The Cybersecurity 202: The Biden administration aims big on cybersecurity spending

The White House wants a 14 percent across the board funding hike amid a rash of damaging hacks. ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌  ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌  ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌  ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌  ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌  ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌  ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌  ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌  ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌  ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌ ‌

Sign up for this newsletter Read online Your daily cybersecurity policy download.       By By Joseph Marks with Aaron Schaffer  Email The Biden administration wants to put its money where its mouth is when it comes to protecting government computer systems from hackers.  The White House is asking Congress to commit roughly $10 billion to civilian government cybersecurity next year – a jump of nearly 14 percent. Far more than that would go to funding military cyber operations, but the exact number isn't clear because so much military cyber work is classified.  The super-sized requests reflect a punishing past six months for the nation's cybersecurity, including major hacks from Russia and China, which stole reams of classified government information. It also reflects the government's scrambling efforts to respond to a wave of criminal hacks, including a ransomware attack against Colonial Pipeline that played havoc with gas supplies in the southeastern United States.  U.S. President Joe Biden delivers remarks at the White House. REUTERS/Kevin Lamarque/File Photo The cyber proposal is part of a blockbuster $6 trillion administration budget request aimed at broadening the social safety net and reshaping the U.S. economy.  The proposed budget includes $750 million worth of fixes designed specifically to "respond to lessons learned" from the Solar Winds hack.  Another $110 million would go to the Homeland Security Department's Cybersecurity and Infrastructure Security Agency, which is increasingly acting as a cybersecurity traffic cop across the government.  There's also $500 million for a fund to retire outdated government technology systems that can make federal agencies more vulnerable to hacking and to replace them with updated systems with more modern cybersecurity protections.   The proposal also funds a raft of new programs and offices recommended last year by a congressional-led cybersecurity panel.  That includes funding a new cyber director's office inside the White House tasked with creating a unified government response to cybersecurity challenges.  Members of the Cyberspace Solarium Commission described creating that office as one of their most important recommendations and it was later mandated by Congress. Biden nominated Chris Inglis, a former National Security Agency deputy director and a member of the commission to fill the role but he hasn't been confirmed yet.  Here's more from Christian Beckner, vice president at the National Retail Federation industry group: And from Politico's Eric Geller: Here's a full rundown from CyberScoop's Tim Starks.   The White House request is just a blueprint for Congress, so the big new investments are far from guaranteed.  But congressional cybersecurity advocates are pushing for major investments along similar lines. Reps. Mike Gallagher (R-Wisc.) and Jim Langevin (D-R.I.) are urging House appropriators to give a $400 million boost to DHS cybersecurity. Gallagher was a co-chair of the solarium commission. Langevin was a member of the commission and is co-founder of the Congressional Cybersecurity Caucus.   Rep. Dutch Ruppersberger (D-Md.) is pushing appropriators to add more funding for all of DHS's defense-related activities, including cybersecurity. Ruppersberger, who was formerly top Democrat on the House Intelligence Committee, has long advocated for rejiggering arcane congressional budget rules, so there's more money available for DHS's cybersecurity work.  Sen. Maggie Hassan (D-N.H.) also wrote to the White House, expressing concern that the president's overall budget request for DHS isn't enough for the agency to deal with cybersecurity and other threats. Hassan chairs the Senate Homeland Security Committee's panel on emerging threats.  "I am concerned that the budget request for DHS is essentially flat, and as a result may not provide what is needed to address the myriad threats facing the United States today," she wrote.  And some cybersecurity pros are also pushing for more funding. Here's Katie Moussouris, CEO of Luta Security and a consultant on government cybersecurity projects: Jamieson Brown, senior director of global government affairs at Tenable Security:   Share The Cybersecurity 202    The keys A Danish intelligence agency helped the NSA spy on European politicians including German Chancellor Angela Merkel. Merkel condemned the surveillance (Andreas Gora/Pool/EPA-EFE/Shutterstock) The NSA used the collaboration to target politicians in France, Germany, Norway and Sweden from 2012 to 2014, according to an investigation by Danish public broadcaster DR. European politicians including Merkel and French president Emmanuel Macron condemned the spying. French President Emmanuel Macron declared that wiretapping "is not acceptable between allies" and asked the United States for clarity on the reports, Rick Noack and Ellen Nakashima report.  The report comes eight years after tensions first flared between the Obama administration and Merkel over reports U.S. spies tapped the chancellor's cellphone. The revelations came from documents leaked by former NSA contractor Edward Snowden.  German President Frank-Walter Steinmeier, who was also reportedly targeted by the spying, and a spokesperson for Merkel said they did not know Denmark was involved in the spying until DR's report, the BBC reported. The NSA and Denmark's Defense Intelligence Service did not comment. Colonial Pipeline delayed voluntary TSA cybersecurity reviews before it was hit with ransomware.  Colonial has delayed a cybersecurity assessment three times since last year, a spokesman said (AP Photo/Chris Carlson) It's not clear whether the review would have averted a ransomware hack on the pipeline last month, but the delays reveal weaknesses in the TSA's voluntary approach to oversight of pipeline security, Ellen Nakashima, Lori Aratani and Douglas MacMillan report. The Biden administration scrapped the voluntary measures, which were used for two decades, in favor of a mandatory system last week. A proposed cybersecurity assessment of Colonial was delayed three times since last year because the company was planning to move its headquarters and dealing with the effects of the pandemic, Colonial spokesman Kevin Feeney said. The TSA debuted its first pipeline security guidelines in 2010 and more detailed cybersecurity checks in 2018. "The lesson, particularly in recent months, is that we need to step up the incentives for the critical infrastructure to strengthen cybersecurity," former Secretary of Homeland Security  Michael Chertoff said. "Positive incentives are important, but sometimes you need to be mandatory." A U.N. group including the United States, China and Russia agreed on new rules for cyberspace. The cyber norms are being promoted as a step toward a safer cyberspace (Ludovic Marin/AFP via Getty Images) The agreement from a United Nations Group of Governmental Experts includes new guidance on how nations should respond to hacks inside their territories and how they should ask each other for help, the U.S. representative and acting State Department cyber coordinator Michele Markoff said.  There is no guarantee that nations will actually adhere to the broad rules outlined in the report. But the United States and other countries are championing the report as a step toward a safer cyberspace.  "Of course, it is only with implementation we can truly work out how international cyber stability can be achieved," Markoff said. "With our new report, we are calling on all states to put this framework into practice." The report itself hasn't been released yet.    Securing the ballot The D.N.C. Didn't Get Hacked in 2020. Here's Why. By New York Times ●  Read more »     Cyber insecurity Cyber attack shuts down global meat processing giant JBS By Australian Broadcasting Corporation ●  Read more »   Secret chats show how cybergang became a ransomware powerhouse By The New York Times ●  Read more »     Chat room Cybersecurity professionals continued to debate a hack of USAID's email marketing system. Rendition Infosec's Jake Williams: Bloomberg's Joseph Menn and the New York Times' Nicole Perlroth:   Daybook Rep. John Katko (R-N.Y.), the top Republican on the House Homeland Security Committee, Rep. Ami Bera (D-Calif.) and former Australian Prime Minister Malcolm Turnbull discuss Australia-U. S. collaboration on issues like cybersecurity to compete with China today at 6 p.m. Microsoft's two-day European Cyber Agora conference kicks off on Wednesday. Dr. Joseph Evans, the Pentagon's Principal Director for 5G, and other officials speak at the Billington Cybersecurity 5G Security Summit, on Thursday at 11 a.m.   Secure log off   We think you'll like this newsletter Check out Must Reads for a curated selection of our best journalism in your inbox every Saturday, plus a peek behind the scenes into how one story came together. Sign up »

Manage my email newsletters and alerts | Unsubscribe from The Cybersecurity 202 | Privacy Policy | Help You received this email because you signed up for The Cybersecurity 202 or because it is included in your subscription. ©2021 The Washington Post | 1301 K St NW, Washington DC 20071