The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and the Cybersecurity and Infrastructure Security Agency (CISA) has released Business Continuity in a Box. Business Continuity in a Box, developed by ACSC with contributions from CISA, assists organizations with swiftly and securely standing up critical business functions during or following a cyber incident.

Comprised of two core components—Continuity of Communications and Continuity of Applications—Business Continuity in a Box is designed for situations where the availability or integrity of an organization’s data and/or systems has been compromised. The core components focus on keeping communications flowing during an incident and establishing interim business-critical applications.

Business Continuity in a Box aligns with CISA’s goals for Critical Infrastructure Security and Resilience Month which aims to provide businesses of all sizes with free or low-cost resources and tools that aid in strengthening our national cybersecurity posture.

Explore core AI concepts at Azure Virtual Training Day: AI Fundamentals from Microsoft Learn. Join us for this free training event to learn how organizations use AI technology to solve real-world challenges and see how to build intelligent applications using Azure AI services. This training is suitable for anyone interested in AI solutions—including those in technical or business roles. You will have the opportunity to: Understand foundational AI concepts and real-world use cases. Get started using AI services on Azure and machine learning in Azure Machine Learning Studio. Identify common AI workloads and ways to use AI responsibly. Join us at an upcoming event: December 8, 2023 | 12:00 PM – 3:30 PM | (GMT-05:00) Eastern Time (US & Canada) Delivery Language: English Closed Captioning Language(s): English

REGISTER TODAY >

The National Institute of Standards and Technology (NIST) is extending the period for submitting comments to support the development of an implementation plan for the United States Government National Standards Strategy for Critical and Emerging Technology (USG NSSCET) until Dec. 22, 2023.

Submit comments now via the Federal Register notice. 

“It is critical to our economy and national security that we have high quality standards for the critical and emerging technologies that will transform the way we live and work,” said Under Secretary of Commerce for Standards and Technology and NIST Director Laurie E. Locascio. “We are asking experts and stakeholders to share their best ideas for implementing a national strategy that will strengthen U.S. leadership and competitiveness in each of these sectors.”

Read More

This FBI Private Industry Notification (PIN) is being provided to assist agencies and organizations in guarding against the persistent malicious actions of cybercriminals.

The FBI is releasing this PIN to highlight ransomware initial access trends and encourage organizations to implement the recommendations in the mitigations section to reduce the likelihood and impact of ransomware incidents.

As of July 2023, the FBI noted several trends emerging or continuing across the ransomware environment and is releasing this notification for industry awareness. New trends included ransomware actors exploiting vulnerabilities in vendor-controlled remote access to casino servers, and companies victimized through legitimate system management tools to elevate network permissions.

This FBI PIN provides an overview of the threat, mitigation recommendations, and is being provided to assist agencies and organizations in guarding against the persistent malicious actions of cybercriminals.

NICE is continuing to refine and clarify the Workforce Framework for Cybersecurity (NICE Framework) as a fundamental reference resource that is agile, flexible, modular, and interoperable. As such, we are pleased to announce that refactored Task statements are ready for your review and feedback!  Proposed updates to the NICE Framework Task statements follow the principles set forth in the Task, Knowledge, Skill (TKS) Statements Authoring Guide for Workforce Frameworks. Updates include improvements for: Consistency: Statements follow a common structure that begins with the activity to be executed and focus on the work to be done (not the knowledge or skills needed to do that work) Clarity: Statements are clearly stated Redundancy: Statements are unique and do not duplicate or unnecessarily overlap with others Compound statements: Statements do not include more than one task Once the Task statement comments are received and adjudicated, NICE intends to release a full, updated set of TKS statements for use with the NICE Framework, including a mapping of the 2017 statements to this updated data set.

WE WANT TO HEAR FROM YOU!

Comments on the proposed updates to Task statements should be submitted by email to [email protected] by 11:59 pm ET on January 29, 2024. Take Action:  Read the Task Statement Summary of Updates Review the Refactored Task Statements (clicking the link downloads an XLSX file) Submit comments to [email protected] by January 29th Join the NICE Framework Users Group to join community discussions. Visit the NICE Framework Resource Center for additional information.

The US Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center (HC3) released this Analyst Note to provide awareness of BlackSuit ransomware.

A relatively new ransomware group and strain known as BlackSuit, with significant similarities to the Royal ransomware family, will likely be a credible threat to the Healthcare and Public Health (HPH) sector. Discovered in early May, BlackSuit’s striking parallels with Royal, the direct successor of the former notorious Russian-linked Conti operation, potentially places the group with one of the most active ransomware groups in operation today. Both Royal and the now defunct Conti are known to have aggressively targeted the HPH sector, and if their purported ties to BlackSuit prove to be verified, then the sector will likely continue to be attacked profoundly.

This HC3 Analyst Note provides an overview of the group, possible connections to other threat actors, an analysis of their ransomware attacks, their target industries and victim countries, impacts to the HPH sector, MITRE ATT&CK techniques, indicators of compromise, recommended defenses and mitigations,  and is being provided to assist agencies and organizations in guarding against the persistent malicious actions of cyber criminals.

NIST issues SP 800-53 Release 5.1.1 in Cybersecurity and Privacy Reference Tool

NIST has issued SP 800-53 Release 5.1.1 and SP 800-53A Release 5.1.1 in the Cybersecurity and Privacy Reference Tool (CPRT). This inaugural patch release includes minor grammatical edits and clarifications that do not impact the implementation or outcome of the controls, as well as one new control and three supporting control enhancements to address recent vulnerabilities related to identity and access management systems, and corresponding assessment procedures. A two-week, expedited public comment period on the new control and supporting control enhancements was held in October 2023 using the SP 800-53 Public Comment site. This release is available via the CPRT in JSON, spreadsheet, and in OSCAL formats.

This patch release marks the first time NIST has issued controls and assessment procedures in this way; and NIST will use this approach to ensure that the catalog of security and privacy controls, assessment procedures, and control baselines stay up to date to address the evolving threat landscape while allowing for user feedback, review, and transparency in our development process.

Organizations that already use and implement SP 800-53r5 (Revision 5) have the option to defer implementing the changes in the patch release until SP 800-53 Release 6.0.0 is issued. Refer to the SP 800-53 Release 5.1.1 FAQ for more information.

Additional questions and comments can be directed to [email protected].

NIST Cybersecurity and Privacy Program
Questions/Comments about this notice: [email protected]
CSRC Website questions: [email protected]

The US Department of Health and Human Services’ Health Sector Cybersecurity Coordination Center (HC3) released this Analyst Note to provide awareness of 8Base ransomware.

A recent attack on a US-based medical facility in October highlights the potential threat of the ransomware gang, 8Base, to the Healthcare and Public Health (HPH) sector. Active since March 2022, 8Base became highly active in the summer of 2023, focusing their indiscriminate targeting on multiple sectors primarily across the United States. This surge in operational activity included the group’s engagement in double extortion tactics as an affiliate of Ransomware-as-a-Service (RaaS) groups against mostly small to medium-sized companies. While similarities exist between 8Base and other ransomware gangs, the group’s identity, methods, and motivations remain largely unknown.

This HC3 Analyst Note provides an overview of the group, possible connections to other threat actors, an analysis of their ransomware attacks, their target industries and victim countries, impacts to the HPH sector, MITRE ATT&CK techniques, indicators of compromise, recommended defenses and mitigations,  and is being provided to assist agencies and organizations in guarding against the persistent malicious actions of cyber criminals.

NIST Seeks Collaborators for Consortium Supporting Artificial Intelligence Safety

The U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) is calling for participants in a new consortium supporting development of innovative methods for evaluating artificial intelligence (AI) systems to improve the rapidly growing technology’s safety and trustworthiness. This consortium is a core element of the new NIST-led U.S. AI Safety Institute announced yesterday at the U.K.’s AI Safety Summit 2023, in which U.S. Secretary of Commerce Gina Raimondo participated.

The institute and its consortium are part of NIST’s response to the recently released Executive Order on Safe, Secure, and Trustworthy Development and Use of AI. The EO tasks NIST with a number of responsibilities, including development of a companion resource to the AI Risk Management Framework (AI RMF) focused on generative AI, guidance on authenticating content created by humans and watermarking AI-generated content, a new initiative to create guidance and benchmarks for evaluating and auditing AI capabilities, and creation of test environments for AI systems. NIST will rely heavily on engagement with industry and relevant stakeholders in carrying out these assignments. The new institute and consortium are central to those efforts.
Read More

Two Days Left to Register for our NIST Webinar! Learn about Revisions to Two of our Identity Special Publications

Event Date: November 8, 2023

Time: 1:00 PM-2:30 PM ET

Description:

The National Institute of Standards and Technology (NIST) will be hosting a webinar to introduce two recently published Public Draft Special Publications (SPs):  The 3-part Drafts of SP 800-73 Revision 5, Interfaces for Personal Identity Verification (PIV) and Draft SP 800-78 Revision 5, Cryptographic Algorithms and Key Sizes for Personal Identity Verification. These publications are complements to FIPS 201-3, which defines the requirements and characteristics of government-wide interoperable identity credentials used by federal employees and contractors.

The webinar will discuss the necessary changes made to the PIV card, its credentials, and cryptographic capability to align with FIPS 201-3. 

Full Agenda:

1:00 PM-1:05 PM – Introduction and Welcome

1:05 PM-1:15 PM – Introduction to the PIV Standard

1:15 PM-1:45 PM – Changes to Draft SP 800-73 Revision 5

1:45 PM-2:15 PM – Changes to Draft SP 800-78 Revision 5

2:15 PM-2:30 PM – Key Dates/Next Steps/Closing

Visit the event page to register and learn more about the webinar. If you have any questions, please reach out to our team at [email protected].

Event Page