tFederal Facilities Council.. James Myska and Joe Alper, Rapporteurs

Federal facilities are increasingly complex and sophisticated systems of systems, with automated systems tied together through operational technology (OT) networks monitoring and controlling lighting and environmental control systems (CS), among many others. Federal agencies have built virtual fortresses around their information technology (IT) networks, including connected CS and OT networks, yet key vulnerabilities can allow bad actors to tunnel through the embedded layers of protection, interfere with facility operation and control, and gain direct passages into IT networks, bypassing their elaborate protections. On July 9, 2024, the National Academies' Federal Facilities Council convened a workshop to discuss the security of CS and OT networks. Workshop panelists explored the current threat environment; standards, policies, and guidance to protect OT and CS from malicious actors; and approaches that industry has taken to protect its OT and CS security.

National Academies of Sciences, 2024. 41p.

By United States. Cybersecurity & Infrastructure Security Agency

The following passage from the document contains multiple links embedded in the text: "The Cybersecurity and Infrastructure Security Agency (CISA) conducts Risk and Vulnerability Assessments (RVAs) for the federal civilian executive branch (FCEB), high priority private and public sector critical infrastructure (CI) operators, and select state, local, tribal, and territorial (SLTT) stakeholders. Concurrently, the United States Coast Guard (USCG) conducts RVAs on maritime CI operated by SLTT and private-sector organizations. The RVA is intended to assess the entity's network capabilities and network defenses against known threats. In Fiscal Year 2023 (FY23), CISA and the USCG conducted a combined total of '143' RVAs across multiple CI sectors. [...] The goal of the RVA analysis is to develop effective strategies to improve the security posture of FCEB, CI, maritime, and SLTT stakeholders. During each RVA, CISA and the USCG collect data through remote and onsite actions. This data is combined with national threat and vulnerability information to provide organizations with actionable remediation recommendations prioritized by risk of compromise. CISA designed RVAs to identify vulnerabilities threat actors could exploit to compromise network security controls. After completing an RVA, CISA and the USCG provide the assessed entity a final report that includes recommendations, specific findings, potential mitigations, and technical attack path details. The FY23 reports provided these general observations: [1] Assessors completed their most successful attacks via common methods, such as phishing, valid accounts, and default credentials. [2] Assessors used a variety of tools and techniques CISA has captured in previous RVA analyses to successfully conduct common attacks. [3] Many organizations across varying CI sectors exhibited the same vulnerabilities. [4] CISA assessment personnel used common vulnerabilities facilitated by shortcomings in secure by design and default principles and other misconfigurations to compromise systems."

UNITED STATES. Government. Washington DC. SEP, 2024. 24p.

KOVALCIKOVA, NAD'A; FILIPOVA, RUMENA VALENTINOVA, 1989-; HOGEVEEN, BART; KARÁSKOVÁ, IVANA; PAWLAK, PATRYK; SALVI, ANDREA

From the document: "This 'Chaillot Paper' delves into the phenomenon of foreign interference and the risk it poses to democratic societies. It explores the interplay between information manipulation and disruptive cyber operations, revealing their role as complementary components within a broader strategy. Dedicated chapters examine how interference manifests across various sectors, including social, political, economic, digital and security domains, describing existing tools and evolving policy responses. Each case study follows a clear structure, presenting an incident, its effects and the implemented responses. The volume concludes by identifying convergences and divergences across the cases studied, and highlights foreign interference as a critical and growing threat to global security. It offers targeted recommendations on how the EU can significantly bolster its defences and resilience against this threat."

INSTITUTE FOR SECURITY STUDIES (PARIS, FRANCE). AUG, 2024. 67p.

Pechtol, Colby; Gallagher, Jill C.

The following passage from the document contains multiple links embedded in the text: "On July 19, 2024, CrowdStrike, a U.S. cybersecurity firm, released a software update to their customers. The update caused certain systems to crash, disrupting services across several industries, including airlines, banks, hospitals, government agencies, and public safety systems. CrowdStrike reported that the incident was caused by 'a defect found in a single content update of its software on Microsoft Windows operating systems' and was not a cyberattack. Though the update affected less than 1% of all Windows machines, the impacts were widespread and global. The incident illustrates the vulnerabilities of information technology (IT) systems, increased dependence and risks in relying on third-party vendors for critical IT services, and lack of protocols and backup systems in the event of IT system failures. This In Focus discusses the incident's impact on certain U.S. public safety communications systems and services."

LIBRARY OF CONGRESS. CONGRESSIONAL RESEARCH SERVICE. 26 JUL, 2024.. 3p.

DIAS, TALITA DE SOUZA; HAKMEH, JOYCE; MESSMER, MARION

From the document: "Many states are becoming more interested in nuclear energy as a means to help achieve environmental goals, economic development and energy security. A declaration by 25 countries - including the US, the UK and Canada - during the COP28 UN [28th Conference of Parties to the United Nations] Climate Change Conference in December 2023 exemplified this trend, announcing an ambition to triple nuclear energy capacity by 2050 as part of efforts to achieve net zero greenhouse gas emissions and limit global warming. The commitment emphasized not only the potential role of nuclear energy in supporting sustainable development but also the consequent importance of maintaining safety, sustainability, security and non-proliferation standards in the civil nuclear industry. As growth in the use of nuclear energy would imply that more nuclear power plants will come into operation, considerations of safety and security in the civil nuclear industry - including around cybersecurity, the specific subject of this paper - are likely to become more critical than ever. Since Russia's full-scale invasion of Ukraine in February 2022, there has been a notable shift in many Western countries' energy security strategies. [...] This surge in interest can be attributed in part to nuclear energy's reliability, resilience and low carbon footprint. [...] However, any expansion of nuclear capabilities also brings new challenges, particularly in cybersecurity. Cyber operations targeting civil nuclear systems have been reported worldwide. Such operations pose significant risks, with potential harms including information theft, equipment malfunction, disruption of energy supplies, environmental damage and health impacts. The risks are prevalent both in peacetime and during conflicts."

ROYAL INSTITUTE OF INTERNATIONAL AFFAIRS. JUL, 2024.

Cooper, Betsy

The UC Berkeley Center for Long-Term Cybersecurity (CLTC) has released a report focused on the rapidly evolving landscape of cybersecurity in sports, with an emphasis on the Olympic Games. The report, "The Cybersecurity of Olympic Sports: New Opportunities, New Risks," is an unprecedented look into how the proliferation of new technologies in major sporting events�from digital display panels in stadiums to online ticketing systems to artificial intelligence-based scoring software - opens the door to cyberattacks that could threaten public safety, diminish the fan experience, and undermine the integrity of competition. CLTC produced the report through a partnership with Cal Athletics (the University of California, Berkeley's athletics department) as well as the Los Angeles Organizing Committee for the 2028 Olympic Games. Using the Olympic Games as a case study, the report introduces a framework for evaluating potential risks posed by digital technologies in sports, and highlights possible threats that will arise as these technologies are deployed. The study identifies key areas of risk, including hacks on stadiums, scoring systems, and photo and video replay systems; manipulation of digital systems used by athletes for training and self-care; hacks on transportation and entry systems; as well as more extreme attacks designed to induce panic or facilitate terrorism or kidnapping. The report also includes fictional news stories from the future to highlight hypothetical incidents. One shows how malicious actors seeking to disrupt the Olympics could cause mass panic in a stadium by hacking into digital display panels. Another story highlights how hackers could manipulate a software-based scoring system in gymnastics, throwing a marquee event into chaos. A third story focuses on how "smart" appliances installed in athlete' residences in the Olympics Village could be hacked and used for surveillance. The report suggests that sporting event planners should consider the potential cybersecurity implications of any new technology, noting that "organizers should press to ensure that there are tangible benefits to incorporating digital devices�and that significant risks can be mitigated�before going forward."

Berkeley, CA: University of California at Berkeley, Center for Long-Term Cybersecurity, 2017. 40p.

By Cynthia Dion-Schwarz, Alt. Authors: Nathan Ryan, Julia A. Thompson, Erik Silfversten, Giacomo Persi Paoli

This report profiles the cybersecurity threat landscape faced by Japan as the host nation of the 2020 Summer Games and 2020 Paralympic Games of the XXXII Olympiad. The overarching objective of the study was to produce a threat actor typology, based on a risk assessment of the Tokyo 2020 threat landscape. Synthesizing multiple sources of primary and secondary data, the study team developed a visualization of the threat landscape that provides an at-a-glance overview to guide Olympic security planners, computer emergency response teams, and policy- and decisionmakers as they prioritize and address cybersecurity threats. The risk assessment also considered the motivation, sophistication, and propensity of threat actors to collude with one another. This research could be valuable to a wide variety of stakeholders and will be of particular interest to stakeholders involved in planning and ensuring the security of the Tokyo 2020 Games. The research also serves as a reference to inform ongoing policy debates on cybersecurity preparations for mega-events and as a basis for future research.

Santa Monica, CA: RAND, 2018. 97p.

By Robert Mandel

Optimizing Cyberdeterrence by Robert Mandel provides a comprehensive analysis of strategies to enhance cybersecurity on a global scale. Mandel delves into the concept of cyberdeterrence and how it can be optimized to prevent cyberattacks effectively. Through detailed case studies and theoretical frameworks, the book offers valuable insights into the evolving landscape of cyber threats and the necessary steps to mitigate them. A must-read for policymakers, cybersecurity professionals, and anyone interested in safeguarding against cyber risks.

Georgetown University Press, 2017 - 287 pages

MAY CONTAIN MARKUP

PAUL BoCIJ

INTRODUCTION; “We are constantly told that technology enriches our lives: the Internet provides learning opportunities for our children, cell phones allow us to keep in touch with our relatives while we're on the move, and laptop computers allow us to work almost anywhere at any time. But we are also constantly warned about the dangers of technology, especially the Internet: hackers can steal our credit card numbers, pedophiles can target our children, and racists can spread messages of hate. We take these dangers seriously because technology permeates almost every aspect of our lives. For instance, it is not an exaggeration to sugges t that virtually every child in the United States, Europe, and any number of other technically advanced nations will come into regular contact with the Internet. It is for this reason that parents, teachers, law enforcement agencies, and others constantly monitor the safety of th e young people in their care.”

Praeger. Westport, Connecticut London. 2004. 273p.

MAY CONTAIN MARKUP

By LEONARD I. KRAUSS and AILEEN MACGAHAN

FROM THE PREFACE: “This book deals with computer fraud prevention, detection, deterrents, investigation, loss recovery, and risk management. (The term "computer fraud" is our shorthand way of referring to computerassisted or computer-related crimes. The people who commit these crimes may use the computer either directly or as a vehicle for deliberate misrepresentation or deception, usually to cover up the embezzlement or theft of money, goods, services, or information.) Avoiding the sensationalism that so often characterizes the current literature on the subject, this book is addressed to business executives, financial and administrative officers, data processing managers, systems analysts, auditors, corporate and computer security supervisors, law enforcement investigators, and others who are responsible for providing direction in coping with the risk of computer fraud.”

RENTICE-HALL, INC., Englewood Cliffs, New Jersey. 1979. 502p.