Space Force wants a ‘bloodhound’ to sniff out cyberthreats

U.S. Space Force has kicked off development of a seven-year contract for cybersecurity services to protect the ground networks that manage its space assets.

Space Force’s cyber operations division has dubbed the contract Digital Bloodhound and it will be a multiple-award, task-order contract. The solicitation is expected before the end of the year with an award by the end of March 2023.

The cyber operations division currently has two product lines for defensive requirements for cybersecurity and national security called Manticore and Kraken, according to the posting.

Full Article

GAO Pushes EPA to Implement Cyber Risk Assessment Framework

To better manage and protect against cybersecurity risks the Environmental Protection Agency (EPA) must establish an enterprise-wide cybersecurity risk assessment framework, the Government Accountability Office (GAO) said in its latest annual priority recommendations report to the agency.

GAO outlined 12 priority recommendations for EPA that fall into six focus areas – including ensuring cybersecurity at EPA.

Federal agencies continue to face a growing number of cyber threats to their systems and data. According to Federal guidelines, agencies need to effectively identify, prioritize, and manage their cyber risks to protect themselves against these threats.

Full Article

NCCoE Releases Draft Project Description for DevSecOps

The National Cybersecurity Center of Excellence (NCCoE) has released a new draft project description, Software Supply Chain and DevOps Security Practices: Implementing a Risk-Based Approach to DevSecOps. Publication of this project description begins a process to solicit public comments for the project requirements, scope, and hardware and software components for use in a laboratory environment.

Full Article

80% of Firms Suffered Identity-Related Breaches in Last 12 Months

Rapidly growing employee identities, third-party partners, and machine nodes have companies scrambling to secure credential information, software secrets, and cloud identities, according to researchers.

In a survey of IT and identity professionals released Wednesday from Dimensional Research, almost every organization — 98% — experiences rapid growth in the number of identities that have to be managed, with that growth driven by expanding cloud usage, more third-party partners, and machine identities. Furthermore, businesses are also seeing an increase in breaches because of this, with 84% of firms suffering an identity-related breach in the past 12 months, compared with 79% in a previous study covering two years.


Europol Busts Phishing Gang Responsible for Millions in Losses

Europol on Tuesday announced the dismantling of an organized crime group that dabbled in phishing, fraud, scams, and money laundering activities.

The cross-border operation, which involved law enforcement authorities from Belgium and the Netherlands, saw the arrests of nine individuals in the Dutch nation.

The suspects are men between the ages of 25 and 36 from Amsterdam, Almere, Rotterdam, and Spijkenisse and a 25-year-old woman from Deventer, according to a statement from the National Police Force.


CISA is Developing Guidelines For Managing Cyber Supply Chain Risks

The Cybersecurity and Infrastructure Security Agency is developing a guide to help agencies overcome the challenges of managing cyber supply chain risks.   

According to Brian Paap, Cyber Engineering Consultant at CISA, the agency has been working on how to approach Cyber Supply Chain Risk Management (CSCRIM) over the past two years.

CISA recently ran a pilot designed to figure out all of the measures required to stand up and sustain a CSCRIM program within federal departments and agencies.  

Paap noted CISA has recently developed the Overview and Guidelines document, which combines learnings from NIST 161 and elements of NIST 853, Rev 5 and several other resources.   


Russian govt hackers hit Ukraine with Cobalt Strike, CredoMap malware

The Ukrainian Computer Emergency Response Team (CERT) is warning that Russian hacking groups are exploiting the Follina code execution vulnerability in new phishing campaigns to install the CredoMap malware and Cobalt Strike beacons.

The APT28 hacking group is believed to be sending emails containing a malicious document name “Nuclear Terrorism A Very Real Threat.rtf.”. The threat actors selected the topic of this email to entice recipients to open it, exploiting the fear that’s spread among Ukrainians about a potential nuclear attack.

Threat actors also used a similar tactic in May 2022, when CERT-UA identified the dissemination of malicious documents warning about a chemical attack.


Cyber Insurance: Action Needed to Assess Potential Federal Response to Catastrophic Attacks

Cyber insurance can help offset costs of some common cyber risks, like data breaches or ransomware. But cyber risks are growing, and cyberattacks targeting critical infrastructure—like utilities or financial services—could affect entire systems and result in catastrophic financial loss.

Insurers and the government’s terrorism risk insurance may not be able to cover such losses. For example, the government’s insurance may only cover cyberattacks if they can be considered “terrorism” under its defined criteria.


Dark Web Sites Selling Western Weapons Allegedly Sent to Ukraine

Dark Web Sites Selling Western Weapons Allegedly Sent to Ukraine
Source: Bleeping Computer
Published: June 9, 2022
Several weapon marketplaces on the dark web have listed military-grade firearms allegedly coming from Western countries that sent them to support the Ukrainian army in its fight against the Russian invaders. Supposedly, these weapons were somehow put aside from the received supplies and are now being made available to terrorists looking to buy rocket launchers and other high-impact attack systems. While the listings appear genuine and the offered weapons are priced realistically, the chances of them being created by pro-Russian actors for propaganda purposes are high.

How Space Development Agency contractors are mitigating supply chain issues

How Space Development Agency contractors are mitigating supply chain issues
Source: C4ISRNET
Published: June 8, 2022
Long before the Space Development Agency awarded its first contract, officials knew that building a diverse, strong supply base would be an important part of its plan to produce and field constellations of hundreds of small satellites. The agency’s vision for using these proliferated constellations to augment and boost the resilience of traditional U.S. Department of Defense systems required a more flexible approach from the government and industry, officials told C4ISRNET. And so, from the beginning, SDA leadership challenged its prime contractors to find ways to foster competition among their supplier base and build redundancy into their strategies.