting all the processes in place so that we can absorb that funding and we can spend it responsibly and effectively.”

In particular, CISA is looking to spend money to hire key personnel, such as its corps of state cybersecurity coordinators, cybersecurity advisers for the private sector and specialists in vulnerability management, threat hunting and incident response.

“We are in the midst of doing a force structure assessment, sort of a ‘troops to task,'” Easterly said.

In most cities, nobody owns the whole network

July’s intrusions reached water controllers that sat on a cellular link no city network scan would find. Naming an owner and paying for the fix are decisions…

Industry’s message on CIRCIA: Please ask us fewer questions about cyberattacks

House intel bill includes provisions on state and local threat intelligence, election security, AI

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure