Cyber Law China

[Amilcar Labrosse]

CloseTopics Topics Cybersecurity Best Practices Cyber Threats and Advisories Critical Infrastructure Security and Resilience Election Security Emergency Communications Industrial Control Systems Information and Communications Technology Supply Chain Security Partnerships and Collaboration Physical Security Risk Management How can we help? GovernmentEducational InstitutionsIndustryState, Local, Tribal, and TerritorialIndividuals and FamiliesSmall and Medium BusinessesFind Help LocallyFaith-Based CommunityExecutivesHigh-Risk Communities Spotlight Resources & Tools Resources & Tools All Resources & Tools Services Programs Resources Training Groups News & Events News & Events News Events Cybersecurity Alerts & Advisories Directives Request a CISA Speaker Congressional Testimony CISA Conferences CISA Live! Careers Careers Benefits & Perks HireVue Applicant Reasonable Accommodations Process Hiring Resume & Application Tips Students & Recent Graduates Veteran and Military Spouses Work @ CISA About About Culture Divisions & Offices Regions Leadership Doing Business with CISA Site Links Reporting Employee and Contractor Misconduct CISA GitHub CISA Central 2023 Year In Review Contact Us Free Cyber Services#protect2024Secure Our WorldShields UpReport A Cyber Issue

According to our joint advisory on PRC state-sponsored activity, PRC state-sponsored cyber actors are seeking to pre-position themselves on information technology (IT) networks for disruptive or destructive cyberattacks against U.S. critical infrastructure in the event of a major crisis or conflict with the United States:

This Advisory focuses on a set of techniques, called "living off the land," used by cyber actors to maintain anonymity within IT infrastructure by abusing tools already present in the environment such as PowerShell, WMI, and FTP clients. Also see the accompanying fact sheet.

This threat detection and monitoring capability for IT and operational technology provides persistent visibility into adversary activity targeting critical infrastructure networks and can drive urgent mitigation where activity is identified.

Gen. Paul M. Nakasone, commander, U.S. Cyber Command, on Tuesday, April 5, 2022 will testify in front of the Senate Committee on Armed Services and the House Committee on Armed Services, Cyber, Innovative Technologies, and Information Systems Subcommittees.

Opening paragraph for the Senate Committee On Armed Services: Chairman Reed, Ranking Member Inhofe and distinguished members of the Committee, thank you for your enduring support and the opportunity today to represent the hard working men and women of U.S. Cyber Command (USCYBERCOM). I am honored to be here and testify beside Assistant Secretary of Defense Christopher Maier and General Rich Clarke.

Opening paragraph for the House Armed Services Committee, Subcommittee On Cyber, Innovative Technologies and Information Systems: Chairman Langevin, Ranking Member Banks and distinguished members of the Committee, thank you for your enduring support and the opportunity today to represent the hard working men and women of U.S. Cyber Command (USCYBERCOM). I am honored to be here and testify beside Assistant Secretary of Defense John Plumb.

Let me begin by acknowledging the dedicated service of our Service members and civilians at USCYBERCOM. Their mission is to plan and execute global cyber operations, activities and missions to defend and advance national interests in collaboration with domestic and international partners across the full spectrum of competition and conflict. Our three lines of operation are to:

These measures were made possible by the patient investments in cyberspace operations capabilities and capacity over the last decade, as well as by the lessons that we as a Department and a nation have learned from operational experience. The current crisis is not over, but I am proud of the response of our people and confident in their ability to deliver results no matter how long it lasts. Their grit and ingenuity have been inspiring.

Cyberspace is a dynamic and inter-connected domain where near-peer adversaries seek to exploit gaps and seams between our organizations and authorities. Such adversaries use a variety of cyber means to compromise our systems, distort narratives and disseminate misinformation. These actions threaten our national interests by impairing the safety and security of our citizens, stealing intellectual property and personal information while seeking to undermine the legitimacy of our institutions. Our adversaries have demonstrated sophisticated cyber-attack capabilities for use in competition, crisis and conflict, but I am confident that USCYBERCOM is well postured to meet those challenges.

USCYBERCOM (with JFHQ-DODIN) also defended the DODIN against cyber threats and helped ensure that disruptions to its systems and data remained inconsequential and brief. We continue to innovate in enhancing DODIN defenses and countering adversary threats; indeed, we must, because our adversaries are agile and adaptive. Key to this effort is building resilience in our systems and platforms while preparing the Department, the other Combatant Commands and Defense Industrial Base (DIB) companies to operate even in degraded cyber environments.

Our success against these growing challenges is a result of sustained efforts and investments, not to mention a lot of hard work. I should add that that work over the last two years took place under COVID-19 mitigations. USCYBERCOM has been on-mission, running operations and exercises with the joint force and domestic and foreign partners throughout the pandemic, with negligible workforce transmission and slight impact to operations. We will continue to prioritize workplace safety, workforce confidence, and mission continuity.

Our adversaries also target our economy. DIB companies are on the frontlines in cyberspace and are constantly targeted by malicious cyber actors. Over the past year, we have deepened our relationships with private industry through voluntary information sharing. Since the nation's critical infrastructure and systems are largely in private hands, these relationships have directly enhanced our operations, in addition to the security of their commercial systems.

Fourth is building a skilled workforce through recruitment, training, and retention. Talent is key to preserving our competitive edge against our adversaries. USCYBERCOM has improved its civilian hiring with the use of its congressionally-granted Cyber Excepted Service (CES) authorities, which allow us to offer competitive compensation packages for high-demand expertise. In addition, a diverse, talented workforce that expands equity and inclusiveness is an enduring goal. To recruit and retain a skilled military workforce, we are also grateful for the authorities Congress has granted the Services to offer flexible promotion and commissioning avenues in support of the CMF.

Partnerships with academia will aid in engaging the future cyber workforce and enriching the strategic dialogue about cyber. Our new Academic Engagement network began last year and comprises 93 institutions, including 10 minority-serving institutions, across 40 states and the District of Columbia, as of March 25, 2022. Interest in partnering with USCYBERCOM is strong and growing.

Training and proficiency are improving through our mission simulation capabilities, particularly the Persistent Cyber Training Environment (PCTE). The PCTE is helping us mature cyber operations tradecraft, enhance individual proficiencies and enable faster attainment of team certification and collective training in maneuvers such as Exercise CYBER FLAG.

The Reserve Component is critical to protecting the nation in cyberspace. As a result of the partnership between USCYBERCOM and the National Guard Bureau during the 2020 election, Guard units could rapidly share information on malicious cyber activity with state and local authorities. Members of the National Guard and Reserve often have private-sector experience in fields of strong interest to USCYBERCOM. In addition, the ability of the National Guard and Reserve to hire cyber talent has been especially helpful in retaining the contributions of Service members who decide to leave active duty upon completion of their commitment; members can transfer to a part-time status.

USCYBERCOM is grateful to this Committee and Congress for granting us Enhanced Budget Control over resources dedicated to the Cyber Mission Force. With this authority, USCYBERCOM will improve direction, control and synchronization of investments for cyber operations across the Department of Defense.

The men and women at U.S. Cyber Command are grateful for the support this Committee has given to our Command. We can only succeed with a strong partnership with Congress. Thank you, and now I look forward to your questions.

The United States is deeply concerned that the PRC has fostered an intelligence enterprise that includes contract hackers who also conduct unsanctioned cyber operations worldwide, including for their own personal profit. As detailed in public charging documents unsealed in October 2018 and July and September 2020, hackers with a history of working for the PRC Ministry of State Security (MSS) have engaged in ransomware attacks, cyber enabled extortion, crypto-jacking, and rank theft from victims around the world, all for financial gain.

Before Microsoft released its security updates, MSS-affiliated cyber operators exploited these vulnerabilities to compromise tens of thousands of computers and networks worldwide in a massive operation that resulted in significant remediation costs for its mostly private sector victims.

In the past few months, we have focused on ensuring the MSS-affiliated malicious cyber actors were expelled from public and private sector networks and the vulnerability was patched and mitigated to prevent the malicious cyber actors from returning or causing additional damage.

3a8082e126