Sens. Gary Peters, D-Mich., and Ron Johnson, R-Wis., have proposed a bipartisan bill that would require the General Services Administration (GSA) to coordinate with the Office of Management and Budget (OMB) and departments of Defense (DOD) and Homeland Security (DHS) to establish a training program to help federal officials protect information technology supply chains against cyberthreats.

The proposed Supply Chain Security Training Act would also direct OMB to come up with guidance on how federal agencies can use the training program and select officials to take part in the program, Peters’ office said Thursday.

“Federal employees need to know how to recognize possible threats when they are purchasing software and equipment that could allow bad actors a back door into government information systems. This bill will help strengthen national security by safeguarding against cybersecurity vulnerabilities and other threats posed by the technology our government uses,” said Peters, chairman of the Homeland Security and Governmental Affairs Committee.

The measure builds on a recent executive order that seeks to facilitate threat information sharing among agencies, improve the security of the federal software supply chain and advance cybersecurity infrastructure modernization.

“Counterintelligence training for federal workers who buy and sell goods and services for the government is critical at a time when our adversaries are probing cyber vulnerabilities to breach our systems and steal information,” said Johnson. “This type of training will help close a potential gap in our cyber and physical security defenses.”

If you want to hear cybersecurity experts talk about how the tech supply chain can reduce the risk of cyberattacks and get ahead of hackers, then check out ExecutiveBiz's Supply Chain Cybersecurity: Revelations and Innovations forum coming up on Oct. 26th. 

To register for this virtual forum and view other upcoming events, visit the ExecutiveBiz Events page.

The National Institute of Standards and Technology asks the public to comment on a new draft document about the cybersecurity of commercial satellite activities.

The document, titled “Introduction to Cybersecurity for Commercial Satellite Operations,” tackles how to manage cybersecurity risks of crewless space activities while considering space vehicle requirements, NIST said Wednesday.

The agency specifically wants feedback regarding the example use cases, corresponding controls and overall approach presented by the document. NIST may also create other publications for other space operation areas, based on the feedback to be received.

Interested parties may access the draft and instructions via this link and submit responses through  August 13. 

Sens. Sheldon Whitehouse, D-R.I., and Steve Daines, R-Mont., have proposed a bill that would direct the Department of Homeland Security to study the potential advantages and risks of allowing private sector organizations to initiate measures against hackers during cyberattacks.

The bipartisan bill would require DHS to submit a report containing its recommendations and findings, including potential impacts on national security and foreign affairs, federal oversight, private entities that would be allowed to take actions, safeguards and level of certainty for attribution, Whitehouse’s office said Wednesday.

“The Colonial Pipeline ransomware attack shows why we should explore a regulated process for companies to respond when they’re targets,” said Whitehouse. “This bill will help us determine whether that process could deter and respond to future attacks, and what guidelines American businesses should follow.”

Current law authorizes the federal government to launch offensive operations against hackers and limits U.S. companies to internal defensive actions. Once the measure becomes law, DHS has 180 days to submit the report.

“The federal government should do more to empower the private sector to directly counter cyber threats from across the globe rather than tie their hands," said Daines.

The FBI, National Security Agency, Cybersecurity and Infrastructure Security Agency and the U.K. government’s national cybersecurity center have issued a joint advisory on a brute force campaign by Russian military intelligence against U.S. and foreign organizations.

The malicious cyber activities by the Russian general staff main intelligence directorate 85th main special service center targeted government and military organizations, political organizations, defense contractors, think tanks, media companies, law firms, logistics and energy companies and higher education institutions, the FBI said Thursday.

The brute force capability enables threat actors to gain access to email and other protected data and identify valid account credentials through password guessing and other extensive login attempts.

The agencies said the exploitation efforts are still ongoing. They also listed in the advisory some of the known tactics, techniques and procedures of the threat actors involved in the brute force campaign.

The FBI, CISA, NSA and U.K.’s NCSC outlined several measures organizations can take to counter the cyberthreat, including the use of multifactor authentication, enabling time-out and lockout features whenever password authentication is needed, changing all default credentials and employing network segmentation and restrictions.