Ice Miller Cybersecurity Law Snapshot: Russian Aggression Heightens Cybercrime Alert Level – Technology

Russia's unprovoked invasion of Ukraine and the
subsequent widespread sanctions and condemnation by
leaders across the world, including the United States and NATO
allies, have raised concern about Russian retaliation using cyberwar
tactics. Both in the private and public sectors, cybersecurity experts
encourage increased vigilance. The federal government is responding
to this increased threat by advocating for safer cybersecurity
habits through the Cybersecurity and Infrastructure Security
Agency's (CISA) "Shields Up" Program, promoting new ransomware response
guidance, restructuring crucial elements of the
internet backbone to strengthen security, and by legislatively enforcing mandatory
reporting timelines.

The Risk to the Private Sector – What You Can Do to
Prepare

From SolarWinds to Colonial Pipeline, Russian-connected threat
actors have demonstrated the capability to wreak havoc on the
private and public sectors. Cybersecurity experts have been
monitoring increased nation-state activity during the ongoing
conflict in Ukraine. Hefty U.S. sanctions imposed on Russia could
make the United States a top target of Russian cyberattacks,
particularly if additional U.S. measures impact energy exports, the
main source of hard currency for Russia. These threats may come in
the form of ransomware locking down personal or business systems,
or through more complex infrastructural attacks targeting internet
access, financial systems, or even the power grid. Cybersecurity
experts and CISA are encouraging businesses and
consumers to practice good "cyber hygiene," such as:

• Implementing multifactor authentication, which mitigates the
  weakness of password-only security based systems;
• Ensuring software and firmware are up-to-date
  on all devices, especially anti-virus and
  anti-malware software and web browsers;
• Enforcing strong password policies and encouraging password
  changes on a regular basis;
• Increasing vigilance for highly complex phishing attacks and
  implementing a "think before you click" approach;
  and
• For Ukrainian-connected organizations, monitoring and
  responding to incidents on their network, and isolating any traffic
  coming from Ukraine.

NIST Ransomware Response Guidance

The propensity of Russian threat actors using ransomware as a
preferred method of attack should encourage entities to implement
robust risk management and response plans. The National Institute
of Standards and Technology (NIST) published a quick start guide to aid organizations in
their use of the NIST Ransomware Risk Management Cybersecurity
Framework Profile. This guide and the broader framework profile
mirror the NIST Cybersecurity Framework (which aids organizations
in managing and reducing cybersecurity risks) in its core
cybersecurity functional approach, while also offering guidance
specific to ransomware threats. The Framework is organized by five
key functions:

• Identify – Develop an
  organizational understanding to manage cybersecurity risks to
  systems, assets, data, and capabilities.
• Protect – Develop and implement the
  appropriate safeguards to ensure delivery of services.
• Detect – Develop and implement the
  appropriate activities to identify the occurrence of a
  cybersecurity event.
• Respond – Develop and implement the
  appropriate activities to take action regarding a detected
  cybersecurity event.
• Recover – Develop and implement the
  appropriate activities to maintain plans for resilience and to
  restore any capabilities or services that were impaired due to a
  cybersecurity event.

FCC Encourages Increased Security Measures 

The Federal Communications Commission (FCC) unanimously approved a notice of inquiry
for secure use of the internet's global routing system, the
Border Gateway Protocol (BGP), in light of Russia's aggression.
This inquiry will focus on vulnerabilities of the internet's
global routing system and will also examine the potential impacts
that these vulnerabilities can have on the transmission of data
through email, e-commerce, bank transactions, interconnected
Voice-over Internet Protocol, and other electronic transmission
sources. Known vulnerabilities surrounding the BGP already exist,
some of which Russian-connected threat actors have exploited,
including the ability to manipulate the BGP to execute a
distributed denial of service attack ("DDoS attack") and
to reroute and steal data. The inquiry notes a range of measures that NIST, the Internet
Engineering Task Force, and the FCC have recommended. Such
measures, however, have not been uniformly adopted. This is an
important inquiry to monitor as network operators may soon face
increased security requirements, including heightened security
standards known as "BGPsec," in order to mitigate
critical vulnerabilities.

Senate Passes the Strengthening American Cybersecurity Act

With the growing threat of Russian cyberattacks, the
Senate expedited its approval of the Strengthening American Cybersecurity Act. If
enacted, the Act will impose rapid reporting deadlines for critical
infrastructure operators and federal agencies. This legislation
would impact companies across 16 federally designated critical
infrastructure sectors, including energy and financial services. It
includes the following paraphrased provisions:

• Critical infrastructure operators and federal agencies must
  report cyberattacks within 72 hours and
  ransomware payments within 24 hours to
  CISA. These reporting obligations also require prompt submission of
  supplemental reports until the incident is fully resolved.
• Current federal cybersecurity laws would be updated to enhance
  coordination between federal agencies.
• All federal civilian agencies would be required to report any
  substantial cyberattacks to CISA.
• The Federal Risk and Authorization Program (FedRAMP) will be
  given a five-year authorization to ensure federal agencies are able
  to adopt cloud-based technologies.

The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.