SEC Updates Guidance on Cyber Disclosures

The SEC updated its guidance for how public companies should handle not only actual cyber incidents, but also the risk of such events. Two quotes below summarize the basics of the new guidance, while the full statement from the SEC is attached at the bottom of this post.  Also attached is the 2011 guidance, which this new update builds upon.

  • “Given the frequency, magnitude and cost of cybersecurity incidents, the Commission believes that it is critical that public companies take all required actions to inform investors about material cybersecurity risks and incidents in a timely fashion, including those companies that are subject to material cybersecurity risks but may not yet have been the target of a cyber-attack.”
  • “While the Commission continues to consider other means of promoting appropriate disclosure of cyber incidents, we are reinforcing and expanding upon the staff’s 2011 guidance. In addition, we address two topics not developed in the staff’s 2011 guidance, namely the importance of cybersecurity policies and procedures and the application of insider trading prohibitions in the cybersecurity context.”

2018 Guidance

Commission Statement and Guidance on Public Company Cybersecurity Disclosures 33-10459

2011 Guidance

CF Disclosure Guidance_ Topic No. 2 - Cybersecurity

Tags:

Cyber Round Up: Evaluating ‘Active Cyber Defence’; UK Blames Russia for NotPetya; Intel Makes Quantum Breakthrough

  • Evaluating the U.K.’s ‘Active Cyber Defence’ Program (Lawfare): A post last week on Lawfare recaps the U.K.’s cyber defense program a year after its implementation. The article summarizes the U.K.’s National Cyber Security Centre’s own report while explaining aspects that could be useful for the U.S.  The three main themes of the program, according to the post, are government-centered action, intervention, and transparency. While the first year generally shows some success and some themes should be adopted by the U.S., it is not a silver bullet, the article says. The full post can be read here.
  • The US and UK say Russia was behind the huge NotPetya ransomware attack (MIT Tech Review): A post on “The Download” says that the British government attributed a major cyber attack in 2017 directly to Russia, a move that the post labeled “rare.” The NotPetya was a ransomware attack based on a Windows flaw that affected computers worldwide. The post says that the White House later agreed with the British government that Russia was responsible. The full post is here.

  • Intel Touts New Quantum Computing Breakthrough, This Time With Silicon (Extreme Tech): A recent article explains how the often relied upon silicon has finally been adapted to quantum computing. The article explains how Intel entered the silicon qubit game with game with what it calls the “spin qubit.” This is one of two parallel tracks that Intel is pursuing in the development of quantum computing, the article says. The article has a video to show exactly what Intel is doing and also explains how it differs from what other companies such as IBM are doing. The full article can be read here.

Tags: , , , ,

The Difference Between Cyber and Information Warfare

“All warfare is based on deception. Hence, when we are able to attack, we must seem unable; when using our forces, we must appear inactive; when we are near, we must make the enemy believe we are far away; when far away, we must make him believe we are near.”
― Sun Tzu, The Art of War

On Friday, February 16, 2018, Deputy Attorney General Rod Rosenstein announced the indictment of 13 Russian officials related to Russian meddling in the 2016 Presidential election. The first charge, conspiracy to defraud the United States, is against all thirteen defendants. Specifically, “[t]he defendants allegedly conspired to defraud the United States by impairing the lawful functions of the Federal Election Commission, the U.S. Department of Justice, and the U.S. Department of State . . .” Other charges include conspiracy to commit wire fraud and bank fraud and aggravated identify theft. The full press release and the indictment are attached at the bottom of this post.

In his statement, Rosenstein explained that the Russians defined their operation as “information warfare.” The use of that phrase reminded me of an important distinction that was first brought to my attention this past fall – the distinction between cyber warfare and information warfare.

General Michael Hayden, former director of both the CIA and NSA, spoke at Syracuse University on Russia-U.S. relations in October.[i] In particular, Hayden focused on Russia’s interference in the 2016 Presidential elections and how those acts fit within Russia’s broader scheme of information warfare.

To provide context for Russia’s policies, Hayden explained the policy making process in the U.S, which he was a part of, when the U.S. was trying to define its own role in cyber space. At that time, the decision makers weighed two options. Option One was to focus on just cyber and try to “dominate” that sphere. Option Two was to enter the world of information warfare – a much more expansive and daunting task. Information warfare includes psychological warfare, disinformation, deception, and public diplomacy. The U.S. chose Option 1 while Russia chose Option 2.

In light of recent events, one must question whether that position is still the correct one today. Should the U.S. expand its capabilities in the cyber domain to include those related to information warfare? If the answer is yes, then who should be responsible for conducting those operations?

Continue reading

Tags:

Worldwide Threat Assessment of the U.S. Intelligence Community

Below is a Statement for the Record given by Director of National Intelligence Daniel R. Coats to Congress on February 13, 2018 regarding the U.S. intelligence community’s worldwide threat assessment, including a section dedicated to cyber security.

2018-ATA---Unclassified-SSCI

Tags:

Cyber Round Up: $3.3 Billion for DHS Cyber; Olympic Cyber Attack; AI and Cyberwar

  • Trump requests $3.3B for DHS cyber unit in 2019 (The Hill): President Trump’s latest request to Congress includes massive allocations for DHS and cybersecurity, a recent article explains. The report says that the $3.3 billion is largely consistent with last year’s numbers. The article provides some breakdown of that $3.3B, including $700 million for the National Protection and Programs Directorate which is responsible for protecting federal systems and critical infrastructure. The request also stresses increased cyber funding and pulls money from other projects to support that goal, according to the article. The full article can be read here.

  • Olympic officials: Winter Games hit with cyber attack during opening ceremony (USA Today): Reports from South Korea say that the Olympics were the victim of a cyber attack during the opening ceremonies. An article summarizing the event did not contain many details but suggested that the only intent of the attacks was to distract from the ceremonies, not to steal information. The article said that organizers did not know the source of the attack but had identified the type of malware used. The full report can be read here.

  • Artificial Intelligence Is The Weapon Organizations Need To Win The Cyber War (Forbes): Chris Petersen, LogRhythm’s Chief Technology Officer (CTO) and Senior Vice President (SVP) of Research and Development, wrote a article for Forbes explaining the potential role of Artificial Intelligence in leveling the playing field in data security and cyber war.  The article identifies the many ways that hackers have the advantage over those trying to secure their data. It offers AI as a way to move closer to obtaining good cyber hygiene with a reduced cost. The full article can be read here.

Tags:

Cybersecurity Demand and Syracuse University

Last week, for the second year in a row, Syracuse University topped the list of best cybersecurity programs in the country for veterans and military connected students. The list is compiled by Military Times, and more about how it is complied can be found here. The article explains SU’s commitment to providing online cybersecurity degrees. It also includes analysis from Syracuse Professor Shiu-Kai Chin on the versatility of cyber degrees, explaining that “all kinds of industries depend on cybersecurity skills — the Defense Department and other government agencies, of course, but also companies that work in financial services and critical infrastructures like power and water.”

The benefits of Syracuse’s cyber programs extend well beyond those with military connections. For instance, Syracuse University College of Law offers courses in Computer Crimes and Cybersecurity Law and Policy. In collaboration with two other schools on campus, the College of Law also offers a Smart Grid course focusing not just on security but also on the privacy and economic issues related to “smart” infrastructure.

The Institute for National Security and Counterterrorism, a joint venture between the College of Law and the Maxwell School of Citizenship and Public Affairs, has worked closely with the NATO Cooperative Cyber Defence Center of Excellence since 2015. Since then, faculty and staff have contributed insight as to how to reform law in this realm. Additionally, the College of Law hosted an interdisciplinary workshop in 2015 titled “Controlling Economic Cyber Espionage,” the details of which can be found here.

The College of Engineering offers both an on campus and an online version of its Master of Science in Cybersecurity degree.  That school also offers a Certificate of Advanced Study in Cybersecurity and an interdisciplinary Certificate of Advanced Study in Public Infrastructure Management and Leadership with the Maxwell School.

Syracuse’s School of Information Studies, the “iSchool” offers an on campus and online Certificate of Advanced Study in Information Security Management.  The National Security Agency has designated Syracuse as a Center of Academic Excellence in Information Assurance for both Education and Research in past years.

Much of Syracuse’s strength in the field comes from its ability to leverage an interdisciplinary approach in all of its programs. Students can approach the field from all angles — law, policy, national security, data security and integrity, and from the technical standpoint of the computer science and engineering programs.

We think these educational initiatives are very important for students and our country.  If you want to share information about other interdisciplinary cyber security programs at other schools, please add a comment below this post or write to us.

Tags: , ,

DOJ charges 36 in global cyber crime ring takedown

Several recent reports, including one from The Hill, summarize recent news from the Department of Justice regarding its takedown of a major international cyber crime ring. 36 total individuals were were charged, 13 of which have already been arrested the article says. Five of those thirteen were Americans. The operation was known as “Infraud” and allegedly “facilitated the sale of stolen identities, credit card data, financial information, Social Security numbers and other personally identifiable information.”  Authorities estimate that the operation netted over $500 million in profits. The full article can be found here.

The full press release from the DOJ and the indictment are included below. Both of those can also be found here.

news release

infraud_superseding_indictment_0

Tags:

Cyber Round Up: Trusting Drones; Drones and Cyberwar; Cyber Diplomacy

  • Trust, Confidence, and the Future of Warfare (War on the Rocks): A lengthy article written earlier this week takes a look at the technological concerns related to increased reliance on semi autonomous weapons systems such as drones. The article is one of a few that look at the issue, and notes the increased role that autonomous systems have in the third offset strategy. The article stresses that it was not investigating what is best, but rather what shapes preferences for these systems and how trust in them can be advanced. The full article can be read here.
  • Cyberwarfare is taking to the skies, aboard drones (MIT Tech Review):  A recent post on MIT Tech Review’s “The Download” series explains how drones will be utilized in cyber war. The post explains that there are “flying wiretaps for mobile networks, home-brew devices that turn off smart bulbs, or giants with 20-foot wingspans that meddle with Wi-Fi networks.” And the market is only going to grow, a quote in the article explains. The full piece can be read here.

  • Lawmakers zero in on cyber diplomacy (The Hill): Some of the focus on Capitol Hill this week will be on cyber policy, an article Monday explained. Specifically, the hearing would look at the role of cyber in the international sphere and how the U.S. conducts cyber diplomacy. The article explains that both sides of the aisle have concerns over Secretary of State Tillerson’s cyber policies, including shutting down the Office of the Cybersecurity Coordinator at State. The full article can be read here, and any significant updates will be posted as they become available.

Tags:

Cyber Round Up: Israel Cybersecurity Industry Increases, Cybersecurity Professionals Lack Proper Skills, Can You Guess What Your Data is Worth?

  • Israel accounts for 16 percent of global cybersecurity investment, second only to U.S. (CyberScoop): In 2017, Israel’s cybersecurity industry raised $814.5 million, a 28 percent increase from 2016, according to a recent article. CyberScoop explains Israel’s cybersecurity is strong for the size of the country because of Israel’s mandatory military service, support from the Israeli government, and popularity of the industry within the country. Read more about the increasing prevalence of cybersecurity in Israel, and recent cyber investments here.
  • Cybersecurity professionals: Lack of training leaves skills behind (TechTarget): A recent Information Systems Security Association study revealed a shortage of cybersecurity professionals’ skills and training heavily influences a company’s cybersecurity health, according to a recent article. Senior principle analyst at the Enterprise Strategy Group (ESG) Jon Oltsik said, “There is a cumulative impact here: You don’t have enough people, the people you have don’t have the right skills and the people that you have aren’t getting the right training.” The full article with suggestions on how to train current cybersecurity employees can be found here.

  • Do you know your data’s worth? (Digital Guardian): Your data is generally worth a lot, whether in the eyes of malicious or non-malicious organizations. Digital Guardian, a comprehensive data protection platform, has a game where you can guess what data like your social security number, medical records, and Netflix password sell for on the Dark Web. The article also discusses tips on protecting your data and things to look out for in corporate privacy practices. See if you can figure out what your data sells for here.

Tags: , , , , ,

Summary of 2018 National Defense Strategy

Included below is the Summary of the 2018 National Defense Strategy.  An article last week commented on the cyber-related issues in the document, including the fact that it does not mention an elevated role for Cyber Command. That article can be read here.

2018-National-Defense-Strategy-Summary

Tags: , , ,

Next Page »

Authors

Untitled Document
Professor William Snyder

Professor William C. Snyderis a member of the faculty of the Institute for National Security and Counter-terrorism at Syracuse University after fifteen years with the United States Department of Justice.

Ryan D. White

Ryan D. WhiteRyan is currently a third year law student at Syracuse University College of Law, and is also pursuing a Master of Public Administration degree from Syracuse’s Maxwell School of Citizenship and Public Affairs. Ryan spent time with Homeland Security Investigations while pursuing his undergraduate degree at Wesleyan University, and spent his first summer of law school as clerk for the U.S. Attorney’s Office in the Western District of New York. He is a member of Syracuse Law Review, the Journal on Terrorism and Security Analysis, and participates in the Veteran’s Legal Clinic. Full biography

Shelby E. Mann

Ryan D. WhiteShelby is a second year law student at the Syracuse University College of Law. During her final year at the University of Missouri, she served as a full-time news producer for ABC 17 News. Shelby spent her first summer of law school at the Shelby County District Attorney General's Office in Memphis, Tenn., in the Public Corruption and Economic Crimes Unit. She is a member of Syracuse Law Review, the Journal on Terrorism and Security Analysis, and the senior editor for the Syrian Accountability Project. Full biography

Christopher w. FolkChristopher W. Folk

is a 2017 graduate of SU College of Law. A non-traditional student, Christopher returned to academia after spending nearly twenty years in the high tech industry. Christopher served in the Marine Corps, graduated from Cornell University with a B.S. In Applied Economics and Business Management, attended Northeastern University’s High-Tech MBA Program and received a M.S. In Computer Information Systems. Christopher previously worked in Software Engineering. Christopher is currently serving his second term as Town Justice for the Town of Waterloo. Christopher externed with a Cybersecurity firm in the Washington, D.C. area between his first and second year at SU College of Law. Full biography

Anna Maria Castillo

Anna Maria Castillois 2016 graduate of Syracuse College of Law. She also holds a Master of Arts in International Relations from Syracuse University's Maxwell School of Citizenship and Public Affairs. She has interned at a London-based think-tank that specializes in transnational terrorism and global security and at the legal department of a defense contractor. She served as an executive editor in the Syracuse Law Review. Full biography

Jennifer A. CamilloJennifer A. Camillo

is a 2015 graduate of Syracuse College of Law and is a prosecutor. She has served as a law clerk in the United States Attorney’s Office for the Northern District of New York and the Cayuga County District Attorney’s Office and as an extern in the Oneida County District Attorney’s Office. She was a member of the Syracuse National Trial Team and was awarded the Tiffany Cup by the New York Bar Association for her trial advocacy achievements.

Tara J. PistoreseTara J. Pistorese

holds Juris Doctor and Masters of Public Administration degrees from Syracuse University's Maxwell School of Citizenship and Public Affairs and its College of Law. She wrote for this blog when a student. She is now a member of the U.S. Army Judge Advocate General's Corps.

Benjamin Zaiser

is both a scholar and a Federal Agent of the Federal Criminal Police Office of Germany. (Opinions expressed here are his own and not any part of official duty.) Full biography

Categories