State Department cyber strategy emphasizes proactively hunting for threats

The State Department Bureau of Intelligence and Research released a cybersecurity strategy to create a more proactive culture when it comes to finding and fixing vulnerabilities.

The State Department Bureau of Intelligence and Research (INR) released a cybersecurity strategy Monday meant to address what the bureau’s chief called “technical debt” and to create a more proactive culture when it comes to finding and fixing vulnerabilities.

The strategy document focuses on what INR is doing to “strengthen the security of the department’s top secret computing environment and improve how we manage cyber risk.”

A key element of the strategy involves migrating to the cloud. The strategy document emphasizes the need to prioritize and leverage new technologies and “establish modern IT infrastructure, software, hardware, and systems.” The strategy also focuses on the need to deploy “real-time threat based security functions.”

Assistant Secretary of State for Intelligence and Research Brett Holmgren began his tenure at State in September and immediately focused on upgrading INR’s cybersecurity posture. A longtime intelligence and national security official who served on the National Security Council staff as senior director for intelligence programs in the Obama White House, Holmgren more recently was vice president for technology risk management at Capital One Financial where he spent three years.

The strategy document focuses on making INR staff more accountable for managing cyber risk, recruiting and retaining a workforce with strong cybersecurity skills and working more closely with larger agencies such as the Department of Homeland Security.

Holmgren said in an interview Friday that working with better resourced agencies will help the relatively small 400-person INR staff create a cybersecurity culture that is appropriate for the high volume of top-secret information the bureau handles.

“We are responsible for ensuring the confidentiality, integrity and availability of all of our top secret information with the entire department,” said Holmgren. “This is a comprehensive approach to shifting from a reactive cybersecurity posture to a proactive one where we’re constantly hunting for potential threats in our environment rather than just waiting for alerts to fire and then we’re investigating.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure