Yesterday, we received this communication from the Cybersecurity and Infrastructure Security Agency (CISA) regarding the heightened risk of cyberattacks from Russian actors. This communication is copied and pasted directly from CISA correspondence with stakeholders.
Re: Cybersecurity Advisory on Russian Cyber Threats to U.S. Critical Infrastructure
Rapidly escalating tensions in Eastern Europe have increased concerns about the risk of cyber threats that can disrupt essential services in the United States and potentially result in impacts to public safety. Most recently, public and private sector entities in Ukraine have suffered a series of malicious cyber incidents, including website defacement and private sector reports of potentially destructive malware on their systems that could result in severe harm to critical functions. The identification of destructive malware is particularly alarming because similar malware has been deployed in the past-e.g., NotPetya and WannaCry ransomware-to cause significant, widespread damage or lack of availability to critical functions and/or critical cyber-dependent infrastructure.
Based on this heightened threat, please consult some of the following links from CISA for controls and other best practices in cyber risk mitigation:
This page consolidates CISA's published resources on cyber threats related to the current geopolitical tensions. It is designed to help critical infrastructure owners and operators mitigate possible cyber threats and strengthen their cybersecurity posture.
- Alert (AA22-047A): Russian State-Sponsored Cyber Actors Target Cleared Defense Contractor Networks to Obtain Sensitive U.S. Defense Information and Technology https://www.cisa.gov/uscert/ncas/alerts/aa22-047a (February 2022) - A joint cybersecurity advisory with the FBI and the NSA about Russian state-sponsored cyber actors targeting cleared defense contractors in the United States; includes detection and mitigation recommendations to reduce the risk of data exfiltration.
- CISA Insights: Implement Cybersecurity Measures Now to Protect Against Potential Critical Threats https://www.cisa.gov/sites/default/files/publications/CISA_Insights-Implement_Cybersecurity_Measures_Now_to_Protect_Against_Critical_Threats_508C.pdf (January 2022) -
An executive-level product that recommends urgent, near-term steps to reduce the likelihood and impact of a potentially damaging compromise.
- Alert (AA22-011A): Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure https://www.cisa.gov/uscert/ncas/alerts/aa22-011a (January 2022)
A joint cybersecurity advisory with the FBI and NSA about the Russian threat to critical infrastructure, including specific tactics, techniques, and procedures associated with Russian actors.
CISA has no-cost Cyber Hygiene services https://www.cisa.gov/cyber-hygiene-services -including vulnerability scanning, web application scanning, phishing campaign assessments, and remote penetration tests-as well as free services and tools offered by trusted private sector partners (see the Free Cybersecurity Services and Tools https://www.cisa.gov/free-cybersecurity-services-and-tools page on CISA's website). Always remember to report cyber incidents to CISA Central (email@example.com).
For State, Local, Tribal, and Territorial Government Partners:
- Multi-State Information Sharing and Analysis Center (MS-ISAC) https://www.cisecurity.org/ms-isac and the Election Infrastructure Information Sharing and Analysis Center (EI-ISAC)
Funded by CISA, the MS-ISAC and EI-ISAC serve as no-cost resources for situational awareness, best practices, information sharing, and incident response for SLTT government entities. Register now for the MS-ISAC (https://learn.cisecurity.org/ms-isac-registration) and the EI-ISAC (https://learn.cisecurity.org/ei-isac-registration).
A no-cost protective Domain Name System (DNS) resolver service provided by the MS-ISAC and funded by CISA; blocks malicious DNS requests while keeping state and local partners informed through regular reports.
A service provided by the MS-ISAC and funded by CISA to help SLTT entities involved in managing elections maintain awareness of and isolate malicious activity that may be impacting workstations, servers, and other network endpoints, including malware and ransomware. This program is currently only available to SLTT election organizations.
A service provided by the MS-ISAC and funded by CISA that provides real-time cyber threat intelligence indicator feeds that are easy to implement and available for free to SLTT entities.
Our hope is that the resources provided above will support your overall security posture. We look forward to the continued partnership, please don't hesitate to get in contact if you would like sign up for services or require any security advice.
We will update members on further developments as they arise.