Cyber Official Warns 'American Way of Life' at Risk From Hackers (bloomberg.com) 42
A top U.S. cybersecurity official offered a dire warning to members of Congress on Wednesday, saying the "American way of life" faces serious risks amid the drumbeat of ransomware attacks and physical threats to the nation's critical infrastructure. From a report: Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency, known as CISA, told the House Homeland Security Committee Wednesday that "ransomware has become a scourge on nearly every facet of our lives, and it's a prime example of the vulnerabilities that are emerging as our digital and our physical infrastructure increasingly converge." Her appearance, aside National Cyber Director Chris Inglis, comes as the private sector and governments have grappled with pervasive cyberattacks during the last 12 months. Some attacks, including the Colonial Pipeline breach in May, have led to gas shortages, disrupted supply chains and exposed federal systems to significant compromise.
Easterly's testimony came after CISA issued a binding operational directive that would create a catalog of known exploited cybersecurity vulnerabilities and would require federal agencies to fix these flaws within specific time frames. It would apply to all software and hardware on federal information systems, including those managed by an agency or hosted by third parties. While the directive would only apply to federal agencies, Easterly said in a statement she wants every organization to adopt the directive "and prioritize mitigation of vulnerabilities listed in CISA's public catalog." Representative John Katko, a Republican from New York, said, "The volume of alerts, advisories, and directives goes to show the pervasiveness of vulnerabilities affecting owners and operators of critical infrastructure, and federal networks." Inglis said that privately owned critical infrastructure, which accounts for 85% of the total, is "increasingly core to the government's imperative to protect and provide for national security."
Easterly's testimony came after CISA issued a binding operational directive that would create a catalog of known exploited cybersecurity vulnerabilities and would require federal agencies to fix these flaws within specific time frames. It would apply to all software and hardware on federal information systems, including those managed by an agency or hosted by third parties. While the directive would only apply to federal agencies, Easterly said in a statement she wants every organization to adopt the directive "and prioritize mitigation of vulnerabilities listed in CISA's public catalog." Representative John Katko, a Republican from New York, said, "The volume of alerts, advisories, and directives goes to show the pervasiveness of vulnerabilities affecting owners and operators of critical infrastructure, and federal networks." Inglis said that privately owned critical infrastructure, which accounts for 85% of the total, is "increasingly core to the government's imperative to protect and provide for national security."
Take away lesson (Score:5, Insightful)
Lessons:
Back up early.
Back up often.
Don't erase your old backups.
Re:Take away lesson (Score:5, Insightful)
Just UNPLUG the critical infrastructure stuff from the public network!!!
Not everything has to hook to the internet.
This isn't rocket surgery.
'merkin way of life CREATED this shitshow (Score:1)
Re: Take away lesson (Score:2)
Re: (Score:3)
The "American Way of Life" is not under threat from hackers. That's hype.
Truth, Justice and cost-cutting (Score:4, Insightful)
Re: (Score:2)
And test restores!
and do not store any important data (Score:2)
Re: (Score:2)
Indeed, "don't do things in private that would reflect badly on your company if disclosed in public" is not bad advice, too.
software and hardware needs update not vendor lock (Score:3)
software and hardware needs update not vendor lock in.
And who can pay $500K to upgrade hardware just so that you can get off windows XP as the old hardware software control system only runs on XP and to get new software you must upgrade the 500K hardware that is still working fine.
Re: (Score:2)
Of course the biggest obstacle will be the lazy managers in charge of such systems.
You know, Windows XP is fine and reliable if it is not exposed to the internet. Or employees that are on the internet. Wait, I think I see the problem... Most people at work do not need interne
Re: (Score:2)
If you have a system running windows XP, it should not be connected to the open internet. If it is, the person who connected it is negligent.
Ban cryptocurrency, vet VPNs (Score:3)
The US needs a FIPS VPN certification which is worth a damn and which isn't just code for "with NSA exploits included". Improve the source code validation, have them be programmed in memory safe languages (or formally verified against a memory safe specification) and make a new law which has mandatory 20+ year prison sentences for any US employee which knowingly includes or let remain an exploit in FIPS certified software or devices. VPNs are the most important part of system security and they are riddled with holes, FIPS or no.
Also ban cryptocurrencies of course.
Re: (Score:2)
"old white man" confirmed!
Re: (Score:1)
Well this is coming from Pinky's Brain after all. I knew we should have banned gifs back before they made it onto the web.
Re: (Score:2)
So the information wants to be free and the internet routes around censorship crowd wants to ban crypto now? You're effectively banning a type of data. How does that even work? Say my crypto wallet is located on a machine in Lithuania and I live in Mexico. Might as well ban .mkv files while you're at it to stop movie piracy.
Re: (Score:2)
Sanction any financial company which trades in crypto. All the on/off-ramps will close and crypto will be dead. The US can do that, they did it to Iran.
Malicious hacker's are a symptom not a problem (Score:1)
Yet another example of "the old white man" not getting it. shm.
If coders wrote secure coding, and companies were not more concerned with secure product vs just pushing a product out the door and to market, then there would not be the litany of problems that there are.
If our physical civil infrastructure were designed, engineered and built the same way out digital infrastructure is, we'd need a lot more cemeteries.
It is long past due for the time where legislation in required to force companies to produce
coders need the power to tell the PHB NO like civi (Score:2)
coders need the power to tell the PHB NO like civil engineers.
if coders are being held like engineers then the PHB who set an deadline needs have there ass on the line and state licensing for TECH / IT coding may end up being very easy to be fucked up big time.
Hey everyone. (Score:1)
Told you so.
Re: (Score:1)
And yet you let it happen anyways.
The American way of life is at risk anyway (Score:5, Insightful)
It's been under siege from common sense, decency and the realities of nature for quite some time now. It's more and more inadequate as the Earth's resources dwindle and the rest of the world realizes peace, cooperation and market regulation work better than hysterical individualism, violence and unbridled capitalism. This is just another nail in a fast-closing coffin. But hey, it still has a few years left in it for those who think it's a sustainable societal model. Enjoy it while it lasts...
Re: (Score:2)
Meanwhile in the real world, crop yields are at an all time high and so are mining yields
Well you know, when your car is careening off the cliff, it's never been so fast.
Like I said, enjoy it while it lasts.
Real Threat=Corporate Penny Pinching, Not Hackers (Score:5, Interesting)
All of these threats have been known and understood for decades. There are prevention and mitigation measures, which have also been around for years.
Yet these businesses continue to engage in piss poor security practices. The have little-to-no monitoring, prevention, or resilience.
Every single time I've read the details of a ransomware incident, there were at least three serious shortcomings in security or general IT practices. And being in a different industry is no excuse; if your business cannot prepare for a well-known threat, outsource to someone who can.
Re: (Score:2)
Apparently paying for a year of free credit monitoring is cheaper than giving a fuck.
Bah, humbug. No Funny here (Score:5, Interesting)
So to adapt the generic joke to the current story:
"A dragon and a hacker walk into a bar. The dragon complains it's too hot, so the hacker says, 'Shut your mouth.'" [Usual apologies to Jimmy Carr.]
Oh yeah, about the actual story. I think the "American Way of Life" may have been an illusion from the early years of the Superman comics. These days the American way is to scream "Yeah? Well fsck you and the horse you rode in on." But when you look for your horse, it turns out the hackers already stole it, so you whip out your sixshooter and start blazing away.
Whatever the "American Way of Life" is supposed to be, I'm not buying that hackers are the biggest risk to it. I'd rank dragons and selfish idiots and horse thiefs way ahead of hackers, even funny-talking foreign hackers wearing black fedoras.
Slashdot needs to up the ante on Funny comments. I reviewed all of the most active discussions searching for wit. Minimal traces of humor detected, mostly in the Intel testing story--but some of it was obligatory. Didn't this used to be a more amusing place?
Re: Bah, humbug. No Funny here (Score:4, Insightful)
The american way of life used to be that the whites exploites the nonwhites and the rich exploited the poor and blamed it on the whites when exploiting the nonwhites, and vice versa.
The only difference now is that there are less rich people and more nonwhites
Re: (Score:1)
The last thing anyone needs is (Score:2)
IT Security is not that hard, but it is a PITA. Thus, best practices are often set aside for ease of use.
Oh Noes~ (Score:2)
Too late. (Score:2)
The American way of life was defined by, and dependent on, freedom.
That's already gone.
Think of the children? (Score:2)
In the face of the US nationalism wave of the past years this 'american way of life' slogan sounds a lot like the 'save the children' moniker used previously to convince the public of something they wouldn't otherwise accept.
And what did people expect anyway? Security was never on the minds of the big corpo's like microsoft. They built their business on 'just enough' security to not have the house of cards collapse on itself. This is what the 'american way of life' is all about, isn't it? Profit over proper