"The FBI, CISA, and CGCYBER assess that advanced persistent threat cyber actors are likely among those exploiting the vulnerability," the joint advisory notes.
The law's vulnerability disclosure provisions will give the Chinese government a head start on remediating -- and potentially exploiting -- zero-day vulnerabilities, possibly to include those discovered in tech used by the Defense Department, Intelligence Community, and across the US public and private sectors more broadly.
The GPS network continues to prove its unmatched reliability, and it’s only getting stronger.
"So what will happen is you'll be destroying your grandmother's computer in Kansas that has been taken over," cyber policy expert Herb Lin said. "It's not clear to me that that's the best way."
"It's part of a larger diplomatic strategy," cyber policy expert James Lewis said of the US attribution to China for Microsoft Exchange hacks earlier this year.
"We shouldn’t be relying on voluntary reporting to protect our critical infrastructure," Sen. Warner said.
"The PRC’s pattern of irresponsible behavior in cyberspace is inconsistent with its stated objective of being seen as a responsible leader in the world," a senior administration official said on Sunday night.
Reducing cognitive overload on warfighters while improving “time to trust” for autonomous systems is a matter of design.
"CISA has validated various proofs of concept and is concerned that exploitation of this vulnerability may lead to full system compromise of agency networks if left unmitigated," the emergency directive says.
"This is a good reminder that the GRU remains a looming threat, which is especially important given the upcoming Olympics, an event they may well attempt to disrupt," observed John Hultquist, VP of Analysis at Mandiant Threat Intelligence.
"China is a second-tier cyber power but, given its growing industrial base in digital technology, it is the state best placed to join the US in the first tier," an IISS report says.
The bad practices are aimed especially at -- though not limited to -- educating critical infrastructure owners and operators. This includes, of course, the defense industrial base and many who support its supply chain -- from communications equipment and high-tech capabilities to electrical and mechanical components for military hardware, such as tanks, planes, and ships.
Knowing when to build on commercial systems and when to develop something new can be the difference between parity and information dominance.
Sen. Warner's draft legislation, long expected, marks one of the first attempts to create a federal law mandating cyber incident reporting by some entities. Notably, the bill provides reporting entities with a degree of privacy and legal protection.
"If the past year has taught us anything, it's the obligation we have as leaders to anticipate the unimaginable," CISA nominee Easterly said. "I believe as a nation we remain at great risk of a catastrophic cyberattack."
"[Paying the ransom] was the hardest decision I've made in my 39 years in the energy industry... and I put the interest of the country first," Colonial's CEO told Congress. "I believe with all my heart [paying the ransom] was the right choice to make, but I want to respect those who see this issue differently."
CISA and FBI issue a joint advisory on DarkSide ransomware. "There is no immediate mission impact" from fuel shortage on DoD, a Pentagon spokesman said. Colonial temporarily restored operations between North Carolina and Maryland last night. Russia denies involvement. DarkSide's business model complicates attribution.