CISA Community Bulletin March 2024

March 2024 Issue

In this edition:

• Secure Our World
  • Secure Our World at Super Bowl LVIII & NFL Partnership
•  Announcements
  • Director Jen Easterly testified on the nation-state threat the People’s Republic of China (PRC) poses to U.S. critical infrastructure.
  • CISA and FBI release Guidance to Increase Awareness of Chinese-manufactured Unmanned Aircraft Systems (UAS) Risks
  • Logging Made Easy (LME) v1.2.0 Just Dropped a Cyber Mic
• Partnerships
  • CISA and International Partners Release Guidance on Engaging with Artificial Intelligence
  • CISA and FBI Release joint Cybersecurity Advisory (CSA) Known Indicators of Compromise Associated with Androxgh0st Malware
  • CISA, FBI and EPA Release Incident Response Guide for Water and Wastewater Systems Sector
  • CISA's Stakeholder Engagement Division (SED) Sector Liaisons
• Information Exchange
  • Handling Destructive Malware
  • The Cloud Log Aggregation Warehouse (CLAW)
  • Release of the Connected Communities Procurement and Implementation Guidance
  • New ChemLock Resources
  • CISA Considers Software Developers a Key Part of the Cybersecurity Workforce
• Education and Training and Workshops
  • Quarterly ChemLock Trainings
  • Region 8 Training and Exercise Resources Webinar

To see the latest CISA Cybersecurity Alerts and Advisories visit Cybersecurity Alerts & Advisories | CISA

Report a Cyber Incident

CISA provides secure means for constituents and partners to report incidents, phishing attempts, malware, and vulnerabilities.

Report a Cybersecurity Incident: Report anomalous cyber activity and/or cyber incidents 24/7 to report@cisa.gov or (888) 282-0870.

• Report an Incident
• Report Phishing
• Report a Vulnerability

Report incidents as defined by NIST Special Publication 800-61 Rev 2, to include

• Attempts to gain unauthorized access to a system or its data,
• Unwanted disruption or denial of service, or
• Abuse or misuse of a system or data in violation of policy.

Federal incident notification guidelines, including definitions and reporting timeframes can be found here.

Organizations can also report anomalous cyber activity and/or cyber incidents 24/7 to: Central@CISA.dhs.gov 

Secure Our World at Super Bowl LVIII & NFL Partnership

Last month the National Football League (NFL) announced they are joining the Secure Our World cybersecurity awareness effort. Launched in September 2023 and led by CISA, Secure Our World encourages individuals, families, and small to medium-sized businesses to take simple steps, like using strong passwords, enabling multifactor authentication, recognizing and reporting phishing, and updating software, to stay safe and secure online. The cybersecurity tips were seen at the NFL Fan Experience during Super Bowl Week and during the big game. The NFL has also committed to working with their teams to advance cybersecurity awareness throughout the 2024-2025 season. Secretary of Homeland Security Alejandro N. Mayorkas traveled to Las Vegas for the announcement and was joined by CISA’s Assistant Director for Stakeholder Engagement, Alaina Clark, and Associate Director for Strategic Relations, Kevin Dillon. For more information, see CISA’s Secure Our World webpage, which includes the Secure Our World: Super Bowl LVIII Video.

Director Jen Easterly testified on the nation-state threat the People’s Republic of China (PRC) poses to U.S. critical infrastructure

On January 31, the House Select Committee on the Strategic Competition Between the United States and the Chinese Communist Party (CCP) conducted a hearing on the CCP's nation-state threat to the American homeland. During the hearing, the Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly testified on the nation-state threat the People’s Republic of China (PRC) poses to U.S. critical infrastructure. During her testimony, Director Easterly addresses CISA’s concern about a strategic shift in the PRC’s malicious cyber activity against U.S. critical infrastructure, and what the agency is doing to deter potential interference from the PRC. 

We invite you to read Director Easterly’s opening statement Opening Statement by CISA Director Jen Easterly | CISA, or read it below. We also encourage you to visit cisa.gov/China to learn more about the agency’s efforts around the PRC. Our updated page on the PRC also links to the Director's submitted testimony and a full recording of the hearing which is housed on the Committee's page: Hearing Notice: The CCP Cyber Threat to the American Homeland and National Security | Select Committee on the CCP (house.gov). 

CISA and FBI release Guidance to Increase Awareness of Chinese-manufactured Unmanned Aircraft Systems (UAS) Risks.

The Cybersecurity and Infrastructure Security Agency (CISA), in coordination with the Federal Bureau of Investigation’s (FBI) Cyber Division, released Cybersecurity Guidance: Chinese-Manufactured UAS. CISA and FBI developed this guidance to increase awareness on the risks associated with Chinese-manufactured Unmanned Aircraft Systems (UAS). This product provides critical infrastructure and state, local, tribal, and territorial (SLTT) partners insight into Chinese-manufactured UAS that carry an increased risk of the Chinese Communist Party gaining unauthorized access to sensitive information. It also provides a series of cybersecurity recommendations to mitigate risk to networks and information.   The Cybersecurity Guidance: Chinese-Manufactured UAS product is a continuation of CISA’s suite of products related to UAS cybersecurity, including Cybersecurity Best Practices for Operating Commercial Unmanned Aircraft Systems and Secure Your Drone: Privacy and Data Protection Guidance.   To access this guidance and learn more about Chinese-manufactured UAS vulnerabilities and cybersecurity recommendations, visit: https://www.cisa.gov/resources-tools/resources/cybersecurity-guidance-chinese-manufactured-uas.

Logging Made Easy (LME) v1.2.0 Just Dropped a Cyber Mic

Exciting news, cyber guardians! Logging Made Easy (LME) v1.2.0 just dropped a cyber mic, taking log management to new heights! Explore LME’s new sleek dashboards, bug fixes, and a fortified ELK stack at v8.11.1.Dive deeper at CISA’s site and LME’s GitHub.     Logging Made Easy (LME) is CISA’s reimagined version of an internationally well-known log management toolset, which offers a reliable, no-cost centralized log management solution. LME is the perfect option for those organizations hampered by limited resources and currently lacking a comparable capability.

CISA and International Partners Release Guidance on Engaging with Artificial Intelligence

Joint guidance on Engaging with Artificial Intelligence was released on January 23, 2024. CISA, along with the Canadian Centre for Cyber Security (CCCS), New Zealand National Cyber Security Centre (NCSC-NZ), United Kingdom (UK) National Cyber Security Centre (NCSC-UK), Federal Bureau of Investigation (FBI), and National Security Agency (NSA) collaborated with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), who led the development of this product.     This guidance focuses on using AI systems securely rather than developing secure AI systems. For guidance on the latter, the authoring agencies encourage developers of AI systems to refer to the joint Guidelines for Secure AI System Development.   Specifically, organizations are provided with a summary of threats to AI systems, best practices for managing risk, and recommended mitigations for self-hosted and third-party hosted AI systems. The guide also offers mitigation considerations for organizations with guiding questions to help organizations assess an AI system’s cybersecurity implications. Organizations that use or are considering AI systems need to assess the system’s cyber security implications and evaluate the benefits, risks and consequences of the system within the organization’s context. We encourage these organizations to review this guide.

CISA and FBI Release joint Cybersecurity Advisory (CSA) Known Indicators of Compromise Associated with Androxgh0st Malware

CISA and FBI released joint Cybersecurity Advisory (CSA) Known Indicators of Compromise Associated with Androxgh0st Malware to disseminate known indicators (IOCs) and tactics, techniques and procedures (TTPs) associated with threat actors using Androxgh0st malware.  

Androxgh0st malware establishes a botnet to scan for websites using the Laravel web application framework. On these websites, threat actors have attempted to determine if the domain’s root-level .env file is exposed and if they contain credentials for accessing additional services.  

Multiple investigations are ongoing regarding Androxgh0st malware’s capability to establish a botnet and further identify and compromise vulnerable networks. Threat actors exploiting Androxgh0st malware have been observed exploiting specific vulnerabilities which could lead to remote code execution; those common vulnerabilities and exposures (CVE) are CVE-2017-9841 (PHP Unit Command), CVE-2021-41773 (Apache HTTP Server versions) and CVE-2018-15133 (Laravel applications).  

Recommended actions include prioritize patching known exploited vulnerabilities in internet-facing systems; review and ensure only necessary servers and services are exposed to the Internet; and review platforms or services that have credentials listed in .env files for unauthorized access or use.  

All organizations are urged to review the advisory, implement recommended mitigations, and validate your organization’s security controls against the threat behaviors mapped to the MITRE ATT&CK.  

Read the latest Cybersecurity Advisories and Alerts on CISA.gov

Subscribe here to receive alerts via email of Cybersecurity Advisories and other cybersecurity topics from CISA.

CISA, FBI and EPA Release Incident Response Guide for Water and Wastewater Systems Sector

Cybersecurity and Infrastructure Security Agency (CISA), Environmental Protection Agency (EPA) and Federal Bureau of Investigation (FBI), published “Incident Response Guide: Water and Wastewater Systems (WWS) Sector.” Developed in collaboration with over 25 WWS Sector industry, nonprofit, and state/local government partners, this guide assists WWS owners and operators with best practices for cyber incident response and information about federal roles, resources and responsibilities for each stage of the response lifecycle. This resource covers the four stages of the incident response lifecycle. For each stage, the guidance identifies ways to interface with the federal-level response and highlights key measures to better posture and prepare for collaboration with federal partners. Technical expertise is not required to understand and use this guide. All WWS utilities are encouraged to use this incident response guide to augment their incident response planning and collaboration with federal partners and the WWS before, during, and following a cyber incident. Familiarity with this guide will better prepare WWS utilities to respond to—and recover from—a cyber incident. For more information and resources, WWS utilities are encouraged to visit cisa.gov/water.

CISA's Stakeholder Engagement Division (SED) Sector Liaisons

CISA’s Stakeholder Engagement Division (SED) Sector Liaisons

There are 16 critical infrastructure sectors vital to the United States, with assets, systems, and networks deemed crucial for national security, economic well-being, public health or safety. Each sector has unique characteristics, operating under the oversight of a designated Sector Risk Management Agency (SRMA). DHS/CISA serves as the SRMA for eight sectors, while for the other eight, CISA appoints Sector Liaisons to coordinate with relevant Federal departments and agencies. 

Who are the Liaisons and what do they do?

CISA collaborates with other federal agencies managing critical infrastructure risks, implementing various coordination mechanisms. Sector Liaisons, acting as subject matter experts, engage with their assigned sectors to understand SRMA priorities and challenges, advancing CISA's mission. Due to sector-specific differences, Liaisons focus on enhancing risk reduction capabilities, building security capacity, and supporting CISA as the National Coordinator, functioning in discrete areas of responsibility to protect cyber and physical infrastructure. 

Additionally, the SRMA Sector Liaisons are led by Section Chief Justin Rinck, who can be reached at: justin.rinck@cisa.dhs.gov. For more information on the SRMA Sector Liaisons, please reach out to: srmaliaisons@cisa.dhs.gov.

Handling Destructive Malware

Destructive malware can threaten an organization’s access to critical assets and data, but there are steps organizations can take to protect their enterprise networks before and after a destructive malware incident. Destructive malware is malicious code that is designed to destroy data. It impacts the availability of critical assets and data, presenting a direct threat to an organization’s daily operations. Organizations must enhance vigilance and assess their readiness, including planning, preparation, detection, and response for continuously evolving indicators and modules related to destructive malware. It is crucial to actively prepare for and respond to such events. Destructive malware leverages common communication tools, spreading through email, instant messages, website-delivered Trojan horses, and virus-infected files from peer-to-peer connections. It aims to exploit system vulnerabilities for discreet access. The malware can target various systems and spread across networks. Organizations should evaluate their environment for unusual channels facilitating malware delivery and propagation. This includes assessing enterprise applications like patch management, asset management, remote assistance software, antivirus software, systems of administrative personnel, centralized backup servers, and file shares. Additionally, threat actors might compromise resources like centralized storage devices and network devices, posing risks such as direct access to data warehouses and manipulation of routing tables that could impact critical network resources. To learn more about best practices and planning strategies to strengthen an organization’s resilience against destructive malware, check out CISA’s Blog on Handling Destructive Malware.

The Cloud Log Aggregation Warehouse (CLAW)

The Cloud Log Aggregation Warehouse (CLAW) provides persistent cloud monitoring of FCEB cloud infrastructure and assets. It ingests logs from specific services from participating FCEB agencies, such as various components of DHS, Department of State (DoS), Department of Transportation (DoT), and Department of Energy (DOE). Service logs ingested from participating agencies vary and currently CLAW has capability to gather information from Microsoft Azure Active Directory, Microsoft M365, Azure Firewall, and authentication logs from Amazon Web Services (AWS) Cloud Trail.

CLAW is built using cloud native services, allowing FCEB agencies to take advantage of low inter-region data transfer cost. Cloud data collected from individual agencies preserves agency data isolation and each agency has a dedicated S3 data store.

CLAW has enabled analytics groups to effectively unite and actively work towards a common goal of producing better cloud analytics. Prior to the introduction of CLAW, different analytic groups were fragmented across CSD; little to no communications occurred between groups and efforts in analytics development were redundant. OTD and CFS were the major driving forces of this project. CLAW has plans for expansions for both onboarding new FCEB agency partners and expanding logs collected from more services.

Release of the Connected Communities Procurement and Implementation Guidance

Connected Communities Initiative (CCI) released the Connected Communities Procurement and Implementation Guidance. Developed in close collaboration between CCI and the Department of Homeland Security Office of Cyber, Infrastructure, Risk, and Resilience Policy, this guidance is designed to encourage conversations at the state, local, tribal and territorial (SLTT) government levels about critical questions to ask when procuring and implementing smart and connected technologies, and to serve as a resource for SLTT governments to plan for security and resilience in their supply chains. The guidance is illustrated by two infographics. The first provides a list of questions that local leaders can utilize internally to help clarify their procurement and implementation goals. The second infographic presents a list of questions for local leaders to ask third-party vendors. The Connected Communities Procurement and Implementation Guidance can be found here: Connected Communities Procurement and Implementation Guidance | CISA.

New ChemLock Resources

CISA OBP Launches Comprehensive Bomb Threat Guide    As the threat landscape evolves, security measures must respond in kind to address it. The recently published CISA Office for Bombing Prevention (OBP) Bomb Threat Guide was developed to help decision makers respond to bomb threats in an orderly and controlled manner. When it comes to bomb threats, having a clear, specific and well-developed plan can save lives, protect critical infrastructure, and reduce the financial impact. Each bomb threat is unique and requires rapid evaluation to mitigate the immediate impact and manage in accordance with site needs. CISA OBP recommends owners and operators periodically review bomb threat guidance (including this product) and collaborate with first responders to establish and rehearse a bomb threat management plan that addresses each risk level appropriate for their specific site location.   Highlights from the Bomb Threat Guide include:  Planning and preparation information  Threat assessments  Response options  Suspicious items recognition   Additional resources and training opportunities   CISA’s ChemLock program released three new customizable templates that facilities and organizations can use as part of developing and implementing a facility security plan. ChemLock: Chemical Inventory Template – This document serves as a template for maintaining an accurate inventory of the location, quantities, and physical states of chemicals at your facility. ChemLock: Personnel Background Checks Policy Template – This document includes background checks that facilities can consider conducting for personnel and serves as a template for a personnel background checks policy. ChemLock: Security Organization Roles and Responsibilities Template – This document includes a listing of security roles and responsibilities. It serves as a template to assist your facility in developing and maintaining a security organization. For more information on how to develop a facility security plan, see the ChemLock Security Plan webpage or contact the ChemLock team at ChemLock@cisa.dhs.gov.

CISA Considers Software Developers a Key Part of the Cybersecurity Workforce

CISA published a blog titled We Must Consider Software Developers a Key Part of the Cybersecurity Workforce. Even after seeing some of the most brazen ransomware attacks ever and increasingly bold cyberattacks on the federal government by nation-state adversaries within the past few years, cybersecurity in computer science education remains an elective. Indeed, of the top 24 American universities in computer science, 23 still don’t require a cybersecurity course.    Cybersecurity is viewed as a subdiscipline, much like graphics or human-computer interaction – not essential knowledge that every future software developer should be equipped with as they enter the workforce. This oversight is unacceptable. All too often, attacks exploit simple weaknesses that any developer with basic security knowledge could have stopped.    At CISA, we’re continuing to drive the mission of making software secure by design. This mission includes working across academia and industry to further establish cross-disciplinary education for both computer science and cybersecurity professionals to better integrate security in the earliest stages of product development.   To learn more, read our full blog post and visit CISA’s Secure by Design webpage.

CISA Launches #Protect2024 Resources Webpage for State and Local Election Officials

Today, as part of its unwavering commitment to safeguarding the integrity of the nation’s electoral processes, CISA proudly announced the launch of the #Protect2024 website.  

As part of the #Protect2024 initiative, CISA developed a webpage to serve as a central point for consolidated critical resources, training lists and security service offerings to support the over 8,000 election jurisdictions for the 2024 election cycle. These efforts build upon prior years of working with elections officials to mitigate the cyber, physical, and operational risks to election infrastructure.  

CISA encourages stakeholders, government officials, and the public to explore the #Protect2024 website, joining the collective effort to ensure a secure and resilient 2024 election cycle. 

U.S. and International Partners Publish Cybersecurity Advisories on People’s Republic of China State-Sponsored Hacking of U.S. Critical Infrastructure

CISA in partnership with U.S. and international government agencies, published a Joint Cybersecurity Advisory (CSA) on malicious activity by a People’s Republic of China (PRC) state-sponsored cyber actor, known as Volt Typhoon, to compromise critical infrastructure and associated actions that should be urgently undertaken by all organizations.

CISA and its U.S. government partners have confirmed that this group of PRC state-sponsored cyber actors has compromised entities across multiple critical infrastructure sectors, including communications, energy, transportation, and water and wastewater, in the United States and its territories. The data and information CISA and its U.S. government partners have gathered strongly suggest the PRC is positioning itself to launch destructive cyberattacks that would jeopardize the physical safety of Americans and impede military readiness in the event of a major crisis or conflict with the United States.

In addition to the joint Cybersecurity Advisory, CISA and our partners also released complementary Joint Guidance to help all organizations effectively hunt for and detect the sophisticated types of techniques used by actors such as Volt Typhoon, known as “living off the land.” In recent years, the U.S. has seen a strategic shift in PRC cyber threat activity from a focus on espionage to pre-positioning for possible disruptive cyberattacks against U.S. critical infrastructure. By using “living off the land” techniques, PRC cyber actors blend in with normal system and network activities, avoid identification by network defenses, and limit the amount of activity that is captured in common logging configurations.

Today’s joint CSA is based primarily on technical insights gleaned from CISA and industry response activities at victim organizations within the United States, primarily in communications, energy, transportation, and water and wastewater sectors. Our complementary Joint Guidance is derived from those insights as well as previously published products, red team assessments, and industry partners.

Quarterly ChemLock Trainings

CISA’s ChemLock program provides the ChemLock training courses every quarter on a first-come, first-serve basis. ChemLock: Introduction to Chemical Security This course provides an introduction to identifying, assessing, evaluating, and mitigating chemical security risks. This easy-to-understand overview identifies key components and best practices of chemical security awareness and planning to help kickstart chemical security discussions at your facility. This course runs 1-2 hours in length and is appropriate for all personnel regardless of their level of involvement with dangerous chemicals. Register for April 8, 2024 – Noon-2 pm ET Register for July 11, 2024 – 1-3 pm ET Register for October 7, 2024 – 11 am-1 pm ET ChemLock: Secure Your Chemicals Security Planning This course walks through how to create a tailored, scalable security plan that meets the business model and unique circumstances of a facility. Participants will learn the key elements of a chemical security plan and benefit from examples, lessons learned, and best practices. This course runs 2-3 hours in length and is designed to help leadership, facility security personnel, and other applicable personnel understand, develop, and implement a facility security plan. Register for May 6, 2024 – Noon-3 pm ET Register for August 7, 2024 – 11 am-2 pm ET Register for November 7, 2024 – 1-4 pm ET For more information or to request a specific training for your facility, please visit the ChemLock Training webpage.

Region 8 Training and Exercise Resources Webinar

The Cybersecurity and Infrastructure Security Agency (CISA) is hosting a 1-hour webinar on March 19th, 2024, to provide information on training & exercise resources to complement your critical infrastructure and community preparedness programs. Whether you have a well-established program or are looking for a place to start, the webinar will provide useful information to help navigate available training & exercise tools and materials. The topics will include training and exercise resources to support the protection and resilience of all critical infrastructure sectors, with a focus on cybersecurity, physical infrastructure security (including soft targets and crowded places), chemical security, and emergency communications. For more information about the CISA Region 8 Training & Exercise program email CISARegion8trainingexercise@cisa.dhs.gov or visit https://www.cisa.gov/about/regions/region-8.

The CISA Community Bulletin is a monthly publication that shares cybersecurity webinars and workshops, new publications, and best practices.

To access past editions of this CISA Community Bulletin newsletter, please visit the CISA Community Bulletin archive.