The Office of Management and Budget (OMB) has released a memorandum that establishes a maturity model for event log management as part of efforts to improve the federal government’s capabilities to remediate and investigate cyber incidents in accordance with the cybersecurity executive order issued in May.

The maturity level is composed of four Event Logging tiers meant to help agencies prioritize resources and efforts in order to “achieve full compliance with requirements for implementation, log categories, and centralized access,” OMB said in the Friday memo.

Agencies should evaluate their maturity against the model and identify implementation gaps within 60 days, achieve Event Logging tier 1 maturity within a year, reach EL2 maturity within 18 months and EL3 maturity within two years of the memo’s release date.

The memo also requires agencies to share relevant logs to the FBI, Cybersecurity and Infrastructure Security Agency and other federal agencies to address cyberthreats.

The document outlines the specialized responsibilities of the CISA and Department of Commerce as part of efforts to enhance the use and management of logging practices.

CISA, for instance, will oversee the deployment of teams to advise agencies when it comes to assessing logging capabilities and development of tools to facilitate review of logging maturity across the organization.

ExecutiveBiz, sister site of GovConDaily and part of the Executive Mosaic digital media umbrella, will host a virtual event about securing the supply chain on Oct. 26. Visit ExecutiveBiz.com to sign up for the “Supply Chain Cybersecurity: Revelations and Innovations” event.

Deputy Attorney General Lisa Monaco has announced a new fellowship program at the Department of Justice meant to train and build a pool of attorneys and prosecutors that could handle cybersecurity cases. The establishment of the program is one of the recommendations from a cyber review that Monaco ordered in May.

Under the three-year Cyber Fellowship program, the selected attorneys will have a chance to conduct investigations and prosecute ransomware attacks, state-sponsored cyberthreats, transnational criminal groups and use of cryptocurrency to fund cybercrimes, DOJ said Friday.

“We need to develop the next generation of prosecutors with the training and experience necessary to combat the next generation of cyber threats. This Fellowship gives attorneys a unique opportunity to gain the well-rounded experience they need to tackle the full range of those threats,” Monaco said.

The program will be based in Washington, D.C., and all incoming fellows must have a Top Secret security clearance. DOJ will accept applications for the Cyber Fellowship program’s first track via the Honors Program application portal through Sept. 8.

ExecutiveBiz, sister site of GovConDaily, will host a virtual event about securing the supply chain on Oct. 26. Visit ExecutiveBiz.com to sign up for the “Supply Chain Cybersecurity: Revelations and Innovations” event.

The FBI has identified a group of cyberthreat actors that has launched ransomware attacks against U.S. companies since November using Cobalt Strike software.

The OnePercent Group uses phishing emails with a malicious zip file attachment to infiltrate victims’ networks, installs Cobalt Strike using IcedID, encrypts and extracts data from the compromised system using rclone and observes the breached network for a month before deploying the ransomware, the bureau said Monday.

Victims will receive calls through spoofed phone numbers from the cybercrime group demanding ransom. The group will further communicate with victims by providing a ProtonMail email address and its extortion tactics starts with a warning. If an organization fails to immediately pay the ransom, the warning will progress to a partial leak and then to a full leak of extracted data.

The FBI listed indicators of compromise and applications used by the actors to execute ransomware attacks.

The agency also recommended mitigation measures for organizations, such as backing-up critical data offline, keeping devices and applications patched, implementing Microsoft LAPS and network segmentation, auditing user accounts with administrative privileges and using multifactor authentication with strong passphrases.

ExecutiveBiz, sister site of GovConDaily and part of the Executive Mosaic digital media umbrella, will host a virtual event about securing the supply chain on Oct. 26. Visit ExecutiveBiz.com to sign up for the “Supply Chain Cybersecurity: Revelations and Innovations” event.