Growing cooperation between corporate boards and chief information security officers has strengthened cyber defense as looming regulations could demand greater accountability, experts tell Axios.

Driving the news: Publicly traded companies have spent the last year bracing for a proposed Securities and Exchange Commission rule that would require private companies to publicly report cyber incidents within four business days and detail companies' policies for responding.

• The rule, proposed last year, would also require an annual report on corporate boards' cybersecurity expertise. The SEC declined to comment on when the final rule is expected to be published.

The big picture: Boards have been grappling with a wave of ransomware attacks, data breaches, and additional cyber and privacy regulations in recent years.

• Those incidents have both forced board members to learn more about their companies' cyber risks and motivated top security officers to figure out how to better communicate with boards.
• Historically, boards have struggled to understand the threat landscape — prompting them to view security as an expendable cost and to use security officials as scapegoats after a major incident.

But that's starting to change: More than three-fourths of board directors say their board has at least one cyber expert, according to a Wall Street Journal survey released last month.

• Many of the largest publicly traded companies now have a former CISO, chief technology officer or government official on their board to help fill in the gaps, Phil Venables, CISO at Google Cloud, tells Axios.

What they're saying: "Cybersecurity is no longer just a back-office issue that is rarely talked about," Friso van der Oord, senior vice president of content at the National Association of Corporate Directors, tells Axios.

• "It can cause catastrophic damage to many organizations, and we've seen the volume of successful cyberattacks rise significantly," he says.

Between the lines: CISOs have gotten better at communicating their teams' priorities and the threat landscape to boards, Bob Maley, chief security officer at Black Kite, tells Axios.

• "Today, the best CISOs may not be the best hackers or the best technical people, but they're the best ones that can translate that technical language into the language of the board," Maley says.
• Whether boards and C-suites will be prepared for increased SEC requirements will depend on the relationship between them and their CISOs, Christopher Gray, vice president at cyber firm Deepwatch, tells Axios.

The intrigue: Unpredictable economic conditions have forced boards to become better acquainted with their cyber risks as they comb through their companies' budgets.

• "People are going to have to figure out what actually works for them, why and what they're going to have to cut," said Peiter "Mudge" Zatko, executive-in-residence at Rapid7 and recent Twitter security whistleblower, during the Verify conference last week.

Yes, but: While relationships have gotten better between boards and CISOs, there are still gaps they'll need to close to meet the SEC's expected demands.

• Smaller public companies that haven't focused on cybersecurity will most likely need to re-evaluate who's on their board to guarantee they have the cyber expertise the SEC will be looking for, Venables says.
• More than two in five IT and security professionals said in a survey released this week by BitDefender that they've been told to keep an ongoing breach quiet, even if it should actually have been disclosed.

A group of cybersecurity companies, including Microsoft, has launched a full-scale legal crackdown against one of the top hacking tools malware groups use in their attacks.

Driving the news: Microsoft, software maker Fortra and the Health Information Sharing and Analysis Center (Health-ISAC) unveiled a wide-reaching legal plan Thursday to tackle malicious versions of Fortra's Cobalt Strike and Microsoft's software development kits.

Why it matters: Cobalt Strike is a widely used penetration testing tool that allows organizations to test their security defenses before an attack. However, malicious hackers have relied on a manipulated version of the tool for years to launch devastating ransomware attacks and other incidents.

• The Department of Health and Human Services warned health care organizations in November 2021 that both state-backed hacking and cybercriminal groups had been relying on the tool in their attacks.
• That same year, the now-defunct Conti ransomware gang also attempted to use Cobalt Strike to deploy malware against Ireland's publicly funded health care system.

Details: On Friday, the U.S. District Court for the Eastern District of New York issued a court order to the organizations allowing them to seize domains where malicious actors have been storing and sharing malicious versions of Cobalt Strike.

• The court order allows Microsoft, Fortra and Health-ISAC to automatically notify and take down IP addresses in the U.S. that are hosting manipulated versions of these tools. Those takedowns will start today, and the court order allows for future takedowns as criminals develop new infrastructure.
• Microsoft will also notify hosting providers in Latin America and the European Union on Thursday about domains it believes are hosting tainted versions of Cobalt Strike.
• Microsoft and Fortra also received a temporary restraining order against those violating the copyright of their programs to make it easier for them to seize and shut down malicious versions of the software.

Go deeper

The U.S. Justice Department announced Wednesday that the FBI and its international partners have seized notorious cybercrime marketplace Genesis Market.

Why it matters: Malicious actors often use marketplaces like Genesis Market to buy and sell stolen passwords and other login credentials that can help other malicious actors in future data breaches.

• Because users often reuse usernames and passwords across accounts, these stolen credentials make it easy for malicious hackers to access data beyond the organization that was originally hacked.

The big picture: Wednesday's announcement followed several law enforcement efforts that prompted shutdowns of major dark web marketplaces in the last year — including the seizure of Hydra Market exactly a year ago and the arrest of BreachForums' top administrator last month.

• 45 FBI field offices and law enforcement partners in a dozen countries, including the U.K., Italy, Denmark, Australia, Canada and Romania, assisted in the investigation.

Details: Since March 2018, Genesis Market had facilitated the sales of data stolen from more than 1.5 million computers, including login credentials associated with more than 80 million accounts, the DOJ estimates.

• Genesis Market also sold so-called device fingerprints, which provide a combination of someone's device identifiers and browser cookies to circumvent anti-fraud detection software.
• Law enforcement officials seized 11 domain names used to keep Genesis Market online as part of an FBI investigation dubbed "Operation Cookie Monster."
• The FBI handed over the stolen login credentials obtained during the investigation to the website Have I Been Pwned, which helps people track whether their information has been exposed during data breaches.
• The U.S. Treasury Department also placed sanctions on Genesis Market on Wednesday that bar U.S. people and entities from conducting transactions on the site.

Between the lines: The action follows federal law enforcement's existing strategy to not only target the perpetrators of high-profile cyberattacks, including ransomware gangs, but also the tools and internet infrastructure they rely on.

Go deeper

@ D.C.

🤖 A top U.S. cyber official warned that cybersecurity threats tied to generative AI will be "the biggest issue that we're going to deal with this century." (The Record)

🚨 A watchdog for the U.S. Labor Department said in a memo this week that there are "urgent equity and security concerns" tied to the use of facial recognition in unemployment insurance programs. (Nextgov)

@ Industry

👀 Nearly all companies had a cyber incident last year, according to Sophos. (Cybersecurity Dive)

💸 Venture capital investments in cyber companies in Q1 dipped to the lowest levels since 2020. (Metacurity)

📲 Alcohol recovery startups Monument and Tempest sold users' personal information and health data to advertisers for years without consent. (TechCrunch)

@ Hackers and hacks

❌ A presumed hacktivist group took down the websites associated with Israel's largest universities and cyber firm Check Point. (Jerusalem Post)

🚔 Spanish police arrested a 19-year-old hacker in connection with the cyberattacks last fall against Spain's General Council of the Judiciary. (The Record)

🫗 A ransomware gang leaked the second batch of data stolen during an attack on Oakland's government. (Engadget)

Sorry I missed y'all earlier this week — I spent some well-earned days exploring the California coast (or at least the parts that were still open after this season's rain), and boy, was it beautiful!