Sentar has secured the license to use Idaho National Laboratory’s consequence-driven cyber-informed engineering process to enhance its cybersecurity services to government clients.

The partnership with INL allows Sentar to expand its real-time operational technology monitoring capabilities, the Huntsville, Alabama-based information technology services company said Tuesday.

As the first Department of Defense contractor to gain rights to the patented CCE methodology, Sentar intends to use the process to advance its cyber terrain mapping and other services to protect critical U.S. infrastructure.

CCE is considered as the initial phase of MissionValor, a threat intelligence and pattern analytics project created by the Department of Defense under the Small Business Innovation Research program. 

“[The CCE process] provides a starting point for the identification of mission-essential tasks and maps critical operational technology capabilities to assets and networks to mitigate high-consequence events,” Sentar Vice President Vincent Mihalik commented.

The Cybersecurity and Infrastructure Security Agency said suspected advanced persistent threat actors related to the Iranian government exploited the Log4Shell remote code execution vulnerability to compromise the network of a federal civilian executive branch organization.

CISA said Wednesday it released an advisory outlining indicators of compromise collected from the investigation of the suspected APT activity that targeted an unpatched VMware Horizon server to install crypto mining software.

The agency identified the APT activity on the organization’s network using the EINSTEIN intrusion detection system and found IOCs in its server.

From mid-June through mid-July, CISA conducted an incident response engagement and observed that the threat actors installed XMRig crypto mining software, moved to the domain controller, compromised credentials and distributed Ngrok reverse proxies across several hosts.

CISA unveiled the cybersecurity advisory in collaboration with the FBI to help network defenders detect and implement appropriate measures against related compromises.

The FBI, Secret Service and Cybersecurity and Infrastructure Security Agency should fortify their collaboration to fight the rising incidents of ransomware attacks on public and government institutions, the Government Accountability Office has instructed.

In a study published Wednesday, the GAO cited gaps in processes for assisting state, local, tribal, and territorial government organizations vulnerable to ransomware that put operations and services at greater risk.

Based on data from the Multi-State Information Sharing and Analysis Center, SLTTs reported approximately 2,800 ransomware attacks from Jan. 2017 to March 2021, the federal watchdog noted. It emphasized the importance of addressing such crimes in the government’s commitment to cybersecurity resilience.

To improve cyber ransom prevention and response, GAO recommended that FBI, CISA and the Secret Service bolster interagency coordination, and review the challenges identified by SLTTs in accessing federal assistance.

GAO also suggested the establishment of a coordinating council involving the Department of Education, K-12 schools, CISA and other concerned federal agencies. The recommendation is in light of research data showing that between 2018 and 2021, more than 1 million children were estimated to have been affected by cyber ransom threats, and took an average of two to nine months to recover from the incidents.