Cyber
The Next Frontier

Malicious hackers are exploiting emerging technologies that rapidly connect people, posing advanced cyber risks in a world where the digital and physical are increasingly interwoven, according to a report Tuesday from the Office of the National Cyber Director.

“We are in the midst of a fundamental transformation in our Nation’s cybersecurity,” National Cyber Director Harry Coker said in a statement accompanying the report. “We have made progress in realizing an affirmative vision for a safe, prosperous, and equitable digital future, but the threats we face remain daunting.”

The first-ever “Report on the Cybersecurity Posture of the United States,” required as part of the law that established Coker’s office, also identified the top trends of 2023 as evolving critical infrastructure risks, ransomware, supply chain exploitation, commercial spyware and artificial intelligence.

And it detailed progress on efforts to implement the Biden administration’s national cybersecurity strategy published last year, with the office deeming 33 of 36 initiatives completed on time under the administration’s implementation plan and another 33 with deadlines still to come.

The report arrives nearly five months into Coker’s tenure as the second national cyber director and three months after a watchdog report pointed to the need for improvements in how the office is implementing the national strategy. In an accompanying report Tuesday, Coker’s office released a second version of the national strategy implementation plan, adding 31 more initiatives.

“Complexity, interconnectivity, and competition” were the three main characteristics of 2023, according to the cyber posture report.

“Continued progress in digital communications, advanced computing, quantum information science, data storage and processing, and other critical and emerging technologies are rapidly increasing the complexity of our economy and society,” the report states. “These technologies also connect people around the world, enable the proliferation of cyber-physical systems, and create new dependencies between critical infrastructure and essential services across every sector.

“As this landscape evolves, malicious state and non-state actors are exploiting its seams with growing capability and strategic purpose, making clear that cyberspace is closely aligned with other domains of international conflict and competition,” it continues.

Critical infrastructure risks are exacerbated by nation-states showing a willingness to compromise systems that don’t have inherent value for espionage, according to the report. It mentioned the Chinese government-sponsored hacking group Volt Typhoon breaching systems that “could enable disruption of operational technology systems in critical infrastructure and interference with U.S. and allied warfighting capabilities” as an example of that kind of activity.

Ransomware attacks and costs showed signs of increasing in 2023, the report says. A growing reliance on third-party service providers was another 2023 risk, with incidents like the Okta breach allowing hackers to go after one third-party provider that gives them access to other potential victims, according to the report.

A growing market for commercial spyware is another major 2023 trend the report identified due to the tech’s ability to “offer world-class capabilities to the highest bidder.” And artificial intelligence large-language models offered more sophisticated tools to hackers who otherwise don’t have many resources, the report says.

The post ONCD report: ‘Fundamental transformation’ in cyber, tech drove 2023 risks appeared first on CyberScoop.

SAN FRANCISCO — A U.S. State Department strategy document released Monday said the Biden administration aims to orient its cyber-diplomacy around the concept of “digital solidarity” to help partners and allies responsibly use technology and to help developing nations grow their economies. 

The long-awaited strategy for how the United States will pursue its digital diplomacy goals reiterates Washington’s commitment to an open, interoperative internet but comes at a time when that idea has never been under greater threat, including in the United States, where a recently passed law aims to force ByteDance to divest from TikTok. 

Nonetheless, American officials said Monday’s strategy document provides a blueprint for cracking down on malicious behavior online, assembling an international coalition to effectively govern digital technologies, and promote economic development. 

In remarks at the RSA Conference in San Francisco, Secretary of State Antony Blinken described digital solidarity as the document’s “North Star.” Blinken said that while “‘move fast and break things’ is the literal opposite of what we try to do at the State Department,” technology diplomacy is key to promoting economic development, aiding other countries in responding to cyber attacks and harnessing technological innovation to tackle hard problems, like climate change. 

Blinken pointed to the U.S. response to Russia’s invasion of Ukraine — when the U.S. government and tech companies collaborated to provide technological assistance to the government in Kyiv — as an example of how the United States can be more responsive in its technology diplomacy. 

“That is digital solidarity in action, and it’s the kind of collaboration we want to scale and apply around the world,” Blinken said. 

Monday’s strategy lays out four “action areas” for American diplomats to pursue. The document calls on the State department to promote and maintain an open inclusive and secure digital ecosystem; align their technology governance work with partners in a way that respects human rights; encourage responsible state behavior online, including by discouraging cyberattacks on critical infrastructure; and improve the cybersecurity and tech policy capacity of partner states. 

The strategy does not break much new ground and mostly reiterates existing U.S. policy, but Nate Fick, the top cyber diplomat at the State Department, told reporters in San Francisco that the strategy offers an affirmative vision of what the internet might look like at a time when authoritarian states are increasingly censoring their domestic web, and countries in Europe are looking to controls on data flows to wrest back their technology ecosystem from both Chinese and American firms. 

“It’s our obligation to provide a compelling choice,” Fick said. 

Open internet advocates have described the move to force a TikTok divestiture as an abandonment of the United States’ commitment to an open internet, but Fick argued that TikTok represents a “sui generis” national security threat.

“It’s not a slippery slope to determine which platforms can and can’t be used in a free and open society,” he said. 

To develop a positive American vision of a contemporary internet, the 54-page document provides a lengthy to-do list of thorny diplomatic problems with no clear solution in sight.

Among its goals are the crafting of a new international treaty regarding cybercrime. U.S. officials have been battling Russian and Chinese diplomats on this issue at the United Nations, where the Kremlin’s diplomats have sought passage of a broad cybercrime treaty that experts warn would severely undermine online rights. 

The document calls on U.S. diplomats to step up their work in international standards bodies and to reinvigorate their work before the International Telecommunications Union, one such key standard body. U.S. diplomats are instructed to pursue “more action-oriented discussions at the UN” to promote responsible state behavior online and improve cyber capacity. 

The document also calls on U.S. diplomats to encourage the free flow of data and an open internet and to counter what the document describes as many American partners’ growing embrace of “narratives of digital sovereignty and protectionism.” This includes a proposal by the European Union to certify the cybersecurity of cloud computing providers, an idea that has sparked intense criticism by some U.S. observers and the American technology industry. 

Conflicts such as these gesture at the tension in the new strategy document. Around the world, governments are increasingly seeking greater control over technology in all its forms — whether that’s the data collected by online platforms or the supply chain for critical chips — and that often comes into conflict with the United States’ historical emphasis on an open internet, with U.S. technology firms providing its essential components. 

China’s growing technological clout is challenging that model, and Monday’s strategy document can perhaps be most clearly understood as a summation of U.S. policy to counter Beijing’s influence on matters of technology and public policy. As 5G cellular technology was rolled out over the past decade, Chinese firms dominated its deployment, and Blinken said on Monday that this experience is informing the State Department’s efforts to promote the work of companies committed to an open web.

“We’ve learned in the 5G experience that we cannot be complacent and let strategic competitors dominate the technologies that form the backbone of the global economy and that determine how and where information flows,” Blinken said. 

The post State Department wants ‘digital solidarity’ at center of tech diplomacy appeared first on CyberScoop.