Oak Ridge National Lab Tests Blockchain to Protect Grid Against Cyberattacks
December 1, 2022
by Peter Maloney
APPA News
December 1, 2022
In an effort to protect against cyberattacks and improve resiliency, researchers at the Department of Energy’s Oak Ridge National Laboratory (ORNL) have used blockchain to validate communication among devices on the electric grid.
The ORNL researchers said they used tamper-resistant blockchain to spread configuration and operational data redundantly across multiple servers. The data and equipment settings are constantly verified against a statistical baseline of normal voltage, frequency, breaker status and power quality. The equipment settings are collected at frequent intervals and compared with the last good configuration saved in the blockchain, allowing rapid recognition of when and how settings were changed, whether those changes were authorized, and what caused them, the researchers explained.
Processing the vast amount of data needed to monitor the status of the electric grid is well suited to blockchain technology, which uses a cryptographic method called hashing, where a mathematical computation is performed on bulk data to represent it as numbers in the blockchain. Hashing saves energy and reduces the space needed to store data and enables the blockchain to processes thousands of transactions per second for each intelligent grid device, ORNL said.
ORNL is using the blockchain framework it developed to detect unusual activity, including data manipulation, spoofing, and illicit changes to device settings that could trigger cascading power outages as breakers are tripped by protection devices.
The researchers demonstrated their framework in a test bed within the Department of Energy’s (DOE) Grid Research Integration and Deployment Center at ORNL, which uses commercial grade hardware in a closed electrical loop to mimic the architecture of a real substation. ORNL says that approach allows the researches to simulate cyberattacks or accidental misconfigurations in a low risk manner. The ORNL researchers said they are extending the approach to incorporate communications among renewable energy sources and multiple utilities.
The risk of cyberattacks increases as two-way communications between grid power electronics equipment and devices ranging from solar panels to electric car chargers and intelligent home electronics increases, ORNL noted.
“Our system helps determine in near real time whether a fault was triggered by a cyberattack or induced by natural events,” said Raymond Borges Hink, leader of the ORNL research team. “This is the first implementation of blockchain enabling this kind of data validation between a substation, a control center and metering infrastructure.”
The blockchain project is part of the Darknet initiative being led by ORNL and funded by the DOE’s Office of Electricity that aims to secure the nation’s electricity infrastructure by shifting its communications to increasingly secure methods.
APPA Responds to FERC Proposals on Cybersecurity Rate Incentives
November 17, 2022
by Paul Ciampoli
APPA News Director
November 17, 2022
The Federal Energy Regulatory Commission (FERC) should reconsider several aspects of a Notice of Proposed Rulemaking (NOPR) on cybersecurity rate incentives including a proposal that would allow a 200-basis point return on equity (ROE) adder on eligible investments, the American Public Power Association (APPA) said in recent comments filed at FERC.
If the Commission allows an enhanced ROE on eligible investments, it should limit the incentive to 50 basis points, as the proposed 200-basis point adder is more than necessary to promote cybersecurity investment and could impose excessive costs on consumers, APPA said in its comments filed this month.
The comments responded to the FERC NOPR issued in September.
At the outset of its comments, APPA noted that it supports prudent utility investment to address the growing cybersecurity threats faced by the nation’s electric grid. APPA also recognizes that, in adding section 219A to the Federal Power Act (FPA) Congress has directed the Commission to adopt incentive rate treatments (or performance-based rates) to promote certain cybersecurity-related investments.
“While many features of the NOPR strike an appropriate balance between encouraging cybersecurity investment and protecting customers from unreasonable costs, APPA respectfully submits that certain aspects of the NOPR do not fully comply with the FPA’s requirements for incentive rate mechanisms, which remain fully applicable to any rule promulgated under section 219A.”
APPA urged the Commission to modify certain of the NOPR’s proposals while preserving the features of the NOPR designed to protect customers and ensure transparency.
NOPR Details
Under the NOPR, cybersecurity expenditures would be eligible for an incentive including both expenses and capital investments associated with advanced cybersecurity technology and participation in a cybersecurity threat information sharing program.
Also, eligible cybersecurity expenditures would be voluntary and have to materially improve the utility’s cybersecurity posture. FERC proposes to establish a pre-qualified list of cybersecurity expenditures that are eligible for incentives that would be publicly maintained on FERC’s website.
The proposed incentives would take two forms: a return on equity adder of 200 basis points, or deferred cost recovery that would enable the utility to defer expenses and include the unamortized portion in its rate base, on which the utility could earn a return (the Regulatory Asset Incentive).
Approved incentives, with certain exceptions, would remain in effect for up to five years from the date on which the investments enter service or expenses are incurred.
Incentives Should Be Narrowly Tailored to Satisfy the Requirements of FPA Section 219A
Along with its concerns about the ROE adder proposal, APPA also said that FERC must ensure that there is a nexus between the incentives and project investment decision.
Such a requirement conforms the Commission’s regulations to precedent requiring the Commission, in awarding rate incentives under the just and reasonable standard, to see to it that the increase is in fact needed, and is no more than is needed, for the purpose, it said.
“Evaluating applications for incentives to ensure that there is a nexus between the incentive and the applicant’s investment decision is also necessary to verify that incentives are not awarded for actions that a utility has already taken or is already required to take,” APPA said.
While Congress has required FERC to adopt a rule providing incentives, the Commission, in designing such incentives, must conform to longstanding requirements for just and reasonable rate incentives, it said.
In considering the design of incentives under FPA section 219A, the Commission should also take into account evidence that lucrative incentives are generally unnecessary to promote cybersecurity investment, APPA argued.
The Commission Should Limit the Regulatory Asset Incentive to 50 Percent of Project Investment
APPA noted that in connection with the Regulatory Asset Incentive, the NOPR asks whether it would be preferable to permit only 50% of incentive-eligible expenses to be treated as regulatory assets.
“APPA encourages the Commission to adopt this change from the NOPR’s proposal to allow the entire qualifying expenditure to be accorded regulatory asset treatment.”
APPA also said that incentives should not be available for investments that utilities are required to make or that have already been made.
Groups Urge Risk-Based Approach for Covered Entities for Cyber Incident Reporting
November 10, 2022
by Paul Ciampoli
APPA News Director
November 10, 2022
The Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) should define “covered entities” for cyber incident reporting in a risk-based manner, the American Public Power Association (APPA) and the Large Public Power Council (LPPC) said in response to a request for information (RFI) issued by CISA on the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA).
“While the whole electric sector is critical to national and economic security, not all electric utilities have the same risk profile,” APPA and LPPC said in their comments.
“Acknowledgement of this fact is of particular importance to public power utilities, as APPA’s and LPPC’s members have widely different risk profiles ranging from an electric utility with transmission assets that serves millions of customers to a very small distribution electric utility without an industrial control system serving 200 customers,” they said.
Moreover, APPA and LPPC strongly encouraged CISA to utilize previous efforts to identify the most critical of critical systems and assets as it determines what constitutes a covered entity under the law.
APPA and LPPC believe that such a targeted definition of “covered entity” — especially in this initial implementation period — has the dual benefit of ensuring that entities with the highest risk profiles begin incident reporting immediately, thereby increasing national security, and keeping the number of entities covered under the law to a limited, more manageable level, allowing CISA and industry to more easily work out any implementation kinks.
APPA and LPPC also recommended that CISA tightly limit the definition of “covered cyber incident” to significant and substantial incidents that impact critical systems or services.
For example, a large electric utility that is a covered entity should have to report if it discovers an industrial control system breach at a generation plant or transmission facility. “A covered entity should not have to report a phishing attempt on the email of an accountant that has no connection or control of the operating technology for the electric system,” APPA and LPPC said.
“Critical infrastructure entities are the targets of malicious cyber actors millions of times a day. An overly broad definition of covered cyber incidents would present enormous compliance challenges for utilities, and even if these challenges could be overcome, the result would be a deluge of reports that would make it difficult, if not impossible, for CISA to determine a signal through the noise.”
Balancing Situational Awareness and Cyber Incident Response
The groups also argued that as CISA considers reporting processes and reporting content, it is important that it considers the ultimate purpose of this reporting, which is not to over burden victims for the sake of reporting, but to assist critical infrastructure and the federal government in identifying, addressing, or responding to cyber security threats.
Some critical infrastructure sectors are already covered by federal mandatory reporting of certain cyber incidents, in addition to state laws for reporting of data breach incidents. “In implementing CIRCIA’s incident reporting standards, APPA and LPPC strongly encourage DHS CISA to harmonize any new obligations with utilities’ existing requirements to avoid confusion and conflict between CIRCIA obligations and other mandatory reporting channels.”
Additionally, some sectors, like the electric sector, also have active voluntary reporting and machine-to-machine sharing already taking place. “CISA should recognize and take into consideration these voluntary reporting pathways and associated sector focused analysis, given the value these mechanisms currently provide to critical infrastructures.”
Existing Reporting
A covered entity is exempt from reporting under CIRCIA if it is already required to make reports on similar information to another federal agency, within a similar timeframe, if there is an agreement in place between CISA and that other federal agency, the groups pointed out.
Given the existing incident reporting regimes overseen by the Federal Energy Regulatory Commission and the Department of Energy, “CISA should engage in direct and deep consultation with FERC and DOE as it works to implement CIRCIA.”
Moreover, CISA must take into account existing data breach reporting requirements at the state level, they added.
“To improve the threat landscape and associated awareness of it, it will be critical to work with existing infrastructures wherever possible to allow single-point reporting with the government being responsible for sharing information internally in a need-to-know environment, rather than imposing multiple reporting obligations on an impacted entity, which may also be dealing with a live cybersecurity event.”
Cost Impacts
APPA and LPPC also said that CISA must be mindful of the cost of any new rule on smaller entities.
“The cost of electric service is a key factor in the nation’s economic health, and the reality of varying, but finite resources and budgets suggests that overspending on security measures may compromise grid reliability in other respects. This is especially important to consumer-owned, not-for-profit public power utilities,” they said.
CISA Releases Cybersecurity Performance Goals for Critical Infrastructure
November 2, 2022
by Peter Maloney
APPA News
November 2, 2022
At the end of October, the Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) released a set of voluntary goals outlining the highest priority baseline measures businesses and critical infrastructure owners of all sizes can take to protect against cyber threats to critical infrastructure.
The Cybersecurity Performance Goals (CPGs) were developed by CISA with the DHS at the direction of a July 2021 memorandum on cybersecurity from the White House. DHS, in collaboration with sector risk management agencies, will next begin a process of writing sector specific voluntary goals utilizing the CPGs while they continue to promote these new cross sector cyber gaols.
Legislation passed in November 2018 created CISA within the Department of Homeland Security (DHS) to take the lead in cyber and physical infrastructure security. This did not change the Fixing America’s Surface Transportation Act (FAST Act) – signed into law in December 2015 – designation that the Department of Energy (DOE) specifically as the energy sectors sector risk management lead for cybersecurity.
Over the past year, CISA developed the CPGs in partnership with organizations across government – including DOE – and the private sector through a process that incorporated feedback from hundreds of public and private sector partners and analyzed years of data to identify key challenges that put the nation at risk. APPA appreciated the opportunity to participate in this process as well as to submit feedback much of which was incorporate in the final version.
The CPGs are designed to address concerns CISA heard from “organizations across the spectrum, from the largest multinational corporations to state and local governments, to critical infrastructure entities of all sizes: How can we focus investment toward to the most impactful security outcomes?” Jen Easterly, CISA’s director, said in the introduction to the CPG report.
The CPGs are intended to be implemented in concert with the National Institute of Standards and Technology (NIST) Cybersecurity Framework. It became clear, however, that even with comprehensive guidance from NIST, many organizations would benefit from help identifying and prioritizing the most important cybersecurity practices along with support in making a compelling argument to ensure adequate resources for driving down risk, Easterly said.
The newly delineated CPGs serve as “a kind of QuickStart guide” by prioritizing a “subset of Information Technology (IT) and operational technology (OT) cybersecurity practices that critical infrastructure owners and operators can implement to meaningfully reduce the likelihood and impact of known risks and adversary techniques,” CISA said. The goals were “informed by existing cybersecurity frameworks and guidance, as well as the real-world threats and adversary tactics, techniques, and procedures observed by CISA and its government and industry partners,” the agency said.
Accompanying the goals is a CPG Checklist which can be a very handy starting point for smaller entities looking for a simple way to start working on the CPGs goals and utilizing the CPGs as a reference as needed for the checklist.
CISA stressed that the CPGs are a “baseline set of cybersecurity practices broadly applicable across critical infrastructure” and that they are voluntary and not comprehensive in that they “do not identify all the cybersecurity practices needed to protect national and economic security and public health and safety.” The CPGs “capture a core set of cybersecurity practices with known risk-reduction value broadly applicable across sectors,” the agency said.
The goals are grouped eight topics: account security, device security, data security, governance and training, vulnerability management, supply chain/third party, response and recovery, and other.
Department of Energy Seeks Input on Bolstering Cybersecurity for Public Power
October 24, 2022
by Paul Ciampoli
APPA News Director
October 24, 2022
The U.S. Department of Energy (DOE) recently issued a request for information (RFI) seeking public input on a new $250 million program to bolster the cybersecurity posture of rural, municipal, and small investor-owned electric utilities.
The Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance (RMUC) Program will help eligible utilities cyber harden energy systems, processes, and assets; improve incident response capabilities; and increase cybersecurity skills in the utility workforce, DOE said.
The RMUC program will provide financial and technical assistance to help rural, municipal, and small investor-owned electric utilities improve operational capabilities, increase access to cybersecurity services, deploy advanced cyber security technologies, and increase participation of eligible entities in cybersecurity threat information sharing programs.
Priority will be given to eligible utilities that have limited cybersecurity resources, are critical to the reliability of the bulk power system, or those that support our national defense infrastructure.
The Office of Cybersecurity, Energy Security, and Emergency Response (CESER) will manage the RMUC Program, providing $250 million dollars in funding over five years.
To help inform program implementation, DOE is seeking input from the cybersecurity community, including eligible utilities and representatives of third parties and organizations that support or interact with these utilities.
The RFI seeks input on ways to improve cybersecurity incident preparedness, response, and threat information sharing; cybersecurity workforce challenges; risks associated with technologies deployed on the electric grid; national-scale initiatives to accelerate cybersecurity improvements in these utilities; opportunities to strengthen partnerships; the selection criteria and application process for funding awards; and more.
DOE hosted a series of listening sessions for utilities and stakeholders to ask questions and provide feedback that will help inform the development and implementation of the RMUC program. The final listening session will take place on October 25, 2022. For more information and to register, go here.
Responses to the RFI must be submitted via email to DE-FOA-0002877@netl.doe.gov by 5:00 p.m. ET on December 19, 2022. Download the RFI to see the full list of questions, topics of interest, and submission guidelines.
The American Public Power Association plans to submit comments in response to the RFI and welcomes member feedback. Members can contact Bridgette Bourge, Senior Director for Cybersecurity at APPA, at Bbourge@publicpower.org with thoughts on this RFI.
For additional information, visit the RMUC Program webpage on CESER’s website.
Federal Energy Regulators Propose Incentives for Voluntary Cybersecurity Investments
September 28, 2022
by Paul Ciampoli
APPA News Director
September 28, 2022
The Federal Energy Regulatory Commission (FERC) on Sept. 22 issued a Notice of Proposed Rulemaking (NOPR) to establish rules providing incentive-based rate treatment for utilities making certain voluntary cybersecurity investments.
In the Infrastructure Investment and Jobs Act of 2021, Congress directed FERC to revise its regulations to establish incentive-based rate treatments by encouraging utilities to invest in advanced cybersecurity technology and participate in cybersecurity threat information sharing programs.
Under the NOPR, cybersecurity expenditures would be eligible for an incentive including both expenses and capital investments associated with advanced cybersecurity technology and participation in a cybersecurity threat information sharing program.
Also, eligible cybersecurity expenditures would be voluntary and have to materially improve the utility’s cybersecurity posture. FERC proposes to establish a pre-qualified list of cybersecurity expenditures that are eligible for incentives that would be publicly maintained on FERC’s website.
The incentives would take two forms: a return on equity adder of 200 basis points, or deferred cost recovery that would enable the utility to defer expenses and include the unamortized portion in its rate base.
Approved incentives, with certain exceptions, would remain in effect for up to five years from the date on which the investments enter service or expenses are incurred.
At the same time, FERC terminated its earlier cybersecurity incentives NOPR (Docket No. RM21-3), which the American Public Power Association had opposed.
Comments on the NOPR are due 30 days after publication in the Federal Register. Reply comments are due 45 days after publication in the Federal Register.
The NOPR is available here.
New DOE Program Offers Cybersecurity Assistance To Public Power Utilities
August 21, 2022
by Paul Ciampoli
APPA News Director
August 21, 2022
The Department of Energy’s (DOE) Office of Cybersecurity, Energy Security, and Emergency Response (CESER) recently launched the Rural and Municipal Utility Advanced Cybersecurity Grant and Technical Assistance Program.
The program will prioritize rural, municipal, and small investor-owned utilities that have limited cybersecurity resources, are critical to the reliability of the bulk-power system, and/or those that own defense critical electric infrastructure.
CESER will develop the program in coordination with other government partners, leveraging the $250 million made available in Section 40124 of the Bipartisan Infrastructure Law.
On Aug. 18, CESER hosted the first in a series of listening sessions for eligible entities and other interested parties.
CESER will collect input from the listening sessions to create a comprehensive program plan that bolsters cybersecurity for eligible utilities based on the needs identified by session participants, DOE said.
A listening session scheduled for Sept. 29 will focus on the unique needs of electric municipal utilities and their key priorities.
Registration will open approximately two weeks before the listening session date. Additional details about this and other listening sessions are available here.
Ditto Urges Deliberative Process Tied To Implementation of Cyber Incident Reporting Law
June 17, 2022
by Paul Ciampoli
APPA News Director
June 17, 2022
American Public Power Association (APPA) President and CEO Joy Ditto on June 9 sent a letter to Jennifer Easterly, Director of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) regarding implementation of the Cyber Incident Reporting for Critical Infrastructure Act of 2022.
In the letter, Ditto asks for a commitment from Easterly “to take a careful and deliberative process that takes into account existing reporting mandates and to appropriately tailor reporting mandates commensurate with risk to national security.”
Signed into law by President Biden in March, the law requires critical infrastructure entities to report cyber incidents to CISA within 72 hours and ransomware payments within 24 hours. CISA is directed to publish a notice of proposed rulemaking to implement the reporting requirements within 24 months.
Ditto noted in her letter that the electric sector has mandatory and enforceable federal regulatory standards in place for cyber and physical security. These standards include mandatory reporting of specific cyber incidents to the Department of Energy (DOE) via an Electric Emergency Incident and Disturbance Report and to the North American Electric Reliability Corporation (NERC) and Federal Energy Regulatory Commission (FERC).
Outside of these mandatory reporting standards, public power utilities participate in robust voluntary information sharing systems such as the Electric Subsector Coordinating Council and the Electricity Information Sharing and Analysis Center, as well as the Multi-State Information and Sharing Analysis Center.
Moreover, electric utilities worked closely with the National Security Council, DOE, and DHS on the “100 Day Electric Sector Industrial Control Systems Cybersecurity Sprint” to encourage and support utilities’ visibility and monitoring of their industrial control system and operational technology networks, as well as automated sharing into government, Ditto pointed out.
The electric sector “is unique among critical infrastructure sectors in the extent and maturity of existing information sharing regulations and programs,” she wrote. Public power utilities, as units of state and local governments and varying so widely in size and risk profiles, are still more unique.
“Given these complexities, and pursuant to Congress’ expressed intent, it is critical that CISA work directly with our industry’s sector risk management agency, DOE, as well as FERC and NERC, and industry itself, to harmonize, to the maximum extent possible, new reporting mandates and processes with those that already exist.”
In addition, Ditto strongly urged CISA to use “the considerable discretion given to it by Congress in the law to define covered entities for the purposes of mandated reporting of cybersecurity incidents in a risk-based manner.”
As Congress explicitly stated in the law, CISA must define the types of entities that constitute covered entities based on the “consequences that disruption to or compromise of such an entity could cause to national security, economic security, or public health and safety,” she said.
“This is of particular importance to public power utilities, as APPA’s members have widely different risk profiles ranging from an electric utility with transmission assets that serves millions of customers to a very small distribution electric utility without an industrial control system serving 200 customers,” wrote Ditto.
She requested a meeting with Easterly and her team leading implementation to discuss the matters raised in the letter in detail.
Public Power Utilities Well Positioned To Weather Cyberattacks: Fitch Ratings
May 2, 2022
by Paul Ciampoli
APPA News Director
May 2, 2022
Public power utilities are well positioned to weather cyberattacks “due to the electric sector’s years of attention to cyber threat mitigation and regulatory requirements, which offers a heightened level of protection relative to other infrastructure assets,” Fitch Ratings recently said.
The rating agency on April 21 noted that federal warnings of cyberattacks targeting U.S. critical infrastructure coincide with news reports of probing of the Texas energy infrastructure, which can be used to scan and monitor networks for weaknesses. “Risks are amplified, and increased information technology investment and spending will be necessary,” Fitch said.
The rating agency noted that the Department of Energy (DOE), Cybersecurity and Infrastructure Security Agency, National Security Agency, and the FBI jointly released an alert in mid-April to warn that certain advanced persistent threat actors are capable of gaining full system access to multiple industrial control systems (ICS) and supervisory control and data acquisition (SCADA) devices using custom-made tools that target ICS/SCADA.
“Electric utilities are exposed to these threats as they use ICS to connect into the electric grid and SCADA to gather and process data from substations. Events caused by operating technology (OT) breaches can threaten human safety and the availability of essential assets and are much more severe than IT breaches,” Fitch said.
The costs to maintain and update cybersecurity will rapidly increase to keep pace with elevated ICS threats amid geopolitical tension, the rating agency said. “System lifecycles are decreasing along with rapid evolution of technology and sophistication of cyber intrusions. Strengthening of cyber hygiene culture through investment in human capital and technology is critical to continue effective mitigation of fast-evolving” threats from advanced persistent threat actors.
Fitch also said that electric utility critical assets have been hardened by over a decade of compliance with the North American Electric Reliability Corporation’s critical infrastructure protection mandatory cyber security standards.
Moreover, the renewed emphasis on partnerships as threats increase “is supported by platforms allowing utility operators to share cyber threats in real time without compromising competitive or sensitive information,” Fitch said.
Public power groups such as the American Public Power Association and the Large Public Power Council provide their members with cybersecurity support programs, the rating agency noted, and CISA and the FBI updated the CISA Shields Up program in March 2022, providing best practices, technical guidance, free tools and resources that are available to all organizations.
APPA is helping member utilities across the country create a more resilient and secure electric grid that is prepared for both cyber and physical threats. Public power utilities are working with their communities, states, and the federal government to ensure compliance with stringent security standards and to manage risk. For additional details on how APPA is helping members with cybersecurity, click here.
Fitch said that the ability to protect infrastructure from attacks is considered under Fitch’s U.S. public power rating criteria as part of its assessment of management quality and governance, which is an asymmetric credit factor where weaker characteristics may constrain a rating.
Fitch assesses utilities’ cyber security policies, investment and training, their maintenance of insurance against cyberattacks and their protocols to address cyber incidents.
“No public power ratings are currently constrained by concerns regarding a utility management’s lack of preparation. In the event of a cyberattack, Fitch would assess the effect on financial metrics and performance of halts in service, delays in revenue generation, ransomware payments or unexpected capital costs,” the rating agency said.
Advisory Offers Most Comprehensive View On Cyber Threat Posed By Russia Since Invasion
April 23, 2022
by Paul Ciampoli
APPA News Director
April 23, 2022
The Cybersecurity and Infrastructure Security Agency (CISA), along with other U.S. government entities and a number of international organizations, recently issued a joint cybersecurity advisory on Russian state-sponsored and criminal cyber threats to critical infrastructure that could impact organizations both within and beyond Ukraine.
“It is the most comprehensive view of the cyber threat posed by Russia to critical infrastructure released by government cyber experts since the invasion of Ukraine in February,” CISA said on April 20.
The advisory provides technical details on malicious cyber operations by actors from the Russian Federal Security Service, Russian Foreign Intelligence Service, Russian General Staff Main Intelligence Directorate, and Russian Ministry of Defense, Central Scientific Institute of Chemistry and Mechanics.
It also includes details on Russian-aligned cyber threat groups and cybercrime groups. Some of these cybercrime groups have recently publicly pledged support for the Russian government and have threatened to conduct cyber operations in retaliation for perceived cyber offensives against Russia or against countries or organizations providing materiel support to Ukraine.
The advisory recommends several immediate actions for all organizations to take to protect their networks, which include prioritizing patching of known exploited vulnerabilities, enforcing multifactor authentication, monitoring remote desktop protocol and providing end-user awareness and training.
“We know that malicious cyber activity is part of the Russian playbook. We also know that the Russian government is exploring options for potential cyberattacks against U.S. critical infrastructure. Today’s cybersecurity advisory released jointly by CISA and our interagency and international partners reinforces the demonstrated threat and capability of Russian state-sponsored and Russian aligned cyber-criminal groups to our Homeland,” said CISA Director Jen Easterly. “We urge all organizations to review the guidance in this advisory as well as visit www.cisa.gov/shields-up for continually updated information on how to protect yourself and your business.”
CISA was joined in the April 20 advisory by the Federal Bureau of Investigation, the National Security Agency, the Australian Cyber Security Center, the Canadian Center for Cyber Security, New Zealand’s National Cyber Security Center and the United Kingdom’s National Cyber Security Center and National Crime Agency, with contributions from industry members of the Joint Cyber Defense Collaborative.