The IT Nerd

The White House has announced a new effort to secure K-12 schools:

According to a 2022 U.S. Government Accountability Office report, the loss of learning following a cyberattack ranged from three days to three weeks, and recovery time can take anywhere from two to nine months.  Further, the monetary losses to school districts following a cyber incident ranged from $50,000 to $1 million. That is why the Biden-Harris Administration has had a relentless focus on securing our nation’s critical infrastructure since day one, and continues to work tirelessly to provide resources that enable the U.S.’s more than 13,000 school districts to better protect and defend their students and employees against cyberattacks.

Allen Drennan, Co-Founder & Principal, Cordoniq had this to say:

As part of an overall strategy for cyber defense for K-12 schools, districts need to consider taking control over their implementation of both their LMS (learning management systems) and their virtual meeting solution. This is a necessity for controlling available, uptime and scale and handle issues related recovery management and for providing higher security standards and data privacy protection for students and teachers. Solutions that rely solely on cloud-based providers outside of control of the school district are subject to outages, availability concerns and malicious cyber threats.

As I have said previously, the education sector is a prime target for threat actors. Only through scaling the investments in cybersecurity can this sector be fully protected. Thus I applaud the White House for making this move.

UPDATE: Emily Phelps, Director, Cyware submitted this comment:   

“Since adopting digital technologies to adapt to a post-Covid world, securing public schools has become more challenging and more critical. We’re encouraged by the Department of Education’s announcement around strengthening cybersecurity resilience for K-12 entities. Working with CISA to develop practical, actionable guidelines and partnerships with private entities that can bolster K-12 public education’s defenses reinforces the commitment this administration has made to cybersecurity at federal and local levels. Collaboration and collective defense strategies are increasingly important to our public entities and citizenry, and as private-public partnerships garner attention and success, we hope these examples will motivate similar action.”  

Carol Volk, EVP, BullWall follows with this comment:    

“Google and the social media giants should be pumping money into K-12 cyber defenses and education, as they are as much the cause of this firestorm of malicious hacking as they are the benefactors of the younger generations embrace of 24-7 connectivity. With congress tightly focused on the responsibility these companies bear from social media fallout, we can expect these giants to be paying attention to this problem area.” 

UPDATE #2: Ani Chaudhuri, CEO, Dasera adds this:

The recent initiative by the Biden-Harris Administration to bolster cybersecurity in our K-12 schools is a commendable and urgently needed step. The surge in cyberattacks targeting the institutions that shape our future leaders has highlighted an alarming vulnerability. Imagine a nation where school districts are routinely disrupted, and the sensitive data of our children is compromised and auctioned off to the highest bidder.

In the 2022-23 academic year alone, we’ve seen significant cyberattacks on K-12 school districts that have compromised the personal data of students and employees. This isn’t just about data; it’s about our children’s future, their privacy, and the trust they place in the education system.

It’s heartening to see the federal government respond with vigor. The proposed pilot program, the collaboration between different governmental bodies, and the available resources to strengthen cybersecurity infrastructure are steps in the right direction. And while the involvement of education technology giants such as AWS, Google, and others is promising, it’s crucial to ask ourselves if it’s enough.

The real challenge is ensuring these policies and programs aren’t just reactive. We must be proactive, looking ahead to anticipate and thwart future cyber threats. Collaboration between public and private sectors should be constant, not just when disaster strikes. We must understand that the next generation’s education is now intrinsically linked with cybersecurity, and there is no room for complacency.

The increased attention to cybersecurity in our education system is a clear signal of our times. We need to instill a culture of cybersecurity from the classroom to the boardroom. Let’s not wait for another breach to shake us into action. The safety of our nation’s future is at stake.

CISA has released its FY2024-2026 Strategic Plan which sets out a vision to change the US’ national cybersecurity risk environment trajectory and builds on the White House’s strategy published last week.    

“Where the National Cyber Strategy calls for foundational shifts to help America outpace our adversaries and set a national agenda on our terms rather than theirs, and CISA’s Strategic Plan outlines how we’ll work together as a unified agency grounded in common values, our Cyber Strategic Plan focuses on the “how” and – of critical importance – how we’ll know if we’re making progress,” a statement by Eric Goldstein, Executive Assistant Director for Cybersecurity at CISA noted.   

The plan outlines three goals: 

• Goal 1: Address Immediate Threats.   
• Goal 2: Harden the Terrain.   
• Goal 3: Drive Security at Scale.                                                                                                                                                   

The Plan notes that too often threat actors succeed because of insecure environments where enterprises are “too difficult to defend, and our technology products are too vulnerable to protect.” And while the steps to overcome this are known, the design and development of products must adapt to mitigate the impact of exploitable vulnerabilities.  

“We must help organizations, particularly those that are “target rich, resource poor,” take the fewest possible steps to drive the most security impact,” the Plan states. 

Jason Keirstead, Vice President of Collective Threat Defense, Cyware had this comment:   

“CISA is taking a pragmatic and holistic approach to their 2024-2026 strategic plan. Organizations lack the resources to effectively defend against known and emerging threats, and to outpace the adversary, the industry must collaborate more often and more effectively. Even organizations with mature cybersecurity programs often struggle to adequately safeguard every vulnerability. CISA’s focus on collaboration, intelligence sharing, and scalability has potential to measurably strengthen our overall security posture.”

Roy Akerman, Co-Founder & CEO, Rezonate follows up with this:   

“It’s commendable to witness CISA advancing the cybersecurity narrative in such a strategic manner. Drawing from my experiences with cyber defense in Israel, this step accentuates the criticality of prompt detection and response. The recognition that adversaries will always seek and often find vulnerabilities underscores the importance of evolving our SecOps and Identity and Access security programs. In essence, it’s about being several steps ahead, rather than merely reacting.” – Roy Akerman, CEO of Rezonate and former head of cyber defense operations for the Israeli Government.

Having a strategy is great. But it’s all about implementing this strategy and getting people to buy into it. I’m reserving judgement until I see how well that part is done. But on paper, this is a good move by the White House.

UPDATE: Wade Ellery, Field CTO, Radiant Logic had this to say:    

“The recent update to CISA’S comprehensive plan marks a significant stride in the nation’s ongoing efforts to bolster its digital security landscape. An identity-focused strategy stands out as an indispensable and highly effective approach to fortifying systems across the U.S.

Managing identities have become more complicated for organizations, regardless of industry or size. As the government looks to implement a comprehensive plan, it must take into consideration the types of attacks plaguing the U.S. – Identity-related attacks make up the bulk of cyber-attacks, calling into question the way businesses handle their identity data. 

Having clean, unified Identity data has emerged as a central pillar in safeguarding sensitive information, fending off cyber threats and ensuring the integrity of digital environments. This approach centers on verifying and managing the identities of users and allows for full visibility and control over who can access specific resources within a system. This fine-grained access control, integrated into a Zero Trust Architecture, can help minimize the attack surface, limit the risk of unauthorized parties entering the system and detect threats early on.”

In the 2003 edition of the National Risk Register report, the UK government warns that a serious cyber-attack on UK critical infrastructure has a 5–25% chance of happening over the coming two years.

The report is based on the government’s internal, classified National Security Risk Assessment, and considers malicious risks such as terrorism and cyber-attacks alongside non-malicious risks like severe weather incidents. It lists several cyber-related risks, including attacks on:

• Gas infrastructure
• Electricity infrastructure
• Civil nuclear facilities
• Fuel supply infrastructure
• Government
• Health and social care systems
• Transport sector
• Telecommunications systems

The assessment ranks the likelihood of these attacks happening in the next two years as a “4” on a scale of 1–5. The predicted attacks involve “encrypting, stealing or destroying data upon which critical systems rely on or disruption to operational systems” resulting in economic cost measuring in the billions of pounds, possible fatalities of up to 1000 people and casualties of up to 2000.
 
The report also mentions AI as a “chronic risk” that poses “continuous challenges that erode our economy, community, way of life, and/or national security.”

George McGregor, VP, Approov had this to say: 

“This report presents quite a wide-ranging litany of threats and their consequences but unfortunately the “response capability requirements” for each one are very generic and do not make clear which players must take action. Linking this document to more specific mitigation and response guidelines for each area (eg cybersecurity) would make it more actionable.”

We’re past the point where cyberattacks are a mere inconvenience to businesses and the general public. They’re now in a place where they could kill people. If that isn’t an incentive for organizations of all sizes in all sectors to get their houses in order from a cybersecurity perspective, I don’t know what will make them do the right thing.

Ransomware attacks targeting industrial organizations and infrastructure have doubled since the second quarter of 2022, according to a report from industrial cybersecurity firm Dragos. In the second quarter of 2023, Dragos observed 253 ransomware incidents, marking an 18% increase from the first quarter of 2023, which had 214 attacks. The rise in attacks is attributed to ransomware revenue plunging in 2022 as more victims refused to pay up.  

Dragos predicts that the third quarter of 2023 will witness increased business-impacting ransomware attacks against industrial organizations due to political tensions and ransomware groups shifting their focus towards larger organizations.  

North America is the most affected region, followed by Asia. The manufacturing sector remains the most targeted, with industrial control systems (ICS), transportation, and oil and gas sectors also experiencing significant attacks. Among the monitored ransomware groups, LockBit, Alpha V, and Black Basta are the most active in launching attacks. 

Carol Volk, EVP, BullWall leads with is comment:

“Industrial sector organizations must prioritize cybersecurity by strengthening defenses with advanced protection tools, network segmentation, regular data backups and for the inevitable breach, ransomware containment. Educating employees about cybersecurity risks, collaborating with reputable cybersecurity firms, and fostering cooperation among governments and industries for threat information sharing are crucial steps.” 

Emily Phelps, Director, Cyware follows with this comment:                  

“Ransomware attacks can devastate organizations. Adversaries don’t only outnumber cybersecurity pros; they collaborate effectively too. To mitigate the potential damage, enterprises should have preparations that enable them to maintain business continuity in case of an attack.    

“Organizations should regularly back up and test data and systems on an air-gapped network or at least on a network not constantly connected to the internet; segment their environments to contain outbreaks; regularly patch and update systems, applications, and software; invest in regular security awareness training so employees are armed to recognize and avoid common threat tactics; and invest in context-rich threat intelligence that enable security teams to proactively identify and prioritize threats that are more likely to impact their business.”

Finally Stephen Gates, Principal Security SME, Horizon3.ai:

“Simply put, attackers who gain remote access to any internal computing device are the primary threat industrial organizations face. Once an attacker achieves access, they use it to take over networks and ransom critical systems.   

“In comparison to a natural disaster, fire, or other similar incident, a cyber event like ransomware that halts production is just as critical to plan for, especially in terms of risk management and business continuity.   

   “The most effective way to defeat ransomware-based attacks is to continuously assess your own infrastructure, find the attack paths an attacker would take, and then fix those issues and validate that your fixes defeated the discovered attack paths. Once complete, you rinse and repeat the process regularly to discover new attack paths. No other defensive or offensive method of reducing the risk of ransomware will be as effective as the method explained here.”

Clearly the threat actors are moving to attack sectors where they think they will get paid. The best way to stop that from happening is to make every sector as difficult to breach as possible. That way the threat actors have less opportunities for a big payday.

In a new report by researchers at Halcyon, researchers detail an ISP with a legal US business profile identified as Cloudzy that is facilitating ransomware attacks and state-sponsored APT operations by providing C2P services to more than 20 hacking groups, including ransomware operators, spyware vendors, and state-sponsored APT actors.

Cloudzy does not verify customer identities and accepts anonymous crypto payments, and, despite terms and conditions prohibiting the use of its services for illicit activities, more than half of the servers hosted by Cloudzy appear to directly support malicious activities on infrastructure run from the IP space owned by other ISPs.

The company is registered in the US, but really only exists on paper, with its ‘employees’ being those of the hosting firm abrNOC in Tehran. Furthermore, Halcyon discovered infrastructure associated with hacking groups tied to Chinese, Iranian, Indian, North Korean, Pakistani, Russian, and Vietnamese governments, by the sanctioned Israeli spyware vendor Candiru, and other cybercrime and ransomware groups.

“While these C2P entities are ostensibly legitimate businesses that may or may not know that their platforms are being abused for attack campaigns, they nonetheless provide a key pillar of the larger attack apparatus leveraged by some of the most advanced threat actors,” said Halcyon on their blog.

Carol Volk, EVP, BullWall had this comment:

“Ransomware actors are knowingly or unknowingly supported by ISPs and crypto networks. They are a profitable and growing business model and all we can do is be prepared for the coming attack.  

“In the near term, AI automation will initially accelerate the ransomware problem, while companies and researchers continue to improve upon methods of applying automation and AI approaches to their cyber defenses. Research by IBM found that fully 64% of respondents are already using AI to improve cyber defenses and response times, and 29% are evaluating implementation to improve their cyber defenses. AI will continue to improve the ability to identify network breaches and implement containment strategies, stopping the attacks before they can remove or encrypt data.

Willy Leichter, VP, Cyware follows up with this:  

“This is another example of the well-developed hacking-as-a-service industry, and the limitations of blocking traffic based on location. While this is thinly veiled, there is certainly a lot of infrastructure in the US and other countries being controlled by illegal hacking groups. We need to always have a zero-trust mindset – don’t assume anything is safe because it’s from a reputable location.”

I have to admit that this is pretty crafty and a great way for these threat actors to get to victims. I wonder how many other setups like these exist? It would be in our interest to find out quickly.

The Biden Administration has released the National Cyber Workforce and Education Strategy, aiming to reduce the cyber workforce gap and to encourage individuals to enter the cyber workforce:

Technology and humanity are intertwined. Technology itself does not have a value system; rather it carries the values of its owners and operators. Cyberspace is composed not only of technology and protocols, but also people. People are an integral part of cyberspace, both in creating and using it. In less than a generation, technology has transformed our daily lives – among other things, we pay bills, connect with families and friends, build businesses, and build communities. We rely on cyberspace for our national security, economic development, and innovation. More than any other domain – air, space, sea, or land – people conceived of and created cyberspace and will continue to improve it. The Biden-Harris Administration’s 2023 National Cybersecurity Strategy establishes an affirmative, values- driven vision for a secure and resilient cyberspace that enables us to achieve our collective aspirations. To achieve a vision aligned with our values, we must ensure that people are appropriately equipped. This National Cyber Workforce and Education Strategy provides a critical element of the President’s approach to securing cyberspace.

I have secured some commentary on this strategy, which I have printed below:

Debbie Gordon, Founder and CEO, Cloud Range

We are excited to see the Biden Administration addressing the critical cyber workforce needs. While this is a significant step forward in direction, there are some areas where “the how” or more guidance could be beneficial. For example, in section 2, under Transform Cyber Education, it mentions “expand competency-based cyber education.” Expanding competency-based cyber education is only attainable by utilizing simulation based training to overcome the age-old conundrum of you can’t get experience without a job and you can’t get a job without experience. The only way to do this is to incorporate experiential learning in the form of advanced simulation into cyber education programs. Too many people are coming out of universities and community colleges with degrees or certifications that they still can’t get a job because they have no practical experience. Utilizing simulation based training to augment traditional cybersecurity training will enable students to be prepared to be productive on the job from day one, and will give employers the confidence that they have experienced candidates at the ready.

Sherron Burgess, VP Strategy, Cyversity

The National Cyber Workforce and Education Strategy sets a direction for both workforce and education, while taking an ecosystem-focused approach. This strategy builds on previous efforts from the administration—holistically approaching the gap—engaging stakeholders across education, industry, research, etc. and spanning federal and industry workforces.The Biden Administration’s strategy also represents an innovation in transforming cyber education, which is absolutely necessary in engaging underrepresented groups through new and existing initiatives. Finally, we commend the strong focus of the strategy on lifelong skills—and removing some of the conventional barriers to entry to cybersecurity.  And, importantly, the strategy follows the newly released GAO Cybersecurity Workforce report, “National Initiative Needs to Better Assess Its Performance” on NIST’s NICE program, highlighting its strengths and the shortcomings.   

Candy Alexander, President, ISSA

The cyber skills shortage has been an ongoing issue for more than 20 years and with the digital footprint encompassing all areas of our lives this comes at a great time. Current education does not provide hands on skills-based readiness to bring entry level and those changing careers to a real work situation. With the combination of skills needed in the industry and communities of individuals in need of skills and career paths, the National Cyber Workforce and Education Strategy  couldn’t be timelier. 

ISSA has long been studying the life and times of the cybersecurity professional for the past 7 years and has seen little change in the skills gap. In fact, it is widening. The Biden Administration’s strategy is exactly what the industry needs and addresses what we have been advocating for: the collaboration of education institutions, government programs, corporate organizations, and the cyber association communities to build pathways to bridge the gap between pure education and employment.

This is a good move by the Biden administration as having a skilled workforce enables so much when it comes to cyberspace.

UPDATE: I have one more comment:

Emily Phelps, Director, Cyware:  

“We’re encouraged to see the Biden-Harris Administration recognize and take action to address the cybersecurity skills and diversity gaps that have continued to impact organizations and individuals. Improving diversity among cybersecurity professionals will not only help increase the volume of cybersecurity experts, but diversity of perspectives and backgrounds will make the industry more effective overall.  

“In cybersecurity, we must think about our work as the industry vs. the adversary. Improving accessibility to cyber education, diversifying the cyber workforce, bolstering cybersecurity understanding, and increasing collaborative partnerships will help establish a strong foundation to close the skills gap and support resiliency.”

Alarm bells are ringing in the US with fears that the Chinese have planted a “ticking time bomb” inside key US infrastructure according to the New York Times:

The Biden administration is hunting for malicious computer code it believes China has hidden deep inside the networks controlling power grids, communications systems and water supplies that feed military bases in the United States and around the world, according to American military, intelligence and national security officials.

The discovery of the malware has raised fears that Chinese hackers, probably working for the People’s Liberation Army, have inserted code designed to disrupt U.S. military operations in the event of a conflict, including if Beijing moves against Taiwan in coming years.

The malware, one congressional official said, was essentially “a ticking time bomb” that could give China the power to interrupt or slow American military deployments or resupply operations by cutting off power, water and communications to U.S. military bases. But its impact could be far broader, because that same infrastructure often supplies the houses and businesses of ordinary Americans, according to U.S. officials.

That’s not good if that’s actually true. Joe Saunders, CEO, RunSafe Security had this comment:

The threat of a ticking time bomb like this malware means we need to double-down our efforts to achieve not just memory safety in software in the long term, but memory protection in software immediately. Otherwise we take the risk of losing our ability to support our warfighters and maintain a normal sense of operation in society.

Hopefully this “ticking time bomb” is identified and countermeasures are created to stop it. Because a “ticking time bomb” like this cannot be allowed to go off. Period.

I am late to the party on this one. But that’s the side effect of being on vacation.

Last week, the TSA put out new cybersecurity requirements for pipeline owners. No doubt to prevent another Colonial Pipeline situation:

“TSA is committed to keeping the nation’s transportation systems safe from cyberattacks. This revised security directive follows significant collaboration between TSA and the oil and natural gas pipeline industry. The directive establishes a new model that accommodates variance in systems and operations to meet our security requirements,” said TSA Administrator David Pekoske. “We recognize that every company is different, and we have developed an approach that accommodates that fact, supported by continuous monitoring and auditing to assess achievement of the needed cybersecurity outcomes. We will continue working with our partners in the transportation sector to increase cybersecurity resilience throughout the system and acknowledge the significant work over the past year to protect this critical infrastructure.”

I have some commentary on this topic.

Chris Warner, OT Senior Security Consultant at GuidePoint Security:

The TSA has announced updates to its Security Directive (SD) aimed at strengthening the operational resilience of oil and natural gas pipeline owners and operators against cyber-attacks. These updates, effective from July 27th, 2023, introduce certain requirements that may demand additional resources from organizations to comply. At a high level, the updated SD includes the following provisions:

1. Annual submission of an Updated Cybersecurity Assessment Plan (CAP) for TSA review and approval.
2. Reporting of the previous year’s assessment results and providing an annual schedule for auditing cybersecurity measures, with 100% assessment of security measures required every three years.
3. Annual testing of at least two objectives of the Cybersecurity Incident Response Plan (CIRP), involving relevant individuals identified in the plan.
4. Maintaining existing requirements, such as reporting significant cybersecurity incidents to CISA, designating a cybersecurity point of contact, and conducting a cybersecurity vulnerability assessment (SD Pipeline 2021-01C).

The updated SD introduces several changes:

• Section II.A.3 now requires Owner/Operators to reassess their systems if they change their method of pipeline operations, notifying TSA of a schedule for compliance with the SD’s requirements.
• A new Section II.B.3 clarifies whether an Owner/Operator needs to amend their TSA-approved Cybersecurity Implementation Plan (CIP) based on the updated SD.
• Section II.B.4 has been removed, and Section III.A allows TSA to identify additional Critical Cyber Systems not previously identified during review.
• Section III.F.1.e updates requirements for CIRP exercises, mandating Owner/Operators to test at least two CIRP objectives, such as network segmentation and OT and IT system isolation, at least twice a year. They must also identify two employee positions that participated in the exercises. Additionally, an annual CAP Report must include the assessment results, methods used, and the effectiveness of policies, procedures, and capabilities.
• Section III.G changes the acronym CAP to Cybersecurity Assessment Plan, requiring not only its annual submission but TSA approval. The CAP schedule must assess 30% or more of policies, procedures, measures, and capabilities annually to achieve 100% completion of the TSA-approved CIP within three years.
• Section IV.A now requires referencing previously developed plans, assessments, tests, and evaluations in the CIP and making them available to TSA upon request.
• Finally, Section V.C is a new requirement addressing how documents are written and submitted to the TSA to provide flexibility for future capabilities in enhancing operational resilience.

Overall, these newly introduced provisions mandate pipeline owners and operators take proactive steps to enhance their systems’ security and protect against potential cybersecurity threats in the oil and natural gas sector. Despite the resource challenges, pipeline owners and operators understand the critical importance of strengthening their cybersecurity measures. While the implementation may be demanding, it is essential to safeguard their systems against potential cyber threats in the oil and natural gas sector. This calls for strategic planning and resource allocation to effectively address the new TSA SD requirements and enhance the overall security posture of these vital infrastructure systems.

Ron Fabela, Field CTO at XONA Systems:

Some minor but interesting updates have been made to TSA SD Pipeline-2021-02D.  Interesting bits by section:

Section II – TSA seems to be making some clarifications, additions, and removals of sections based on feedback from the pipeline community or as a result of successes (or lack thereof) with certain requirements.  For instance, those owner/operators that have identified no “critical cyber systems” will have to reevaluate when operations change, or now TSA may add “critical cyber systems” that were not previously included before. This may be an indication in owner/operator requirement avoidance by simply stating they have no systems applicable to new regulation. NERC had similar challenges early in CIP regulation days when asset owners were allowed to self identify if they had any “Critical Cyber Assets”. Of course the answer at the time was “none here, regulation not applicable”

Section III changes incident response plans testing and introduces a new term “Cybersecurity Assessment Plan”. Changes to exercising the cybersecurity incident response plan are interesting in that they now only require that half of the requirements (at least 2 out of the 4 objectives) be tested annually instead of all. These requirements are not especially rigorous, so one wonders what prompted the change.

Similarly, while Cybersecurity Assessment Plans must now be reviewed and approved by TSA a section was added only requiring 30% coverage of requirements to be assessed each year, with 100% assessed over any three-year period. Ignoring the obvious math error (3×30%=90%, not 100%) assessing only one third of your security measures a year is a bold outlier to an effective security program.

Section IV changes make an interesting clarification. Use of previous plans, assessments, tests, and evaluations as evidence to meet the SD security directives must now explicitly incorporate these by reference into the CIP and made available to TSA upon request.  With TSA having to make these specific changes, I speculate that owner/operators may have said that they have requirements met by other artifacts but then failed to produce said evidence.

Overall it’s great to see updates being made by TSA to clarify the requirements and in some cases, remove any loopholes as a result of practical application of these Security Directives in the field. I would expect more revisions as assessments and technical evaluation of control effectiveness are conducted in the years to come.

Josh Thorngren, Senior DevSecOps Engineer at ForAllSecure:

The encouraging piece here is that it treats cyber strategy as something that needs to evolve. Most of the changes related to ensuring cybersecurity strategy and implementation are reviewed at least annually seem apparent, but it is a pretty impactful task. It’s easy to think about cybersecurity as ‘maintaining walls’ – a legacy of the era where we just cared about the perimeter is an acceptance and encouragement to play active defense instead. To continually update and reevaluate. It’s too early to tell the impact, but it’s incredibly encouraging to treat cyber as an evolving posture vs a fixed one.

At least there were lessons learned from the Colonial Pipeline episode that are resulting in change. And change is good as it will help to make us all safer.

The UK Government’s Cyber Security Skills in the UK Labour Market 2023 report shows that more than 50% of UK companies have a basic cybersecurity skills gap and 33% have an advanced skills gap showing close to no improvement since last year.

This year was the first year of the study that included a survey question focused on the UK Cyber Security Career Route Map, introduced in 2021, intended to make it easier for individuals to enter cyber security roles via a range of possible pathways. Unfortunately, most of the respondents hadn’t heard of it, so more referenced certification requirements as a hurdle.

“The training is there but it is costly. The certification programmes require quite a hefty cost for the training if you’re going to send people off for the week. Because there is such a shortage of skills in the industry, a lot of organizations are reluctant to put employees through it because once they are qualified, they are quite likely to move to another job on a higher salary,” said an unnamed Cyber sector respondent.

Furthermore, 41% of businesses report a lack of confidence in the area surrounding incident response, one of the top areas covered by external providers. Of the 33% of businesses that outsource any aspect of cybersecurity, 82% utilized an external cybersecurity provider to deal with incident response and recovery.

“There is a low level of understanding of what to do with incident response. I’ve even found with qualified IT security people, because they don’t have to do incident response very often, sometimes when they need to do a basic one, they need help,” said an unnamed public sector respondent.

Avkash Kathiriya, Senior VP of Research and Innovation, Cyware had this comment:  

“The cybersecurity skills gap is a consistent challenge for security teams, and while programs designed to incentivize education and development, we as an industry need to do more to promote these programs and address barriers to entry. For example, ISC^2 has recently introduced an entry level cybersecurity certification program.  

“But this problem isn’t scalable with human expertise alone, particularly in terms of incident response. We need technology that can automate tedious, time consuming tasks that connect the dots for security practitioners, providing visibility and context to take the right action at the right time.”

This is a challenge not just for the United Kingdom, but for everyone as finding people with the right skills is a non-trivial task for many sectors. Hopefully this is something that can be turned around before it comes back to bite us all.

In a move that I think is long overdue, The Security And Exchange Commission is requiring public companies to disclose cyberattacks in four days:

The new rules will require registrants to disclose on the new Item 1.05 of Form 8-K any cybersecurity incident they determine to be material and to describe the material aspects of the incident’s nature, scope, and timing, as well as its material impact or reasonably likely material impact on the registrant. An Item 1.05 Form 8-K will generally be due four business days after a registrant determines that a cybersecurity incident is material. The disclosure may be delayed if the United States Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety and notifies the Commission of such determination in writing.

The new rules also add Regulation S-K Item 106, which will require registrants to describe their processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats, as well as the material effects or reasonably likely material effects of risks from cybersecurity threats and previous cybersecurity incidents. Item 106 will also require registrants to describe the board of directors’ oversight of risks from cybersecurity threats and management’s role and expertise in assessing and managing material risks from cybersecurity threats. These disclosures will be required in a registrant’s annual report on Form 10-K.

The rules require comparable disclosures by foreign private issuers on Form 6-K for material cybersecurity incidents and on Form 20-F for cybersecurity risk management, strategy, and governance.

Craig Burland, CISO, Inversion6 had this comment:

The SEC continues to ramp up expectations for publicly traded companies. The four-day disclosure, however, is not the kicker here. Companies have two subjective decisions before being forced to disclose. First, they have to determine the cyber event was an incident – data was lost, business was disrupted, etc.  Finding sufficient evidence to prove loss takes time. Second, the impact has to be material. For large corporations, this is a high bar that very few incidents would eclipse. 

he real toll of this decision is the one not getting the headlines.  It’s part two of the requirements: the SEC wants companies to “disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance.” Implicit in this decision is that companies have a cybersecurity risk strategy and perform cyber governance. All too often, that’s not the case. A requirement to publicly disclose the practiced level of cyber-competence will open eyes and raise eyebrows across the country.

While not perfect, this is a great move by the SEC as I think it would force companies to invest in cybersecurity because they would face significant blowback in the form of lower stock values and the like if they were forced to disclose that they were pwned within a 4 day window. Not to mention having to disclose where they are in terms of cybersecurity. Perhaps this will be the start of companies finally getting their act together?

UPDATE: I just got a comment on this from Ani Chaudhuri, CEO, Dasera:

The new rules implemented by the SEC are a notable stride towards transparency in a world where cybersecurity incidents are increasingly common. With digital assets becoming increasingly critical to businesses, timely and comprehensive disclosure of such incidents to shareholders is pivotal.

Material incidents are those that have a significant impact on a company’s financials, operations, or reputation – elements which shareholders would indeed consider crucial in making an investment decision. The same principles apply whether we’re talking about a physical asset like a factory, or digital data. Cybersecurity is no longer a domain exclusive to IT professionals; it’s a concern for everyone.

While the SEC’s approach is admirable, it does bring a set of new challenges to the table. The reporting timeline may indeed seem tight, especially for complex incidents where an understanding of the scope and impact may take longer than four days. Given the technical and complex nature of cyber incidents, it’s important to strike a balance between providing timely information and ensuring that information is accurate and complete.

The additional 180 days granted to smaller companies is also a thoughtful concession, acknowledging that not all entities have the same resources to manage and report cyber incidents.

However, it is the clause about the potential postponement of disclosure in instances where it might pose a significant risk to national security or public safety that can be more contentious. While the intent is certainly valid, the execution must be handled carefully. Defining ‘significant risk’ might be a potential gray area, and companies should not misuse it as a loophole to delay disclosure.

Furthermore, while the rules require companies to provide a concise description of the incident, its impact, and the data compromised, they do not require companies to disclose specifics of their incident response plans or details about potential vulnerabilities. In this sense, the rules are a missed opportunity to push companies towards better preparedness and proactive planning. The more information available, the more we can learn and improve our defenses.

Lastly, let’s not forget that this rule is reactive. Disclosing an incident after it has happened does not prevent the incident in the first place. The real need of the hour is to invest more resources in proactive measures that would make our systems more resilient and reduce the chances of such incidents happening in the first place.

The SEC’s new rules are a positive step towards more transparency in handling cybersecurity incidents. Still, valid concerns and potential challenges must be addressed in implementing these rules. As we continue to rely more heavily on digital assets, the onus is on us to evolve our approach towards cybersecurity, making it a key part of strategic decision-making.

UPDATE #2: Another comment has come in from Christopher Prewitt, CTO, Inversion6:

After years of rumor and innuendo, it’s great to see the SEC act, requiring disclosure. This may force some needed attention on the criticality of cyberattacks on companies. More and more organizations fully depend on IT to perform almost every business process, and the interconnected nature of business in 2023, it can sometimes feel like a house of cards seeing the impact of an event.

It would be expected that there will be associated fines for those who don’t meet the 4 day window. The other requirement of disclosing on an annual basis material information regarding cybersecurity risk management, I believe, is an even more important action. This will likely bring the cyber security program to the table in the board room in a more effective manner.