“We’re still in the relatively early days even though this has been several weeks now,” Chris Painter said. “It could well be that Russia is holding those capabilities in the reserve and haven’t used them yet.”
"The FBI, CISA, and CGCYBER assess that advanced persistent threat cyber actors are likely among those exploiting the vulnerability," the joint advisory notes.
Balancing security and access to data are critical to providing users with trustworthy, reliable data for real-time decisions.
The law's vulnerability disclosure provisions will give the Chinese government a head start on remediating -- and potentially exploiting -- zero-day vulnerabilities, possibly to include those discovered in tech used by the Defense Department, Intelligence Community, and across the US public and private sectors more broadly.
"So what will happen is you'll be destroying your grandmother's computer in Kansas that has been taken over," cyber policy expert Herb Lin said. "It's not clear to me that that's the best way."
"It's part of a larger diplomatic strategy," cyber policy expert James Lewis said of the US attribution to China for Microsoft Exchange hacks earlier this year.
"We shouldn’t be relying on voluntary reporting to protect our critical infrastructure," Sen. Warner said.
“Tactical operating system” for warfighters has evolved to provide more situational awareness of the battlefield.
"The PRC’s pattern of irresponsible behavior in cyberspace is inconsistent with its stated objective of being seen as a responsible leader in the world," a senior administration official said on Sunday night.
"CISA has validated various proofs of concept and is concerned that exploitation of this vulnerability may lead to full system compromise of agency networks if left unmitigated," the emergency directive says.
"This is a good reminder that the GRU remains a looming threat, which is especially important given the upcoming Olympics, an event they may well attempt to disrupt," observed John Hultquist, VP of Analysis at Mandiant Threat Intelligence.
"China is a second-tier cyber power but, given its growing industrial base in digital technology, it is the state best placed to join the US in the first tier," an IISS report says.
Knowing when to build on commercial systems and when to develop something new can be the difference between parity and information dominance.
The bad practices are aimed especially at -- though not limited to -- educating critical infrastructure owners and operators. This includes, of course, the defense industrial base and many who support its supply chain -- from communications equipment and high-tech capabilities to electrical and mechanical components for military hardware, such as tanks, planes, and ships.
Sen. Warner's draft legislation, long expected, marks one of the first attempts to create a federal law mandating cyber incident reporting by some entities. Notably, the bill provides reporting entities with a degree of privacy and legal protection.
"If the past year has taught us anything, it's the obligation we have as leaders to anticipate the unimaginable," CISA nominee Easterly said. "I believe as a nation we remain at great risk of a catastrophic cyberattack."
"[Paying the ransom] was the hardest decision I've made in my 39 years in the energy industry... and I put the interest of the country first," Colonial's CEO told Congress. "I believe with all my heart [paying the ransom] was the right choice to make, but I want to respect those who see this issue differently."