Taking meaningful steps toward stronger security

Cybersecurity experts know that attacks targeting government and critical infrastructure organizations are nothing new. Still, over the past two years, the effects of those attacks have begun to reverberate into the public consciousness. Incidents like the Colonial Pipeline hack and the attack on the Oldsmar, Fla., water treatment facility made front-page news, and the government has begun seeing significant pressure to respond to those attacks in a more substantial way.

Attacks on the government do not always target government systems directly. Attacking vendors, suppliers and other partner organizations with the intention of jumping from one network to another via infected code and software backdoors can be an effective tactic -- as evidenced by the recent SolarWinds breach. Understanding the threats that face the government and its partners is critical as is taking meaningful steps to address potential vulnerabilities.

The current threat landscape

The image of the solitary, secretive, hoodie-wearing hacker remains stubbornly persistent in the mind of the public, but it bears little resemblance to today’s most pressing threats. Nation-states now conduct espionage online daily with large, well-resourced expert teams, and they even hire dangerous cybercriminal gangs to retain some level of plausible deniability. Sometimes these efforts by enemy nations seek to inflict damage to competitive nations, conduct cyber espionage or undermine the foundations of democracy itself.

As networks have expanded faster than security teams can protect them, attackers have seized the opportunity to exploit vulnerabilities before defenders can address them.  Unfortunately, countering these threats can be a challenge. Agencies are burdened by legacy systems, many of which use aging operating systems that cannot be easily replaced. While agencies have occasionally stated their intent to update some of these systems, the financial resources needed to do so would be significant.

Simply put, cybersecurity has not been a top priority for government until fairly recently, and without reliable enforcement mechanisms, many network security measures lag behind even existing guidelines. Addressing these issues must be a priority for the government as it attempts to reduce its vulnerability to attacks.

Taking meaningful steps toward stronger security

There are currently more than a dozen pieces of federal cybersecurity legislation in various states of consideration. Not all these bills are necessarily good, and most will never see the light of day, but it is encouraging to note that cybersecurity issues are gaining traction within the highest levels of government. For perhaps the first time ever, there is bipartisan support for regulating industries more stringently to report breaches and share information. Stopping 100% of attacks will never be a realistic possibility, but more reliable incident reporting and sharing of indicators of compromise and adversary tactics, techniques and procedures represent steps in the right direction.

The new administration has also shown an increased willingness to put pressure on nation-states supporting these large-scale attacks. Countries like Russia, Iran and North Korea are already under substantial political and economic pressure. The U.S. is in a prime position to offer both the carrot and the stick by lifting or strengthening its economic sanctions. On a similar note, the U.S. has considered the idea of banning cryptocurrency payments in ransomware attacks. Given the significant evidence that Russian groups are behind many of the most damaging ransomware attacks, this could significantly impact Russia while disincentivizing ransomware attacks in general.

More robust cyber hygiene is also essential, but it is also important to redefine it. Today, it is about more than using strong passwords and installing updates in a timely manner. Identity security must be a part of the broader definition, and agencies must manage their pool of permissions more effectively. Attackers have realized that once they breach perimeter defenses, many networks lack the in-network protections that would promptly detect and derail their activities.

When attackers are free to move laterally throughout a network with minimal fear of detection, they can look for valuable information and assets to steal, increasing the potential damage. Worse, it allows them to escalate their attacks by targeting Active Directory, potentially compromising administrator-level identities and effectively seizing the keys to the castle. This happens all too often. Active Directory and identity services are essential to the function of today’s network and cloud environments, and protecting them must be a part of basic cyber hygiene. As attackers become more sophisticated, they will continue to target these areas -- and defenders must be prepared.

Moving forward with confidence

Over the years, cyberattacks have become more nefarious, more costly and more frequent. It’s a trend that is unlikely to change -- but government has warmed to the idea of taking meaningful action to combat these attacks. The adversaries government and its partner organizations face are both smart and well-funded. Combating them cannot be left to individual agencies and organizations. It requires a highly coordinated effort.

Fortunately, government is in a strong position to enact meaningful legislation, exert political and economic pressure and reexamine its own vulnerabilities and identify ways to address them. In the near future, that could mean federal privacy legislation, streamlined ownership of systems and network assets or a concerted shift toward zero-trust policies. With a growing number of attacks making headlines, one thing is certain: Cybersecurity is on the government’s radar, and addressing it has finally become a top priority.