Rob Joyce, cybersecurity director at the National Security Agency and a previous Wash100 Award winner, said advanced persistent threat actors are using virtual private networks and other widely available commercial tools to evade detection, making it more challenging for the government to attribute cyberattacks, Nextgov reported Wednesday.

“We've seen whole APTs kind of go dark to some of the commercial entities who say 'yeah, I don't see those custom tools from name your favorite threat actor group,' when in reality they're just as active but what they're using now is, you know some of the commercial tools that get them to the same outcomes,” said Joyce. “So it's clouded that space.”

He also cited the challenge of distinguishing between state-sponsored hackers and independent criminal actors especially for countries like China.

“What we often see is there are the commercial elements who by day are supporting those government activities and then by night using some of the same tools, infrastructure and other activities. And I think it's really important China understands how much of a risk that is to them, that these uncontrolled actors are, you know, ambiguously combined with their activities, and that, that's a problem,” Joyce said.

NSA and the Cybersecurity and Infrastructure Security Agency (CISA) issued on Tuesday an information sheet meant to help organizations understand the risks and considerations for selecting a virtual private network. The two agencies also advised organizations to request and verify a product’s software bill of materials and ensure that products use FIPS-validated cryptographic modules, among other recommendations.

ExecutiveBiz, sister site of GovConDaily and part of the Executive Mosaic digital media umbrella, will host a virtual event about securing the supply chain on Oct. 26. Visit ExecutiveBiz.com to sign up for the “Supply Chain Cybersecurity: Revelations and Innovations” event.

The House on Wednesday passed a bill that would create a program meant to allow senior cyber professionals from the private sector to serve for a specific time period in the government and provide an opportunity for government personnel to rotate among federal agencies, FedScoop reported.

Rep. Ro Khanna, D-Calif., introduced the Federal Rotational Cyber Workforce Program Act in May and the measure was sent to the House floor in late June for consideration. Khanna said he is proud to see the bill pass the lower chamber with bipartisan support.

“To maintain our nation’s leadership & security in the 21st century we need an integrated federal workforce, particularly one that possesses the knowledge, skills, and competencies to counter increasingly sophisticated threats from foreign actors,” he added.

The bill would direct the director of the Office of Personnel Management (OPM) to come up with an operation plan for the Federal Rotational Cyber Workforce Program. The plan should establish procedures for the program, identify agencies that should participate in the initiative and indicate that an employee’s participation in the program should be voluntary, among other requirements.

An employee detailed to a cyber workforce position under the program should serve for a term of not less than 180 days and not more than 12 months. The detail of employees among rotational cyber roles at agencies could be extended for a period of 60 days.

ExecutiveBiz, sister site of GovConDaily and part of the Executive Mosaic digital media umbrella, will host a virtual event about securing the supply chain on Oct. 26th. Visit ExecutiveBiz.com to sign up for the “Supply Chain Cybersecurity: Revelations and Innovations” event.

The U.S. Air Force and Ignyte Assurance Platform, a collaborative security technology provider, have signed a patent license agreement to further develop software applications that screen network files to detect potential vulnerabilities, DVIDS reported Wednesday.

Max Aulakh, founder and CEO of Ignyte, said the company and the 16th Air Force’s 67th Cyberspace Wing plan to use and combine their technology platforms to develop a unified capability that could enable the private sector to protect critical assets and data and accelerate compliance with the Cybersecurity Maturity Model Certification (CMMC) program and other federal security requirements.

“Our combined capability will allow organizations to meet compliance objectives while helping quickly identify weaknesses within critical computing systems. This capability will be enabled through the use of advance techniques using artificial intelligence and machine learning,” Aulakh added.

The Air Force’s technology looks for malicious items lacking signatures, which could enable certain files to evade detection using existing methods.

The Air Force Research Laboratory’s (AFRL) Technology Transfer and Transition program office oversee patent license agreements, which help facilitate the transfer of inventions built and patented by defense labs to the private sector for commercial use.

“This agreement will now help us mature and scale our capabilities rapidly for the commercial enterprise,” Aulakh said.

ExecutiveBiz, sister site of GovConDaily and part of the Executive Mosaic digital media umbrella, will host a virtual event about securing the supply chain on Oct. 26. Visit ExecutiveBiz.com to sign up for the “Supply Chain Cybersecurity: Revelations and Innovations” event.