Explore

NIST Updates OT Security Guide, CISA and FBI Advise on ICS Integrator Risks

NIST Updates OT Security Guide, CISA and FBI Advise on ICS Integrator Risks

The National Institute of Standards and Technology (NIST) has released a draft update to its operational technology (OT) security guide, Special Publication 800-82 Revision 4, titled 'Guide to Operational Technology (OT) Security.' This revision expands the guide's sector coverage to include building automation, water and wastewater systems, food and agriculture, freight rail, and maritime vessels, and integrates industrial IoT and cloud convergence. The updated guide is structured around NIST Cybersecurity Framework 2.0 and offers expanded guidance on implementing OT security controls, asset management, network monitoring, and zero trust principles. Concurrently, the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have issued a fact sheet advising critical infrastructure owners and operators on the risks associated with third-party industrial control system (ICS) integrators, urging caution when granting high levels of access and emphasizing the principle of least privilege.

Cybersecurity Threats Projected to Cost African Economies $4 Billion Annually, Prompting Call for Stronger Frameworks

Cybersecurity Threats Projected to Cost African Economies $4 Billion Annually, Prompting Call for Stronger Frameworks

Cybersecurity threats are anticipated to inflict an annual cost of approximately $4 billion on African economies. This projection highlights an urgent need for the development and implementation of more robust national cybersecurity frameworks across the continent. Organizations like Cybastion are actively working to address this challenge by providing integrated cybersecurity solutions. These solutions aim to safeguard critical digital infrastructure and assist governments and businesses in preventing, detecting, and responding to the increasing number of cyber-attacks. The comprehensive approach includes establishing foundational elements such as legal and regulatory frameworks, preparing skilled workforces through academies, and implementing prevention measures like Public Key Infrastructure (PKI). Detection capabilities are enhanced through Security Operations Centers (SOCs) that monitor networks and analyze data, while response mechanisms involve Computer Security Incident Response Teams (CSIRTs) and ...

US cybersecurity agency releases election infrastructure plan 40 days before midterms

US cybersecurity agency releases election infrastructure plan 40 days before midterms

The nation’s cybersecurity agency has released an election infrastructure security plan 40 days before November’s midterms

ShinyHunters Hacking Group Claims Breach of FBI Databases, Holds Employee Data

ShinyHunters Hacking Group Claims Breach of FBI Databases, Holds Employee Data

The high-profile hacking group ShinyHunters, previously known for demanding a ransom from GTA 6 developer Rockstar Games, has claimed to have breached the internal databases of the U.S. Federal Bureau of Investigation (FBI). A representative for ShinyHunters told 404 Media that the group now possesses data on 'all' FBI employees and applicants. A sample provided to 404 Media reportedly contained personal data for 5,000 FBI employees, including addresses, phone numbers, dates of birth, and in some cases, details about their spouses. Reuters was also shown a data sample and was able to partially verify the leaked information. The FBI's jobs website, FBIjobs.gov, was also defaced as part of the hack, displaying a message claiming seizure by ShinyHunters. An FBI spokesperson confirmed awareness of claims regarding unauthorized activity affecting FBIjobs.gov and stated that an investigation is underway.

40 days to midterms, election officials say new US cyber plan comes too late

40 days to midterms, election officials say new US cyber plan comes too late

The nation’s cybersecurity agency has released an election infrastructure security plan 40 days before November’s midterms

ETSI Releases Technical Report Addressing Limitations and Implementation Guidance for Quantum Random Number Generators

ETSI Releases Technical Report Addressing Limitations and Implementation Guidance for Quantum Random Number Generators

ETSI (European Telecommunications Standards Institute) has published Technical Report ETSI TR 104 171, which provides crucial implementation guidance to mitigate weaknesses that could compromise the quality and security of Quantum Random Number Generator (QRNG) outputs. The report emphasizes that while QRNGs leverage inherently unpredictable quantum phenomena for randomness, an adversary with access to side-information can exploit apparent statistical randomness, undermining its true unpredictability. The report covers the entire QRNG lifecycle, from modeling and validating the quantum entropy source and applying appropriate randomness extraction, to monitoring entropy quality during operation and detecting drift, bias, and hardware failures. It also details methods to protect QRNGs against tampering and side-channel attacks, secure the path from the entropy source to the consuming application, and establish provenance, attestation, and auditability to ensure trustworthiness throughout the lifecycle. A key...

U.S. Lawmakers Introduce Bipartisan 'Stop Rogue AI Act' to Establish National Standards for AI Agents

U.S. Lawmakers Introduce Bipartisan 'Stop Rogue AI Act' to Establish National Standards for AI Agents

U.S. Representatives Josh Gottheimer (D-NJ) and Mike Lawler (R-NY) have introduced the bipartisan 'Stop Rogue AI Act.' This legislation aims to establish national standards for identifying, monitoring, and controlling potentially dangerous Artificial Intelligence (AI) agents operating within government and corporate computer networks. The lawmakers highlighted that organizations often lack reliable methods to determine the presence, origin, or access levels of unauthorized AI agents, which can be introduced by employees, embedded in third-party software, or by outside vendors. The bill proposes directing the National Institute of Standards and Technology (NIST) to develop guidelines and best practices for discovering, verifying, monitoring, and controlling these AI agents. Congressman Gottheimer emphasized the need for accountability, likening the bill to requiring a 'driver's license' for every AI agent to ensure organizations can track, verify, and disable them if they pose a threat. The legislation seek...

City of Alexandria Seeks Cloud Architect Engineer to Modernize Enterprise Platforms

City of Alexandria Seeks Cloud Architect Engineer to Modernize Enterprise Platforms

The City of Alexandria, Virginia, is actively seeking an experienced Cloud Architect Engineer to lead the modernization and administration of its enterprise cloud, collaboration, and identity environment. This role, situated within the Department of Information Technology Services (ITS), is critical for setting technical standards, driving innovation, and establishing a secure, automated foundation for city departments. The successful candidate will be responsible for designing, implementing, and optimizing cloud-based collaboration and messaging services, overseeing secure communication and data protection, and managing identity and access lifecycle across cloud platforms. Key responsibilities also include architecting and administering enterprise authentication and access control solutions, such as SSO, MFA, OAuth/OIDC integrations, Conditional Access strategies, and RBAC models. The position requires ensuring compliance with legal, regulatory, and compliance obligations, including FOIA, CJIS, NIST, and ...

EU Cybersecurity Alert System Faces Delays and Oversight Gaps, Auditors Report

EU Cybersecurity Alert System Faces Delays and Oversight Gaps, Auditors Report

The European Court of Auditors (ECA) has released a report indicating significant shortcomings in the European Union's cybersecurity defense mechanisms. Despite allocating €1.4 billion to defend against cyberattacks, the EU's early-warning network for major cyberattacks is not yet operational. Key components, such as the ATHENA and ENSOC hubs of the European Cybersecurity Alert System, lack the necessary tools for threat detection and information sharing due to repeated procurement delays. Furthermore, essential cooperation agreements, common classification systems, and technical standards required for the alert system to function are still missing. The audit also highlighted a critical oversight: when EU cybersecurity funding is passed to third parties, there is no independent verification to ensure these organizations are not exposed to influence from hostile states. Grant beneficiaries are responsible for assessing third-party ownership and control, but the European Cybersecurity Competence Centre, whic...

GAO Warns of Cybersecurity Vulnerabilities in FAA Air Traffic Control Systems

GAO Warns of Cybersecurity Vulnerabilities in FAA Air Traffic Control Systems

The U.S. Government Accountability Office (GAO) has issued a warning regarding significant cybersecurity vulnerabilities within the Federal Aviation Administration's (FAA) air traffic control systems. The report indicates that malicious actors could exploit weaknesses in authentication, encryption, and protocol design of systems like the Aircraft Communications Addressing and Reporting System (ACARS) and Controller-Pilot Data Link Communications (CPDLC). These vulnerabilities could allow for the transmission of fraudulent messages, including fake clearance cancellations, potentially leading to flight delays or safety issues. The GAO found that the FAA lacks comprehensive real-time threat monitoring and has not completed necessary risk assessments and security documentation for several spectrum-dependent systems. The FAA concurred with all nine recommendations made by the GAO, which include strengthening authentication and data protection, conducting spectrum risk assessments, and improving interagency coll...

ShinyHunters hackers say they breached FBI, stole data on bureau employees

ShinyHunters hackers say they breached FBI, stole data on bureau employees

By Raphael Satter and AJ Vicens WASHINGTON, Sept 22 (Reuters) - The digital extortion group known as "ShinyHunters" said on Tuesday that it had breached the Federal Bureau of Investigation and stolen data on a huge number of current and former FBI employees.

Senators Reintroduce Health Infrastructure Security Act to Mandate Healthcare Cybersecurity Standards

Senators Reintroduce Health Infrastructure Security Act to Mandate Healthcare Cybersecurity Standards

Senators Mark Warner and Ron Wyden have reintroduced the Health Infrastructure Security and Accountability Act, a legislative proposal aimed at establishing and enforcing minimum cybersecurity standards across the American healthcare system. This bill targets healthcare providers, health plans, clearinghouses, and business associates, requiring them to undertake several critical security measures. These include conducting security risk analyses, developing comprehensive incident response plans for cyber incidents, natural disasters, and technology failures, performing stress tests to evaluate their ability to restore essential functions, and undergoing independent security audits. The legislation also proposes significant financial investment, with $800 million in upfront payments over two years designated for 2,000 rural and urban safety-net hospitals. This funding is intended to help these hospitals adopt essential cybersecurity standards to address high-risk vulnerabilities in their data infrastructure ...