MUST READ: These charges publicly reveal the extent of Russia’s hacking of the energy sector, infecting 17,000+ devices, in one case planting malware that crippled the safety locks at Saudi Petro Rabigh, the last thing preventing a shutdown, or even explosion.
Many of these incidents have been publicly reported or the subject of previous sanctions (See: nytimes.com/2020/10/23/us/…) but revealing it now, and tying it to specific Russian agencies, reveals the critical nature of the cyber threat the US is up against.
None of these people will see the inside of a jail cell but Monaco makes the message crystal clear: “The criminal charges…make crystal clear the urgent ongoing need for American businesses to harden their defenses and remain vigilant.”
“The potential of cyberattacks to disrupt, if not paralyze, the delivery of critical energy services to hospitals, homes, businesses and other locations essential to sustaining our communities is a reality in today’s world,” - U.S.A Duston Slinkard for the District of Kansas.
“We must acknowledge there are individuals actively seeking to wreak havoc on our nation’s vital infrastructure system, and we must remain vigilant in our effort to thwart such attacks.”
• • •
Missing some Tweet in this thread? You can try to
force a refresh
My ‘22 cyber wish list: 1. MFA FOR EVERYONE. Idiotic we’re not mandating this for critical infrastructure.
2 DISCLOSURE. We only know about SolarWinds because @Mandiant did the right thing. What Americans don’t understand but enemies do: USG lacks visibility into critical systems
3 RIP OUT LEGACY SOFTWARE. Organizations should be fined for using Windows XP the same way Americans are fined for driving without updated registration. Madness.
4 PATCHING. “.
5 SECURE CODING BY DESIGN. I spent thousands to move my toilet plumbing 2” to bring it to code. Why…
aren’t we requiring this for safety critical systems like the grid, water, dams, pacemakers. More madness.
6 SBOM. Software bill of materials with security ratings for each piece of code. We require restaurant chains to disclose calorie counts but we have no idea how vuln…
A few call outs from this morning’s blitz on Chinese cyber espionage. 1.We’ve known China’s Ministry of State Security contracts out some of its sensitive operations to a satellite network of hackers, now USG is calling them out by name (Yes!) and detailing the connections.
2. It’s not just front companies, USG is accusing Chinese universities of playing a critical role in MSS’ recruitment. We’ve reported on these connections before, but China is particularly sensitive about coverage that outs its universities.
3. My personal favorite! USG addresses zero day hoarding in its comments, noting that in this case, the NSA turned over additional Exchange zero days to Microsoft. I would like to buy the bureaucrat who inserted this phrase a beer: “Rather than withholding them...”