National

Axios Codebook

Director of the Cybersecurity and Infrastructure Security Agency Jen Easterly says one of its most robust public-private partnerships is building ways to help critical infrastructure operators get ahead of cyberattacks, rather than respond. 

Why it matters: The congressionally mandated Joint Cyber Defense Collaborative (JCDC) inside CISA has spurred new excitement among private tech and cybersecurity companies who previously weren’t keen on working with the federal government on cybersecurity issues.

Congress mandated CISA stand up the JCDC early last year to create an interagency hub where companies can work with the government to both plan for potential cyber threats and work together to respond to large-scale attacks.

What's happening: JCDC, which Easterly named after the rock band ACDC, marks its unofficial one-year anniversary this week as the Black Hat conference kicks off in Las Vegas. Easterly launched the collaborative at last year's event. 

JCDC has more than 20 tech and cybersecurity company members, including Microsoft, Google Cloud, CrowdStrike, Mandiant and Palo Alto Networks. Agency partners include the National Security Agency, the Pentagon's U.S. Cyber Command, the FBI and the Office of the Director of National Intelligence. 

JCDC members meet regularly about the latest cyber threats they're seeing — speeding up communication between the public and private sector as the number of threats mounts.

The big picture: After spending the first year mostly responding to large-scale attacks, the JCDC is ready to focus in on getting ahead of those attacks and establishing response plans.

They're planning exercises for critical sectors, including finance, energy and telecommunications, to help them test defenses before an actual hacking attempt. A CISA spokesperson said those exercises could include attack simulations and discussions about best practices.

 JCDC is also planning a similar initiative for pipeline operators and cybersecurity companies focused on critical infrastructure sectors. That exercise comes after the Transportation Security Administration rolled out new cyber rules for pipelines last month.

Easterly also said members of the JCDC have already started briefing state and local election security officials on the threats they're anticipating before the November midterms. 

Between the lines: The Biden administration's cyber offices have received criticism from some lawmakers who worry they're not focusing enough on preventing attacks and are spending too much time responding to threats. The JCDC's planning focus could help ease those concerns.

What they're saying: Easterly, a former Morgan Stanley cybersecurity executive and NSA official, told Axios the JCDC has transformed how the federal government approaches public-private partnerships. 

"We approach that partnership with humility," Easterly said. "Certainly, we don't have all the answers, and this is not a problem that the government can solve. It's something we all collectively have to come together to solve — and with a sense of gratitude." 

Easterly also said she has been surprised at how receptive the tech industry was to join JCDC, noting that she expected more hesitation about being able to trust the government.

Flashback: High-profile cyber issues like the discovery of the Log4j vulnerability last year that affects "hundreds of millions" of devices, and the cyber fallout from the war in Ukraine have also boosted the collaborative's effectiveness, Easterly said. 

What to watch: CISA is still firming up its midterm election strategy.

 Easterly said she can envision the agency standing up "some sort of channel" to share cyber threat information with state and local election officials — similar to how JCDC has shared info during Log4j and the war in Ukraine. 

CISA director plans proactive cybersecurity for at-risk companies

The Joint Cyber Defense Collaborative is marking its one year this week.

CISA Director Jen Easterly testifies before Congress

Cybersecurity and Infrastructure Security Agency Director Jen Easterly. Photo: Kevin Dietsch/Getty Images

Cybersecurity

Director of the Cybersecurity and Infrastructure Security Agency Jen Easterly says one of its most robust public-private partnerships is building ways to help critical infrastructure operators get ahead of cyberattacks, rather than respond. Why it matters: The congressionally mandated <a class="gtmContentClick" data-vars-link-text="Joint Cyber Defense Collaborative (JCDC) inside CISA " data-vars-click-url="https://www.cisa.gov/jcdc" data-vars-content-id="326a987f-af9b-4036-a0f0-c5cb6dbcc50e" data-vars-headline="CISA director plans proactive cybersecurity for at-risk companies" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.cisa.gov/jcdc" target="_blank">Joint Cyber Defense Collaborative (JCDC) inside CISA </a>has spurred new excitement among private tech and cybersecurity companies who previously weren’t keen on working with the federal government on cybersecurity issues.

From the Valley to D.C., Big Tech players like Facebook, Google and Amazon are under more scrutiny than ever as new technology develops and privacy and antitrust concerns grow in lockstep with companies’ ambitions.

Technology

Twitter said Friday that a security flaw in its system allowed a hacker to collect the phone number and email address information associated with some user accounts. 

Why it matters: Twitter said the security flaw was on its system for six months before it was discovered in January 2022,  potentially exposing the information tied to pseudonymous accounts — some of which may have belonged to whistleblowers, human rights activists and other dissidents.

Details: The flaw in Twitter’s systems allowed hackers with access to submit an email address or phone number and see if it was associated with an existing account. 

Twitter patched the flaw in January, but Friday’s announcement acknowledges that at least one hacker took advantage of the flaw before then. 

Last month, Twitter said, it became aware through a news report that the hacker was selling that information on the dark web. 

While the company didn’t say which news report, BleepingComputer reported in July that someone was selling information from 5.4 million Twitter users — collected through the same flaw — for $30,000.

Between the lines: This breach could be a huge problem for people who rely on pseudonymous accounts to remain safe online. Many human rights activists, government dissidents and journalists commonly use fake names online to avoid government surveillance and retaliation.

What’s next: Twitter said it plans to notify the account owners it can confirm were affected by the breach, but the company isn’t able to “confirm every account that was potentially impacted.” 

Twitter recommends that people who rely on pseudonymous accounts remove their known phone numbers and email address from their accounts. 

Twitter admits breach that exposed phone numbers, email addresses

Twitter said a security flaw allowed a hacker to collect users' phone numbers and email addresses.

Illustration of the twitter bird logo as an open padlock

Twitter <a class="gtmContentClick" data-vars-link-text="said Friday" data-vars-click-url="https://privacy.twitter.com/en/blog/2022/an-issue-affecting-some-anonymous-accounts" data-vars-content-id="ce44be6f-36d3-49e7-9018-9774e326c891" data-vars-headline="Twitter admits breach that exposed phone numbers, email addresses" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://privacy.twitter.com/en/blog/2022/an-issue-affecting-some-anonymous-accounts" target="_blank">said Friday</a> that a security flaw in its system allowed a hacker to collect the phone number and email address information associated with some user accounts. Why it matters: Twitter said the security flaw was on its system for six months before it was discovered in January 2022, potentially exposing the information tied to pseudonymous accounts — some of which may have belonged to whistleblowers, human rights activists and other dissidents.

The Department of Homeland Security rolled out new cybersecurity rules for pipeline owners and operators Friday — marking a win for the pipeline industry, which spent the last year criticizing the directive that these new rules replace.

Why it matters: The pipeline business is among those with the strictest cybersecurity regulations, and agencies for other industries are following this saga closely before drafting their own cyber regulations. 

Driving the news: The Transportation Security Administration, which is part of DHS, issued its first set of cybersecurity rules last year following the ransomware attack on the Colonial Pipeline that shut it down for several days.

But operators quickly pushed back, arguing that many of the new rules didn’t account for the intricacies of their physical infrastructure and could prompt further disruptions in pipeline operations. 

Details: The new rules place more emphasis on the security outcomes TSA wants from operators, rather than the processes operators should enact to achieve those goals.

What they’re saying: “We recognize that every company is different, and we have developed an approach that accommodates that fact, supported by continuous monitoring and auditing to assess achievement of the needed cybersecurity outcomes,” TSA Administrator David Pekoske said in a statement. 

“TSA has absolutely recognized that, in some instances, outcomes are better suited to mitigate a potential cyberattack than the prescriptive approach,” Jim Guinn, senior managing director of Accenture’s cyber business, told Axios.

Yes, but: Cybersecurity consultants who work with pipeline operators told Axios there’s still some room for improvement as the new rules go into effect. 

Guinn said the rules lack any requirements for pipeline owners and operators to create inventories for the tools and technology they utilize, which could make it harder for them to know what security risks they’re vulnerable to. 

What’s next: TSA’s new rules go into effect for one year on July 27. The agency then plans to accept comments from the industry as  it starts a formal agency rule-making process for permanent rules.

DHS rework of pipeline cybersecurity rules placates industry

The new rules replace those put in effect after the Colonial Pipeline ransomware attack.

Animated illustration of a cursor sawing a pipe in half. 

The Department of Homeland Security rolled out <a class="gtmContentClick" data-vars-link-text="new cybersecurity rules for pipeline owners and operators" data-vars-click-url="https://www.tsa.gov/sites/default/files/tsa_sd_pipeline-2021-02-july-21_2022.pdf" data-vars-content-id="f145204b-6007-4699-a985-10994695c887" data-vars-headline="DHS rework of pipeline cybersecurity rules placates industry" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.tsa.gov/sites/default/files/tsa_sd_pipeline-2021-02-july-21_2022.pdf" target="_blank">new cybersecurity rules for pipeline owners and operators</a> Friday — marking a win for the pipeline industry, which spent the last year criticizing the directive that these new rules replace.Why it matters: The pipeline business is among those with the strictest cybersecurity regulations, and agencies for other industries are following this saga closely before drafting their own cyber regulations.

Several Taiwanese government websites went offline on Tuesday as House Speaker Nancy Pelosi landed in the country for her controversial visit. 

Why it matters: Although the website outages haven’t been attributed, Chinese state hackers have been known to retaliate through low-level distributed denial of service attacks, which overwhelm a site with abnormally high traffic until it shuts down. The Chinese government has also warned that Pelosi’s visit would prompt “strong and resolute measures” in response.

Details: The websites for President Tsai Ing-wen, the Ministry of National Defense, the Ministry of Foreign Affairs and the Taiwan Taoyuan International Airport have been inoperable at times throughout the day.

Chang Tun-Han, a spokesperson for Taiwan’s presidential palace, said in a statement posted to Facebook that the president’s official website was “attacked by an overseas DDoS attack.” Website traffic reached 200 times that of a typical day, Tun-Han said, resulting in a 20-minute shutdown. 

Access to the Ministry of Foreign Affairs, military and airport’s websites continued to be spotty throughout Tuesday as they recover from the suspected DDoS attack.  

The bigger picture: DDoS attacks have become a go-to tool for both state-sponsored hackers and activist hackers in political conflicts. They send a clear message that a country or political group is upset, but they typically aren’t destructive enough to spur retaliation from the targeted organizations. 

Before Russian forces invaded Ukraine, Russian hackers took down the websites belonging to Ukrainian banks and government institutions. 

Why Pelosi's Taiwan visit matters to China

Pressure grows for Taiwan to boost its defense force

Taiwanese seek civil defense training after Russia's invasion of Ukraine

Taiwanese government websites go down during Pelosi’s visit

The outages haven’t been attributed​, but Beijing has warned of a ​“strong and resolute" response to the visit.

The Taipei 101 skyscraper displays a welcome message ahead of House Speaker Nancy Pelosi's arrival on Aug. 2. in Taipei. Photo: Annabelle Chih/Getty Images

Taiwan

Several Taiwanese government websites went offline on Tuesday as House Speaker Nancy Pelosi <a class="gtmContentClick" data-vars-link-text="landed in the country" data-vars-click-url="https://www.axios.com/2022/08/02/pelosi-taiwan-visit-china-threats-biden" data-vars-content-id="fca669c3-de81-41f7-b598-878337a7853f" data-vars-headline="Taiwanese government websites go down during Pelosi’s visit" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.axios.com/2022/08/02/pelosi-taiwan-visit-china-threats-biden" target="_self">landed in the country</a> for her controversial visit. Why it matters: Although the website outages haven’t been attributed, Chinese state hackers have been known to retaliate through low-level distributed denial of service attacks, which overwhelm a site with abnormally high traffic until it shuts down. The Chinese government has also warned that Pelosi’s visit would prompt <a class="gtmContentClick" data-vars-link-text="“strong and resolute measures” in response." data-vars-click-url="https://www.axios.com/2022/07/19/china-pelosi-taiwan-visit" data-vars-content-id="fca669c3-de81-41f7-b598-878337a7853f" data-vars-headline="Taiwanese government websites go down during Pelosi’s visit" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.axios.com/2022/07/19/china-pelosi-taiwan-visit" target="_self">“strong and resolute measures” in response.</a>

The White House’s Office of the National Cyber Director has named Google executive Camille Stewart Gloster as a deputy national cyber director focused on workforce programs and supply chain security issues, according to an administration official familiar with the hire.

The big picture: Stewart Gloster’s hire comes as the one-year-old National Cyber Director’s office continues to fill out its roughly 50-person staff. In May, CNN reported that the office had hired a former Microsoft executive, a CIA official and a National Security Council member to deputy director positions.

Driving the news: National cyber director Chris Inglis pledged at a White House cyber workforce summit last week to develop a formal national cyber workforce and education strategy, and Stewart Gloster is expected to lead those efforts, the official said. 

Details: Stewart Gloster starts Aug. 1 as the deputy national cyber director for technology and ecosystem security.

Most recently, she was the global head of product security strategy at Google. 

Stewart Gloster was also a senior policy adviser at the Department of Homeland Security during the last few years of the Obama administration.

Of note: She is known in the cybersecurity world for her initiative #ShareTheMicinCyber, which she started with Lauren Zabierek, executive director of the Cyber Project at Harvard Kennedy School's Belfer Center, to help spotlight diverse voices in the cybersecurity industry across social media.

What they’re saying: “It is truly an honor to return to public service under Director Inglis’s leadership, and I know, as an organization, we will work tirelessly to bring to bear our greatest resource — the diversity of the American people — to better understand and secure the socio-technical environment and make cyberspace reflect the values and ambitions we hold for it,” Stewart Gloster told Axios in a statement. 

Exclusive: White House cyber office taps Google exec

Camille Stewart Gloster will focus on workforce programs and supply chain security.

Photo of Camille Stewart Gloster in a white jacket leaning against a railing

The White House’s Office of the National Cyber Director has named Google executive Camille Stewart Gloster as a deputy national cyber director focused on workforce programs and supply chain security issues, according to an administration official familiar with the hire.The big picture: Stewart Gloster’s hire comes as the one-year-old National Cyber Director’s office continues to fill out its roughly 50-person staff. In May, CNN <a class="gtmContentClick" data-vars-link-text="reported that the office" data-vars-click-url="https://www.cnn.com/2022/05/10/politics/white-house-cyber-office-kemba-walden/index.html" data-vars-content-id="feb74915-3581-44e0-ba96-83f7d2a8cb09" data-vars-headline="Exclusive: White House cyber office taps Google exec" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.cnn.com/2022/05/10/politics/white-house-cyber-office-kemba-walden/index.html" target="_blank">reported that the office</a> had hired a former Microsoft executive, a CIA official and a National Security Council member to deputy director positions.

Sections

Axios Local

Axios gets you smarter, faster with news & information that matters.

About

Subscribe

Sam Sabin

Stories

CISA director plans proactive cybersecurity for at-risk companies

Twitter admits breach that exposed phone numbers, email addresses

Taiwanese government websites go down during Pelosi’s visit

Exclusive: White House cyber office taps Google exec

DHS rework of pipeline cybersecurity rules placates industry