The National Cybersecurity Center of Excellence has released an initial public draft of “Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile” and is calling for feedback on the publication.

Managing Ransomware Threats

Also known as NIST Interagency Report 8374, the publication is meant to help readers evaluate whether their organization is prepared to counter ransomware threats, mitigate the effects of a ransomware event and develop a ransomware countermeasure playbook, the National Institute of Standards and Technology said Monday.

The publication, which was developed with the help of industry partners, can also be used by readers to identify areas where they could improve their organizations’ defenses against ransomware.

NIST IR 8374 reflects changes to Cybersecurity Framework 1.1 that are now part of CSF 2.0. These changes include objectives that support the management, detection, response to and recovery from ransomware events.

Input From the Public

Concerning public feedback, NIST is interested in determining which parts of the publication are helpful and which need to be improved. Of particular interest to NIST is determining which types of prioritization and control baselines are helpful.

The agency is also interested in finding out about other resources related to ransomware risk mitigation.

Interested parties have until March 14 to provide feedback. Respondents may also provide general feedback regarding the publication.

The National Security Agency, together with the Cybersecurity and Infrastructure Security Agency and other partner organizations, has issued a guidance to assist operational technology owners and operators in selecting secure OT products.

Cybersecurity Information Sheet

The NSA said Monday the Cybersecurity Information Sheet, called “Secure by Demand: Priority Considerations for Operational Technology Owners and Operators in the Selection of Digital Products,” outlines significant security elements needed to purchase OT products such as industrial automation and control systems. The CSI also includes questions to ask manufacturers.

Many OT products don’t have inherent security features or were not developed securely. These products are usually vulnerable to cyberattacks due to weak authentication, shared software weaknesses, limited logging, default settings, default protocols and default credentials.

According to the CSI, OT owners and operators should select products that feature vital security elements, such as:

• Configuration management
• Logging in the baseline product
• Open standards, ownership
• Protection of data
• Secure by default
• Secure communications
• Secure controls
• Strong authentication
• Threat modeling
• Upgrade tooling
• Vulnerability handling

Aside from NSA and CISA, the other partner organizations include the FBI, Department of Energy, Environmental Protection Agency, Transportation Security Administration, European Commission, Australian Signals Directorate’s Australian Cyber Security Centre, Canadian Centre for Cyber Security, Germany’s Federal Office for Information Security, Netherland’s National Cyber Security Centre, New Zealand’s National Cyber Security Centre and the United Kingdom’s National Cyber Security Centre.

Dave Luber, director of cybersecurity at NSA, said, “The guidance not only helps owners and operators of critical systems secure their OT procurement lifecycles, it also sends a message to manufacturers to establish a more resilient and flexible cybersecurity foundation in their products.”

The Cybersecurity and Infrastructure Security Agency has reported significant progress in improving critical infrastructure cybersecurity and resilience since the implementation of its cross-sector Cybersecurity Performance Goals. The agency on Friday published the results of its analysis of 7,791 critical infrastructure organizations enrolled in its vulnerability scanning service from 2022 through 2024.

The CPG, issued in October 2022, is a set of voluntary practices designed to empower critical infrastructure operators to defend their networks against cyberthreats. The CPG offers guidance for organizations that may lack the knowledge and resources to adopt tools or roll out programs that could strengthen their network resilience. 

CISA Shares Cyber Hygiene Enrollment Rate

CISA’s Cyber Hygiene service enrollment rate over the past two years increased by 201 percent. The communications sector saw the largest enrollment jump at 300 percent, with enrollments across emergency services, critical manufacturing, and water and wastewater system sectors also seeing over 200 percent growth. 

Improved Cybersecurity Across US Critical Infrastructure Sector

One of the progress points the agency shared in the report is the decline in known exploited vulnerabilities, or KEVs, among entities enrolled in the government’s vulnerability scanning service. Since 2022, the average number of KEVs in assets accessible to the internet among critical infrastructure organizations declined. The trend shows that companies are prioritizing the remediation of network flaws based on CISA’s KEV catalog. 

The agency also saw improvements in Secure Sockets Layer misconfigurations, which decreased on average from 3.8 in the first 11 months of the CPG implementation to 2.5 in the past 12 months. 

Also highlighted in the report the persistence of operational technology protocols exposed to the internet. The government, according to the agency, accounts for the highest OT/Industrial Control System protocols exposed to the public internet at 63 percent. IT, energy, healthcare and public health, and financial services make up the top five of the sectors with the highest occurrences.