Chris Inglis, a commissioner on the Cyberspace Solarium Commission and former deputy director of the National Security Agency (NSA), said ensuring digital literacy and critical thinking skills among employees with cyber space interaction is vital, FCW reported Wednesday. 

"So what we're speaking about is, how do we invest sufficient education for purposes of realizing our expectations and aspirations in cyberspace, not merely the important but narrower discipline of cybersecurity," Inglis said Tuesday at an Intelligence and National Security Alliance-hosted event. 

He noted that educators, lawyers and other individuals involved in other disciplines should have additional training when it comes to the use of digital infrastructure in their work. Inglis also cited the need to streamline the transfer of employees between the federal government and private sector. 

“At the end of the day, we still have a federal government that has a complex, uneven and stovepipe system that's difficult to navigate, sets up underlaps, creates haves and have-nots and creates unhealthy competitions," Inglis said. 

“So the question at the end of the day is: what do we do to take advantage of those enormous strengths that are unfortunately stove piped and move forward not simply for the benefit of the federal government, but for the nation writ large.”

The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) are warning that advanced persistent threat (APT) actors are exploiting vulnerabilities in internet-facing devices and remote connections and using spear phishing emails to access networks of U.S. think tanks.

“Increased telework during the COVID-19 pandemic has expanded workforce reliance on remote connectivity, affording malicious actors more opportunities to exploit those connections and to blend in with increased traffic,” the advisory reads. 

The advisory from CISA and the bureau listed several tactics, techniques and procedures APT actors used to target think tanks, including defense evasion and privilege escalation techniques and those used to gain initial and credential access. 

The two agencies advised users at think tanks to be aware of tailored spear phishing attacks, log off remote connections when not in use and use different passwords for personal and corporate accounts, among others. 

Cybersecurity and information technology professionals at think tanks should also take steps, such as segregating and segmenting networks and functions, implementing multifactor authentication for corporate accounts and fielding antivirus software on organizational devices.