Recent cybersecurity incidents highlight the significant risks posed by misconfigurations and weak security controls, which attackers can use to gain unauthorized access, exfiltrate data, or disrupt services. As part of CISA and the broad U.S. government’s effort to move the federal civilian enterprise to a more defensible posture, this Directive will further reduce the attack surface of the federal government networks.

“Malicious threat actors are increasingly targeting cloud environments and evolving their tactics to gain initial cloud access. The actions required by agencies in this directive are an important step in reducing risk to the federal civilian enterprise,” said CISA Director Jen Easterly. “While this Directive only applies to federal civilian agencies, the threat to cloud environments extends to every sector. We urge all organizations to adopt this guidance. When it comes to reducing cyber risk and ensuring resilience, we all have a role to play.”

As federal civilian agencies implement this mandate, CISA will monitor and support agency adherence and provide additional resources as required. CISA is committed to using its cybersecurity authorities to gain greater visibility and drive timely risk reduction across federal civilian agencies.

The new directive can be found at Binding Operational Directive (BOD) 25-01.

Source: CISA

Start 2025 ahead of the competition with a paid subscription to IC News. You’ll get full access to our searchable archive of 13,000+ articles, plus new articles each weekday.

The post CISA issues directive for federal agencies to secure cloud environments appeared first on Intelligence Community News.

Vice President Harris and senior administration officials met on May 4 with CEOs of four American companies at the forefront of AI innovation—Alphabet, Anthropic, Microsoft, and OpenAI—to underscore this responsibility and emphasize the importance of driving responsible, trustworthy, and ethical innovation with safeguards that mitigate risks and potential harms to individuals and our society. The meeting is part of a broader, ongoing effort to engage with advocates, companies, researchers, civil rights organizations, not-for-profit organizations, communities, international partners, and others on critical AI issues.

The administration is working to address the national security concerns raised by AI, especially in critical areas like cybersecurity, biosecurity, and safety. This includes enlisting the support of government cybersecurity experts from across the national security community to ensure leading AI companies have access to best practices, including protection of AI models and networks.

The actions announced May 4 include:

1. New investments to power responsible American AI research and development. The National Science Foundation announced $140 million in funding to launch seven new National AI Research Institutes.
2. Public assessments of existing generative AI systems. The administration announced an independent commitment from leading AI developers, including Anthropic, Google, Hugging Face, Microsoft, NVIDIA, OpenAI, and Stability AI, to participate in a public evaluation of AI systems, consistent with responsible disclosure principles—on an evaluation platform developed by Scale AI—at the AI Village at DEFCON 31.
3. The Office of Management and Budget announced that it will be releasing draft policy guidance on the use of AI systems by the U.S. government for public comment. This guidance will establish specific policies for federal departments and agencies to follow in order to ensure their development, procurement, and use of AI systems centers on safeguarding the American people’s rights and safety.

Source: White House

Like IC News? Then please consider subscribing. You’ll get full access to our searchable library of 10,000+ articles, plus new articles each weekday.

The post White House announces actions to promote responsible AI appeared first on Intelligence Community News.

In this decisive decade, the United States will advance cyberspace as a tool to achieve our goals in a way that reflects our values: economic security and prosperity; responsive and rights-respecting democracy; and a vibrant and diverse society.  Our rapidly evolving world demands a more intentional, more coordinated, and better-resourced approach to cyber defense.  We face a complex threat environment, with state and non-state actors developing and executing novel campaigns to threaten our interests.  At the same time, next-generation technologies are reaching maturity at an accelerating pace, creating new pathways for innovation as well as increasing digital interdependencies.

The National Cybersecurity Strategy calls for two fundamental shifts: rebalancing the responsibility to defend cyberspace and realigning incentives to favor long-term investments.  The digital ecosystem’s biggest, most capable, and best-positioned actors – be they in the public or private sectors – can and should assume a greater share of the burden for mitigating cyber risk.  When entities across the public and private sectors face trade-offs between temporary fixes and long-term solutions, they must have the resources, capabilities, and incentives to choose the latter.

The U.S. commitment to international partnerships on cyber issues remains strong, and the Strategy emphasizes working with our allies and partners to build a defensible, resilient, and values-aligned digital ecosystem.  Advancing shared goals requires promoting a global cyberspace where responsible state behavior is expected and where irresponsible behavior is both costly and isolating.

This Strategy sets out a path to secure the promise of our digital future.  Its implementation will build a durable cyber foundation for the Administration’s goals in infrastructure, clean energy, equity, democracy, and economic opportunity.  Fundamentally, it recognizes that cyberspace does not exist as its own end, but as a tool to pursue our highest aspirations.

For further information, see the National Cybersecurity Strategy.

Source: Department of State

Your competitors read IC News each day. Shouldn’t you? Learn more about our subscription options, and keep up with every move in the IC contracting space.

The post National Cybersecurity Strategy released appeared first on Intelligence Community News.

OMB’s zero trust strategy release supports the Executive Order on Improving the Nation’s Cybersecurity (EO 14208) in adapting civilian agencies’ enterprise security architecture to be based on zero trust principles. The draft strategy clarifies zero trust priorities for federal civilian agencies over the next few years, by focusing agencies on several key security outcomes and setting baseline policy and technical requirements.

Key areas of OMB’s zero trust strategy include consolidating agency identity systems, combatting phishing through strong multifactor authentication, treating internal networks as untrusted and encrypting traffic, moving protections closer to data by strengthening application security, and more. Moving to zero trust architectures will be a multi-year journey for federal agencies, and the government will learn and adjust along the way as new practices and technologies emerge.

CISA’s release of the Cloud Security Technical Reference Architecture (TRA) and Zero Trust Maturity Model also supports the Executive Order on Improving the Nation’s Cybersecurity (EO 14208). The Cloud Security TRA was developed through a collaborative, multi-agency effort with contributions from the United States Digital Service (USDS), and the Federal Risk and Authorization Management Program (FedRAMP). The goal is to provide agencies with guidance on the shared risk model for cloud service adoption, how to build a cloud environment, and how to monitor such an environment through robust cloud security posture management.

The Zero Trust Maturity Model complements OMB’s Zero Trust Strategy and will assist agencies in the development of their zero trust architectures. The maturity model is designed to provide agencies with a roadmap and resources to achieve an optimal zero trust environment. To this end, OMB and CISA are seeking collaborative feedback from the public at zerotrust.cyber.gov to improve upon the strategy to strengthen enterprise security across the federal government.

“Never trust, always verify. With today’s zero trust announcement, we are clearly driving home the message to federal agencies that they should not automatically trust anything inside or outside of their perimeters. They must verify anything and everything trying to connect to their systems before granting access. This is an expectation in a modern technology environment and we look forward to this public comment process to make our strategy even stronger,” said Clare Martorana, federal chief information officer.

“The federal government’s approach to cybersecurity must rapidly evolve to keep pace with our adversaries, and moving toward zero trust principles is the road we need to travel to get there. Today we’re releasing a draft federal zero trust strategy that will help agencies put these principles into practice. While we feel the urgency to begin implementing this plan, we know that input from the broader community of experts will help ensure it is the right plan. We welcome feedback on how we can refine this strategy to best advance federal cybersecurity,” said Chris DeRusha, federal chief information security officer.

“The Zero Trust Maturity Model is one of the many ways CISA is helping federal agencies protect their systems, and we are excited to release this model to gain further insights from the public. Additionally, CISA teamed up with the United States Digital Service (USDS) and the Federal Risk and Authorization Management Program (FedRAMP) to co-author the Cloud Security Technical Reference Architecture, which will guide agencies’ secure cloud migration efforts. Through our strong partnerships and ongoing collaborative efforts, CISA will develop new and innovative ways to secure constantly changing network perimeters to enable critical federal IT modernization,” said Jen Easterly, director, Cybersecurity and Infrastructure Security Agency.

“Our adversaries are constantly adapting, and so must we. Zero trust principles are at the core of how our federal agencies must evolve to meet today’s cybersecurity demands. Our draft federal zero trust strategy will push agencies in the right direction, and help make a more coherent federal cybersecurity posture. We welcome comment from the public on how we can make our strategy as strong and effective as it can be,” said Chris Inglis, national cyber director.

“Rapidly improving the cybersecurity of federal networks and leading by example in implementing innovative, effective technologies are core to the Biden Administration’s cybersecurity strategy. Today, we see the President’s Executive Order on Cybersecurity in action and welcome partnership with the private sector to work collaboratively towards modernizing our cyber defenses,” said Anne Neuberger, deputy national security advisor for cyber and emerging technology.

Source: OMB

Like IC News? Then please consider subscribing. You’ll get full access to our searchable library of 10,000+ articles, plus new articles each weekday.

The post OMB releases draft zero trust federal strategy appeared first on Intelligence Community News.

“The new National Space Policy is my plan for how the executive branch will advance United States interests in space for the benefit of the American people.  By charting a clear course for United States space activities, this policy reaffirms our leadership in the space domain and our status as the world’s foremost spacefaring nation.

This policy represents a whole-of-government approach that recognizes space as a national imperative.  After years of drift, my Administration revived the United States space enterprise to once again unleash our unmatched pioneering potential.  In particular, I am proud that my Administration oversaw the restoration of our capability to transport American astronauts to space on American rockets from American soil.  Through our Artemis program, the United States is working hand-in-hand with commercial and international partners to return to the Moon—this time to stay—and prepare for the next great American adventure, the giant leap to Mars.

Moving forward, the United States will proudly encourage and facilitate the continued growth of an American commercial space sector that generates new markets and promotes entrepreneurship while furthering core United States interests.

The National Space Policy also directs the United States to continue to adapt its national security strategy to defeat aggression and protect national interests in space.  As part of this effort, the newly created sixth branch of our Armed Forces, the Space Force, will enhance the capabilities of our Armed Forces to protect our freedom of operation in, from, and to space.

Under this new policy, the United States will advance our national interests in space and lead a new era of permanent human presence in space on the Moon, Mars, and beyond.”

To view the National Space Policy, click here.

Source: White House

The post White House unveils national space policy appeared first on Intelligence Community News.

Source: US Air Force

The post Air Force releases AI strategy appeared first on Intelligence Community News.

The document, entitled Draft NIST Special Publication (SP) 800-171 Revision 2: Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, now has a new draft companion publication, NIST SP 800-171B, that offers additional recommendations for handling Controlled Unclassified Information (CUI) in situations where that information runs a higher than usual risk of exposure. CUI includes a wide variety of information types, from individuals’ names or Social Security numbers to critical defense information. 

When CUI is part of a critical program or a high value asset — such as a weapons system — it can become a significant target for high-end, sophisticated adversaries. In recent years, these programs and assets have been subjected to an ongoing barrage of serious cyberattacks, prompting the Department of Defense to request additional guidance from NIST. 

 “We need to provide safeguards and countermeasures that can stand up to these attacks,” said NIST’s Ron Ross, one of the publication’s authors. “We are requesting comments on this initial public draft, which we hope will help organizations protect CUI against our most advanced and persistent adversaries.” 

NIST is accepting comments on both SP 800-171 Rev. 2, which received minor editorial updates, and SP 800-171B until July 19, 2019. In the future, NIST plans to issue  final versions of both publications. In addition, a previously available companion document, NIST SP 800-171A, will be updated with new assessment procedures for the enhanced security requirements. 

The original version of SP 800-171 appeared in 2015 and provided 110 recommended requirements to ensure the confidentiality of CUI residing on the computers of contractors and other organizations that interact with the government. The guidance in SP 800-171 supports more consistent and robust security implementations across the federal government’s supply chain. Over 60,000 unique business entities that serve as defense contractors are required to implement NIST SP 800-171 to protect CUI in their systems and networks. (NIST hosted a daylong webinar on CUI in October 2018, offering background on the original NIST SP 800-171 requirements.) 

To address CUI in nonfederal systems and organizations that support critical programs or that form part of a high value asset, NIST has created SP 800-171B, which offers 32 recommended enhanced security requirements. This new companion publication does not alter the original guidance in the 2015 version, but simply provide additional tools to help deal with what are considered “advanced persistent threats” — those adversaries who possess the expertise and resources to play the long game of cyber warfare. They often attempt to establish long-term footholds within a target’s infrastructure to steal information or undermine critical aspects of its mission, sometimes years after the initial breach. 

“When this happens, you need additional safeguards and countermeasures to confuse, deceive, mislead and impede the adversary,” Ross said. “The strategies in SP 800-171B can help you take away the adversary’s tactical advantage and protect and preserve your organization’s high value assets and critical programs, even after the adversary has penetrated your system.” 

“The game is not lost after that initial penetration or breach,” he said. “It’s just beginning.” 

The requirements in SP 800-171B are largely drawn from two other draft publications, NIST SP 800-160 Vol. 2 and NIST SP 800-53 Rev. 5, both of which NIST is developing to help engineer security into information systems. 

Ross cautioned that only a small fraction of organizations would need to employ the new requirements. 

“It’s important to recognize that these requirements will only be levied upon a small percentage of programs and assets,” he said. “Determining what those are is up to individual federal departments and agencies.” 

Recognizing that many contractors do not have the in-house resources to implement the requirements fully, the revised draft indicates how an organization might use appropriate third-party contractors to perform specific tasks such as evaluating an organization’s resiliency to cyberattack or providing a Security Operations Center capability.  

Ross also said that the requirements could be applied on a voluntary basis far beyond the world of government contracting, including in critical infrastructure systems.  

“Everyone has high value assets, from small businesses to Fortune 500 companies,” he said. “These enhanced defenses are great tools for anyone to use. We do our jobs primarily for the federal government, but everyone gets to take advantage of NIST’s cybersecurity guidance.”  

Source: NIST

The post NIST updates cybersecurity guidance for sensitive information appeared first on Intelligence Community News.

The “National Insider Threat Policy and Minimum Standards for Executive Branch Insider Threat Programs,” issued by the White House in November 2012, provides executive branch departments and agencies with the minimum elements necessary to establish functional insider threat programs. These minimum standards serve as the foundation of the insider threat program maturity process.

The Framework, as it is known, is designed to help executive branch departments and agencies’ insider threat programs advance beyond the Minimum Standards to become more proactive, comprehensive, and better postured to deter, detect, and mitigate insider threat risk. The Framework identifies key elements within the existing minimum standards construct that, when enhanced, enable departments and agencies to increase program functionality and garner greater benefits from insider threat program resources, procedures, and processes. Each element within the Framework has been identified as a capability or attribute exhibited by an advanced insider threat program.

The Maturity Framework was developed via a series of working group sessions held in the fall of 2017 to solicit ideas from the U.S. Government’s insider threat community. Feedback from these sessions led to the development of a draft framework that was modeled on the capability maturity model process improvement approach used in private industry. The resulting Framework was vetted through a series of NITTF-hosted focus groups held in the spring of 2018. The groups included representatives from the Intelligence Community, Department of Defense, and federal partner insider threat programs.

NITTF is co-directed by the FBI and the National Counterintelligence and Security Center. It was established in October 2011 by Executive Order 13587 which directed federal departments and agencies with access to classified information to establish insider threat detection and prevention programs. The NITTF was established to assist agencies in developing and implementing these programs.

The Framework and FAQs, as well as additional information on the NITTF and its mission, can be found at https://www.dni.gov/index.php/ncsc-how-we-work/ncsc-nittf.

Source: ODNI

The post ODNI releases Insider Threat Framework appeared first on Intelligence Community News.

“Foreign interference in U.S. elections is a threat to our democracy; identifying and preventing this interference is a top priority of the Federal Government. We believe the greatest strength of our society is an engaged and informed public. Adversaries target U.S. elections to divide America along political lines and influence key policy decisions that are in their national interest.

Foreign Influence

We are concerned about ongoing campaigns by Russia, China and other foreign actors, including Iran, to undermine confidence in democratic institutions and influence public sentiment and government policies. These activities also may seek to influence voter perceptions and decision making in the 2018 and 2020 U.S. elections.

Elements of these campaigns can take many forms, including using social media to amplify divisive issues, sponsoring specific content in English-language media like RT and Sputnik, seeding disinformation through sympathetic spokespersons regarding political candidates and disseminating foreign propaganda.

Election Infrastructure

Currently, we do not have any evidence of a compromise or disruption of infrastructure that would enable adversaries to prevent voting, change vote counts or disrupt our ability to tally votes in the midterm elections. Increased intelligence and information sharing among federal, state and local partners has improved our awareness of ongoing and persistent threats to election infrastructure. Some state and local governments have reported attempts to access their networks, which often include online voter registration databases, using tactics that are available to state and non-state cyber actors. Thus far, state and local officials have been able to prevent access or quickly mitigate these attempts.

Addressing the Threat

Foreign powers have long sought to exploit America’s free and open political system, but as the President recently stated, we will not tolerate foreign interference in our elections. The Executive Order on Imposing Certain Sanctions in the Event of Foreign Interference in a United States Election, which President Trump signed on September 12, makes clear that the U.S. government will not hesitate to defend our electoral processes or punish those who interfere in it.

The Office of the Director of National Intelligence, Federal Bureau of Investigation, Department of Homeland Security and other relevant Intelligence Community components continue to work closely together in order to develop the most up-to-date picture of the threat. Additionally, we want to thank state and local officials for their vigilance and proactive approach in sharing information on cyber threats targeting state and local election infrastructure. We will continue to work with state and local election officials to increase the security and resilience of their systems and remain committed to supporting their actions to counter any threat to or attack on the 2018 midterm elections and beyond.

While the U.S. government is tirelessly working to identify and counter threats to the electoral process, the American public, government officials and political candidates and their campaigns can mitigate adversarial efforts by following sound cyber security guidelines and being responsible consumers of information, in particular from social media platforms.”

Source: ODNI

The post IC leaders issue joint statement on combating foreign influence in US elections appeared first on Intelligence Community News.

The strategy lays out a clear vision and an approach for DHS to take to protect critical infrastructure and prepare to respond and recover from potentially catastrophic electromagnetic incidents. The strategy also reflects a consensus Intelligence Community assessment of the EMP threat posed by our nation’s adversaries.

Electromagnetic incidents caused by an intentional EMP attack or naturally-occurring GMD events, while unlikely, could cause serious damage to the nation’s critical infrastructure, including the electrical grid, communications equipment, and transportation capabilities.

While the strategy is primarily focused on departmental activities, it recognizes the importance of continued close collaboration with federal, state, local, tribal, and territorial decision-makers, sector-specific agencies, and private sector critical infrastructure owner-operators. This partnership is essential to help critical infrastructure owners and operators to manage EMP and GMD risk.

The Department is currently developing an accompanying implementation plan, which will include measures that enable DHS to evaluate progress toward addressing identified capability gaps. Together, the strategy and its companion Implementation Plan will improve the Department’s management oversight and optimize resource utilization for our EMP/GMD protection, response, and recovery activities.

DHS intends to review and update the EMP/GMD strategy, as needed, and regularly assess the department’s progress on the implementation plan.

You can view the Department’s EMP/ GMD Strategy here.

Source: DHS

The post DHS releases electromagnetic incident strategy appeared first on Intelligence Community News.