On June 20th, 2024 Barrett Adams-Simmons, Deputy Regional Director of CISA Region 10 joined us to discuss “The 2024 CISA Cyber Threat Landscape.”

A note for attorneys in Washington State: The live event qualified for Continuing Legal Education (MCLE Activity # 2022745). The recorded replay is available below and at EXP Academy The recorded event qualifies as Continuing Legal Education (MCLE Activity # 2024578).

A video and transcript appear below.

The 2024 CISA Cyber Threat Landscape Transcript

Kelly Paletta, EXP Technical:

Good afternoon, everyone. Welcome to our webinar. Today, we’re going to be discussing The 2024 Cyber Threat Landscape.

We have a terrific guest speaker lined up to present to you today. She has a unique perspective, valuable insights, and she’ll be offering recommendations and references to resources that you can use to make your organization more secure and perhaps more operationally efficient as well.

2024 CISA Cyber Threat Landscape Introductions and Overview:

I want to share a little bit of overview information. Bear with me here…

I have a few announcements to make at the top of our session today. One thing I wanted to point out is that this is an interactive session. What you get out of this session depends a little bit on what you contribute. Questions are welcome. You can submit questions via the Q&A or the chat session. We want you to speak up.

In terms of our agenda, I have some initial announcements that we’re in right now.

Our guest speaker will speak, and she has a contiguous presentation prepared for you.

We’ve allowed a lot of time for questions and answers, so be sure to let us know if there’s something you’re concerned about or something that isn’t clear. Odds are, there’s somebody else who shares your concerns or has the same lack of clarity. Please speak up on those issues.

You can submit questions either via the chat session or the Q&A feature in Zoom. The difference between the two is that if you submit a question via the chat session, it will be visible to everyone in attendance. If you use the Q&A feature, it will only go to the moderator and our presenter, so there’s a bit more privacy, confidentiality, or anonymity with the Q&A feature. Either way is welcome. We do want to hear from you as we go.

One question that comes up all the time is, is this event being recorded? It is. I will make the recording available about a week from today. I’ll send an email that includes a link to the recording. Usually, we publish it on our blog at EXP Technical, as well as on YouTube and our technology training site, EXP Academy.

Share Knowledge. Share Success. (Audience Demographics.)

Before I introduce our speaker, I wanted to share a little bit of information about the demographics of who registers for these events or who’s in attendance.

We have around 100 people in attendance. If you look at the pie chart here, you can see a pretty broad cross-section of the Pacific Northwest regional economy.

The legal profession is well-represented because this event qualifies for continuing legal education. [Live event is MCLE Activity # 2022745. Recorded event is MCLE Activity # 2024578.]  So it makes sense that there are a lot of attorneys here.

At EXP Technical, we provide IT support to many law offices, nonprofit organizations, architectural, engineering, and construction firms, so it makes sense that those industries are well-represented.

Cybersecurity is a Team Sport

My point in bringing this up is to let you know that you’re not alone.

Sometimes, when you attend this event, maybe you’re listening with headphones or viewing the recording later on, and cybersecurity can feel like an individual sport or a lonely venture, but it really is a team effort. We have people attending from the Pacific Northwest region and some from elsewhere in the world. Primarily, attendees are from Eastern Washington, North Idaho, Spokane, Coeur d’Alene area, stretching westward to the West Sound region, Bremerton, and that side of the Puget Sound area, and from north to south from Bellingham [through Everett, Seattle, Bellevue, Tacoma, Olympia] all the way down to Hillsboro, Oregon.

There are a lot of your neighbors here, and the good news is that by attending these events and by hosting them, it’s our goal to help supercharge the region. By attending, you’re doing your part too to keep the region more secure.

As you know, the Pacific Northwest is an economic powerhouse. We’re more productive than just about anywhere else in the world, very tech-savvy, and highly educated. We kind of punch above our weight here. Events like this are one way that we help keep the region more secure.

Finally, my last point on this slide is the title and quote: “Share knowledge, share success.” That’s a core value of ours at EXP Technical.

And “Knowledge shared is power multiplied.” Feel free to share the recording or whatever you take away from this presentation with your colleagues, co-workers, on social media, or wherever you think others might benefit.

That’s a good segue to introduce our guest speaker today. We are delighted and grateful to have Barrett Adams-Simmons joining us.

Her experience and work history include engagements in both the public and private sectors as a consultant, advisor, counterterrorism policy advisor, and cybersecurity policy advisor.

She is currently Deputy Director for CISA Region 10. I think she’ll talk about CISA, what that organization is, where it fits into the structure of government, and what resources are available through CISA. As I said, we are delighted and grateful to have Barrett Adams-Simmons joining us today. Barrett, welcome to our webinar. I will stop sharing now. Welcome, it’s great to have you here.

Barrett Adams-Simmons: Thank you. It’s my turn to share, so give me a moment. I do my own tech as well, so let’s hope I can do this correctly.

EXP: Good luck

Barret Adams-Simmons: Thank you.

EXP: I see your desktop now.

There we are.

CISA Cybersecurity Threats and Services

Barret Adams-Simmons: All right, thank you for the confirmation. Hi, as introduced, my name is Barrett Adams-Simmons. I am the Deputy Regional Director for CISA, [pronounced “SIH suh”] not “sigh-suh”, none of these other ways of saying it, but CISA.

The fun part is we have to practice Cybersecurity and Infrastructure Security Agency. If you try saying it real fast in front of a bunch of people, it’s certainly entertaining. The focus is, of course, on the security and resilience of our nation’s most critical infrastructure.

We are not the FBI, law enforcement, or intel, so this won’t be very heavy on cyber threats.

Instead, it will focus on what CISA is, what we’re looking at as a threat, how this impacts your organization, and some of the resources and best practices to address that. We’ll flow through that way, so it’s not too much of this individual did that, but more to share the information, letting you know what’s out there and how you can address some of these concerns.

Let’s see if it progresses. There we go.

Cybersecurity & Infrastructure Security Agency (CISA) The Nation’s Risk Advisors

As I said, CISA is focused on security and resilience. We aim to prevent being impacted or targeted, and if you are impacted, how to bounce back quickly and to move forward. We are at the pinnacle of risk management for both cyber and physical infrastructure across the country.

CISA Core Competencies

Public and Stakeholder Engagement

One aspect is public and stakeholder engagement, which is a large portion of what we do, especially in the region.

Information Sharing

We want to make sure that our partners know they’re at risk and are aware of what information is available. This includes information sharing and how to identify when you’re being targeted by cyber or insider threats, and also physical threats. Though this session focuses on cyber, we consider the full spectrum.

Risk Assessments

Also among our resources, we provide risk assessments. You have to know yourself. Part of knowing yourself is understanding where you’re vulnerable, who’s in charge of what, what you have in place, and what can be done to mitigate risks.

Capacity Building

Ultimately, capacity building is crucial to increasing the strength of your organization.

Critical Infrastructure Impact on the Nation

Our big focus is on critical infrastructure. Here is a broad picture of the 16 sectors.

Our director, Director Easterly, has focused on four primary goals this year.

Our number one priority is elections infrastructure. We are responsible for helping to secure our nation’s elections infrastructure, which is a major impact area. Much of what we do with elections infrastructure can be applied across all sectors.

Other focus areas include water, wastewater, and public health. Additionally, K-12 education is a priority.

We look for targets that are rich in potential impact but poor in resources, which makes them vulnerable.

These are the critical infrastructure partners we want to engage with to ensure they have the resources to address potential attacks and vulnerabilities.

In this region, we focus on critical manufacturing, commercial facilities (including theaters, sports stadiums, and other crowded places), and the communication sector.

EXP: I can confirm that we have attendees from theaters, museums, and other places where people gather in large numbers. Also, small and medium-sized businesses, as well as nonprofit organizations, often fit the description of “target rich and resource poor.” They don’t have the resources to invest in hardening their infrastructure in the same way that larger organizations like Boeing, Amazon, or Costco might. Am I correct in that assumption?

Barret Adams-Simmons: 100 percent. That’s exactly why I brought that up. We do work with Boeing because there’s a lot of information sharing that goes on there.

Boeing has many small subcontractors as part of their supply chain, third-party entities that are smaller. Often, adversaries target those partners because they don’t have the resources that Boeing has. Boeing encourages us to engage with many of these partners, which I believe includes folks on this call, to ensure they have the resources available at no cost or at least educate them to help them become more resilient. Boeing has large coffers they can pull from, but they’re still concerned about their third-party vendors because threats can ultimately reach them through that vector into larger organizations.

CISA Regions

I mentioned regions. CISA has 10 regions, and we are Region 10, where I’m the deputy.

We cover the Pacific Northwest and Alaska, including Seattle [Washington], Oregon, and Idaho. Across the nation, there are similar footprints. If you’re calling from outside Region 10, we can help direct you to partners with the same resources. We have security advisors on staff who can meet with you, look at your networks, and walk you through assessments or assist visits to see what’s going on with your organizations. Additionally, you can get information when certain threats come out.

EXP: Forgive me for interrupting, but is there different subject matter expertise in different regions? For example, in the Pacific Northwest, we have aerospace manufacturing and many tech businesses, whereas in the Midwest and the East, like Chicago and New York, there might be more financial services. Do different regions boast or support different areas of expertise, or is it pretty broad across each?

Barret Adams-Simmons: We’re fundamentally consistent, focusing on the critical infrastructure sectors.

However, some regions focus more on certain sectors.

For example, both Region 5 and our region focus more on critical manufacturing, whereas Region 7 and to a large extent Region 8 have a larger focus on food and agriculture.

Region 6 is more focused on chemical security. While we have our four priorities and all assets, we might dig more into one specific area.

In our region, we focus more on communications and critical manufacturing. That doesn’t mean we don’t touch on other critical sectors, but those tend to be our focus areas.

CISA Region 10 Overview

 On that note, I mentioned we’re more than cybersecurity. We’re also protective security. We have protective security advisors who look at physical security and conduct de-escalation training, active shooter training, and planning responses.

We have chemical security advisors who examine on-site chemicals, their combinations, quantities, and potential threats. This involves anti-terrorism measures like ensuring certain tanks aren’t close to schools.

I mentioned communications, specifically emergency communications. This includes 911 centers and addressing natural hazards, both cyber and natural hazards, like wildfires.

We work with emergency communication partners to identify what’s in the path of wildfires and advise on potential communication losses. We also look at vulnerabilities in the development of 5G systems and provide technical assistance to emergency communication providers.

Operation Outreach spans all of these areas, helping to ensure information sharing with everyone.

To highlight, all these services are at no cost.

How Can We Work Together?

Know the Threat. Know Yourself.

I mentioned earlier that addressing threats involves knowing yourself, understanding your high-value assets, what’s critical to keep you operating, what adversaries might target, and how to fortify and mitigate those vulnerabilities. Understand the threats, know what adversaries are looking for, and flag that. This comes from exchanging information, going online, and accessing resources at cisa.gov. We have many resources available.

Being aware and signing up for certain programs and resources is crucial.

Cyber Threat Landscape—Big Picture

This is the big picture of the cyber threat landscape. I feel the need to apologize because we’re not the FBI, so we’re not providing an actual threat briefing, but this is the threat landscape we’re primarily looking at.

Advanced Persistent Threats

It’s the advanced persistent threats (APTs), the more robust, state-sponsored threats from countries like Russia and China.

Russian state-sponsored actors are going to target certain sectors, especially the water sector or dam sector, that have what I call cyber convergence.

You have assets exposed to the internet, the threat actor gets into the system, and then is able to manipulate the physical side of the production.

We spend a lot of time looking at how to prevent that first access point, and even if they do get in, how to segment it so they can’t jump from the initial threat vector to the actual systems. They might manipulate how many chemicals are going into water/wastewater, or control the mechanical parts, which could potentially cause significant threats to the community’s public health.

Another issue we often don’t think about is intellectual property theft.

Chinese state actors focus on stealing intellectual property; it’s part of their culture and is acceptable to them. They actively target critical asset owners to gain advantages.

Cyber Crime for Financial Gain

While some of you may see these APT threats, you’re more likely to encounter cyber criminals looking for financial gain. They seek easy access to personal identifiable information to exploit and sell on the dark web. The most significant risk we face is ransomware attacks that shut you down and force you to pay to regain access to your systems.

We help our partners with ransomware prevention and response, working in coordination with law enforcement, the FBI, and sometimes state and local agencies.

Our role is to assist IT departments in figuring out the best way to get back online, understand what happened, and prevent it from happening again.

Bottom Line

The greatest risk for those on this call is likely ransomware. The methods used to gain access for ransomware are the same as those used to manipulate systems or cause other problems.

Don’t panic but don’t be complacent.

Ransomware

As promised, let’s talk about ransomware. We’ll share these slides, PDF them, and make them available through Kelly. There are links included, but I encourage you to visit cisa.gov.

There’s a button for free cybersecurity resources and another for “Stop Ransomware,” which offers a wealth of information on training and securing your infrastructure.

Here are some key points to consider:

Update Your Software: Ensure you have supported operating systems.

Run up-to-date antivirus programs and upgrade systems regularly. Updates and patches address identified vulnerabilities that adversaries target.

Strong Passwords and Multi-factor Authentication: Use strong passwords and enforce them.

Multi-factor authentication is crucial. The “Stop Ransomware” link provides additional guidance on implementation of MFA and how to enforce strong passwords. Because it is one thing to require it and another to demand it.

Phishing Campaigns: Many threats enter through phishing. Train your people to be suspicious of unexpected emails. Use firewalls and address common vulnerabilities. CISA has resources to help with this, including Cyber Essentials.

A significant concern with ransomware is that companies often pay to get their systems back but might have to pay twice or not regain access at all. Work with law enforcement partners to avoid this. Know who your law enforcement partners are. I’ll provide a list of Region 10 CISA partners who can help you connect with law enforcement if needed, ensuring you don’t have to pay or pay twice.

Sometimes, if you try to back up, you don’t back up far enough, and you back it up to the point where the actor is already in the system. This just opens you up again to be vulnerable to a ransomware attack. These are just a few things to consider when looking at ransomware and how you’re being targeted.

One of many—

EXP: Can I interject with something real briefly? A callback from a webinar we had about a year ago with a supervisory special agent from the FBI.

I want to reiterate one of the things he said. (Unfortunately, we couldn’t record that event due to the sensitive nature of some of the discussions.) He mentioned that if you are the victim of a ransomware attack, the FBI discourages paying the ransom. However, even if you do pay, the FBI will still view you as a victim. They want you to speak up, report, and work with them. Don’t feel like you can’t enlist the FBI to assist you just because you didn’t follow their guidance to the letter. You can report incidents to the Internet Crime Complaint Center (IC3).

The FBI ultimately wants to go after the bad guys, not the victims.

The FBI is there to help you, even if you haven’t followed their advice to the “T” so far.

Sorry to sidetrack—

Barret Adams-Simons: No, that’s a good point.

Know who they are before an incident happens. The last thing you want to do during an incident is try to figure out how to get a hold of these people. Know how to do that in case of an event. Anyone with an interconnected computer or device to the internet is at risk for ransomware, so that’s everyone. Some operational technology (OT) folks think they’re not connected, but they actually are. This is another way actors can get in.

I have some numbers here for situational awareness.

In one year alone, over 500 medical centers were impacted.

In the educational system, nearly 1,700 K-12 institutions were impacted.

There was one estimate that over $4 billion across the United States was paid in ransoms in the past year. The cost of ransomware in the United States was nearly $20 billion. This is a big cash cow for a lot of these adversaries.

EXP: I’ll interject briefly. Backups can be an effective remedy against ransomware. It’s critically important to have an air gap between your production environment and your backups. The first thing ransomware wants to do is infect your backup mechanism. Best practices suggest you monitor those backups and do test restores frequently as well.

Maybe I’m speaking to your next slide—

CISA Cyber Hygiene Observations

Barrett Adams-Simmons No, mine’s much more high-level. I appreciate it. Please keep interrupting.

One of the resources we provide is what we call “Cy Hy” or Cyber Hygiene Services.

We have a robust cyber hygiene program with multiple partners signed up. When we run CyHy scans on these partners, these are the primary things that come up.

Some of the best practices include:

Vulnerability or Susceptibility to Phishing: Training is the best part for this, as well as cyber hygiene to see where the susceptibility is.

User Account Permissions: Make sure to take admin rights off general systems. Follow best practices for user account management.

Patching: Proper patch management is critical. If we see vulnerabilities, adversaries see them too. Point out patches that need to be run. Often, partners have been accessed because they weren’t properly patching their systems.

Unsupported Operating Systems and Applications: Upgrade these to avoid vulnerabilities.

EXP: One important note: Windows 10 reaches end of support in October 2025. It sounds like a long time, but it’s not. Plan now to address this, as Microsoft will not release critical security updates after this date. This will make systems more vulnerable.

Barrett Adams-Simmons: We are the federal government, and we’re scanning your systems with Cyber CyHy. In the Pacific Northwest, there is reluctance to work with the federal government. We understand that. We just want to make sure everyone is aware of their vulnerabilities and how to mitigate them. Other sources might cost money, but the important part is that you’re scanning your systems and identifying these known access points to the actor. We won’t be offended if you don’t leverage our no-cost resources. We just want to make sure you’re doing something because you’re certainly vulnerable.

Additional Offerings

Cyber Guidance for Small Businesses

One of the biggest things to focus on is going to cisa.gov. CISA has a section for cybersecurity guidance for small businesses, looking at advice and what small businesses should be doing with these resources.

They constantly adapt how they provide this guidance. For example, a decade ago, we pushed not logging into and buying things from free Wi-Fi at a coffee shop. Now, the primary threats have evolved.

Some steps to consider:

Establish Your Culture: Work with everyone in your organization, not just your IT department. In many cases, you might not have a robust IT department, but everyone in the organization plays a role.

And this site has access to CISA’s MFA—multifactor authentication, how do you do that?

Get people trained. [Security Awareness Training at EXP Academy]

And then the next one is to actually designate somebody to be a security program manager.

What I like about how we posture this in small businesses is that it doesn’t have to be a security expert or even an IT professional, but someone needs to be designated as a security program manager.

This person will act as a single point to help coordinate and ensure that you are actually addressing some of these potential risks.

This is a big one. So there is an incident, right? How do you respond? You need to have an incident response plan before an incident happens, hopefully. This comes down to who you know, who do you call, who’s in charge, who’s responsible for what, are the backups in place, how far back do you have to go into the backups, have you practiced actually using your backups? Things like that. You need that incident response plan.

The next one is to participate in tabletop exercises to test that plan and make sure you’re doing it the right way, or that you even know what to do. The first time you do it should not be in the middle of an incident.

Some resources we have on cisa.gov include tabletop exercise in a box. [CISA Tabletop Exercise Package Documents | CISA]

We have some you can download to help build your own tabletop exercise. We do, in the region, support developing tabletop exercises. In fact, we’re down in Oregon right now supporting state and local, as well as Health and Human Services, Healthcare, and Public Health sector assets.

We are supporting two tabletop exercises, but we can’t support everyone, so we need to focus on priorities. For those who are smaller or not part of one of these critical assets, you’re still at risk. We have resources for you to do it yourself, to learn how to do it, and to walk through it.

Support your IT leaders.

Please take a moment to look at that. That’s everything for your small businesses.

Known Exploited Vulnerabilities Catalog

We also track the known exploited vulnerabilities. We have a resource you can look at for all the current common vulnerabilities. You can sign up to get automatic updates when they’ve updated it so you know to go in and patch.

If you don’t sign up for it, at least take a look at it so you’re aware of what’s out there and some of the threat indicators.

One of the things I preach about with CISA is we have systems in place so that our partners can give us a heads up. Let us know they’ve been targeted. The great thing about that is we take that information and share it broadly. We’ve seen the ability to stop some of these adversaries from spreading because folks are signed up for these automatic updates or notifications, making them aware of what’s coming.

Public and private sector partnerships are what we’re doing right now. We kind of touched on that at the beginning, so I don’t want to get too into it.

EXP: For people frantically writing down URLs, we will include follow-up information with this presentation’s materials and links. You will have access to them. A question just came up asking if you can have copies of the webinar and the presentation slides. You will.

Barrett Adams-Simmons: 100%!

If you can’t find it, just think cisa.gov, and you can get all of these from cisa.gov. I’m just pointing out the ones for small businesses tailored to folks like you. You can still get all the other information, but at least that’s pointing out.

Impact of Known Exploitable Vulnerabilities

Some of the things we’ve learned with the information we’re tracking, this is more about statistics, giving you a reality check. In our scanning and what we’ve been able to track, we have noticed, so I’m going to have to read through this. It takes a second to digest.

Known Vulnerabilities

For known vulnerabilities, and this one’s focused on critical manufacturing, I know there are some folks here. There were 27 total instances of nine vulnerabilities known to be exploited by threats on 11 different critical manufacturing entities. We knew about these vulnerabilities, and now we know that threat actors are targeting them.

Exposed Risky Services

One of the things we do at Cy Hy is identify risky services and exposure to these risky services. Here, 44.4% of scanned entities were exposed to risky services. This lists some of those services you may not realize are risky. We have more information on this online. Nearly 50% of folks we scanned were exposed to those risky services.

Unsupported Operating Systems

Unsupported operating systems in manufacturing, water, wastewater, and critical manufacturing partners we’ve scanned show that over 26% were running on unsupported Windows operating systems.

You’ll see that a lot in industrial control systems, especially older ones. Long-term, how do you upgrade those systems over time to consider this?

One thing I don’t have listed here is the Financial Services sector. This shows that everyone’s a target. Financial services entities that signed up for Cy Hy reduced their active vulnerabilities by an average of over 11% within the first three months of being on Cy Hy scanning. I encourage you to sign up for Cy Hy. You don’t need a person to come out. It’s online at cisa.gov. That is a great program to go with.

Exercise and Training

Moving on…exercise, exercise, exercise, and train, train, train !

I mentioned tabletop in a box. That’s very useful. Some of you will have access to VTE, the federal virtual training environment, which has a myriad of programs and training sessions. Some of these are available to the public, not just limited to state, local, and federal employees. Even without that, please take advantage of some of the tabletop exercises.

Remember, when you’re doing a tabletop, you’re exercising that incident response plan you have in place. You test the plan with your exercise.

If you’re interested in doing this in your organization, please reach out to us. We may not be able to support it, but we can help you get on track and provide advice and guidance on how to move forward.

Know yourself. There is a great program called the Cyber Security Evaluation Tool (CSET). This is an assessment you can download from cisa.gov and conduct on yourself.

These are similar to the assessments a cybersecurity advisor would conduct if they came to your entity and sat down with your team. It takes about eight hours.

This is something you can do on your own to identify vulnerabilities without needing someone to come out. The CSET tool is an excellent resource for those who can’t afford to have someone conduct an assessment. It’s a way to do it yourself.

Protected Critical Infrastructure Information Program

I’m mentioning this because there is a lot of reluctance in the Pacific Northwest to work with the federal government. We want to ensure that sensitive information is protected. One way we do this is through the Protected Critical Infrastructure Information (PCII) Program. If you do an assessment or work with us, we can protect it under PCII. I don’t want to spend too much time on this, but it’s available if there is concern.

One more thing I meant to say earlier…

We have a lot of lawyers here for training, and for everyone else on the call, often when there is an incident, lawyers are the first involved in incident management. It’s important that organizations understand the role their legal team plays and that lawyers understand the difference between law enforcement entities, the resources we provide, and that we are here to help, not to judge or hold any organization accountable. This is something we have to work on in collaboration with partners. Many times, they don’t want us to come in and help, and that’s fine. It’s all voluntary. We want to make sure you have the information and best practices in place before an incident.

EXP: That’s a great point. If you don’t mind me adding, this is a call back to the most recent webinar we hosted just a month ago. It featured Michael Secrist from TechRUG, the Technology Risk Underwriting Group. In addition to your attorneys, your cyber insurance carrier may also need to be involved right away.

These are all things you should map out in an incident response plan and do tabletop exercises, so you have your playbook ready. If that unfortunate event happens, you know who to call right away. This will include your insurance company, attorneys, outsourced IT support provider, internal IT resources, executives, and stakeholders within your organization, as well as CISA and/or the FBI.

Barrett Adams-Simons: That’s very useful. You got to what I was suggesting with the folks we have on the line.

Only two slides left!

The last slide is the contact information for all the cybersecurity advisors in this region. If you’re not in this region, we can help you get in touch with others.

If you walk away with anything today, let it be these three things, along with the earlier points about cisa.gov and free cyber services. Connect with the CSAs, sign up for Cy Hy, and look into the cybersecurity performance goals. Visit cisa.gov for these resources.

Recommendations

Final recommendations: implement multi-factor authentication, improve patch management, and secure potentially risky services. Nearly 50% of those scanned with Cy Hy are exposed to risky services. Visit cisa.gov for free cyber services, connect with the CSAs, sign up for Cy Hy, and check out the cybersecurity performance goals.

The next slide has the contact information for all the CSAs in this region.

CISA Region 10 Cybersecurity Contacts and Questions

Chris Callahan is located here in the Seattle area and is the chief. Locally, in Washington state, you have Ron Waters and Alex Salazar. Dan Brown, listed there, is over on the Eastern side of Washington state. Jos Stamp is over in Idaho and often shares cross-border responsibilities between Eastern Washington and Idaho. In Oregon, you have Leslie and Chris Ross.

Chris Ross is our law enforcement cybersecurity advisor. He is embedded with the FBI and other law enforcement entities in the greater Portland area in Oregon. Moving on to Alaska, we have two cybersecurity advisers: Mark Brunck, the former CIO for the state of Washington, and Troy Laughlin, a highly motivated adviser with extensive technical skills. With that, I will now take questions.

EXP: Thank you. We have a few questions. The first one might open a big can of worms, but I’ll read it as is: “We’re implementing best practices and company policies around the use of AI tools like ChatGPT or Microsoft Co-Pilot. Do you have any guidance on using these technologies safely and responsibly?”

Barrett Adams-Simmons: I don’t have the details in front of me. I have some slides and resources for AI that I’ll include in the final slide deck before sending it to Kelly to distribute. Also, CISA has a folder dedicated to AI resources if you don’t want to wait.

EXP: Yes, I’ll append the presentation with that information. This question highlights concerns about accidental data leakage, either internally or through AI training on your data, especially with free versions of ChatGPT and other tools.

Barrett Adams-Simmons: There’s potential for leakage. This is an area I’m not as fresh on, so I’d prefer to provide the resources rather than speak off the cuff. Often, standard best practices apply, and our positions on AI also involve looking at technology from a security perspective.

EXP: Earlier, you mentioned evolving threats. When I go to CISA.gov,  notice statements indicating that much of what was believed about cybersecurity is no longer true. Can you speak to this evolution?

Barrett Adams-Simmons: Adversaries are constantly adapting. While using unsecured Wi-Fi without a VPN is poor cyber hygiene, it’s no longer the primary concern. Now, threat actors target known vulnerabilities and unpatched or unsupported systems.

For instance, seven years ago, ransomware was not seen as a major threat, but now it’s prevalent. Smaller organizations with poor cyber hygiene are prime targets.

Boeing, for example, has robust defenses and constantly monitors vulnerabilities, preventing many attacks. Smaller firms, lacking such infrastructure, are more vulnerable.

One incident involved a computerized clock that wasn’t patched, allowing adversaries into a system. This particular organization had a flat infrastructure, so the breach affected over 20,000 desktops across the network.

Oh my gosh, wow. So, that is the primary concern with smaller organizations being the target, right? So, does that addresses your question?

EXP: Yes, yeah, and actually raises another one. But yeah, so the point there is that you need to be cognizant of all these peripheral devices—printers, other things accessing the internet—that might not be on your normal patch schedule and may have known vulnerabilities you need to stay on top of.

The other thing too is that you addressed this, and this is becoming more and more apparent. Well, actually, maybe I want to go back because you said something, and I want to underline it because I still hear it today. I meet with business leaders in small businesses, and people will still say to me, “We’re too small, nobody would care.” And the reality is the attackers don’t care what your data is worth; they care what it’s worth to you. They just want to disrupt your operations, to extort you.

Barrett Adams-Simmons: Correct, correct. And it’s not just to extort you with ransomware; it’s the information you hold on your people, payrolls, things like that that they can sell on the dark web if they can’t get you on ransomware and expose your leakage.

EXP: Exactly. The other thing that you mentioned in one of your first slides—this was where I was going to say a minute ago that’s becoming more and more evident to me—is that we have this persistent stereotype of a hacker. First, it was they were a computer genius, and then it’s, well, maybe they’re not a genius, but it’s this lone wolf guy in his mother’s basement sipping Mountain Dew and wearing a hoodie, using code that others wrote.

Maybe those were true, and certainly those people still exist, but now the adversaries are organized crime organizations that are well-funded, with org charts, internal AP and accounts receivable departments, very sophisticated organizations with tons of resources behind them. Or they may be nation-states engaging in attacks on our infrastructure or private sector.

Barrett Adams-Simons: You kind of ended that like it was a question, but I think it was more of a statement.

Yes, well said. While the guy in his basement with a hoodie may still be a threat in some aspects, we are, as was alluded to, seeing this threat evolve.

One of the things we see is ransomware teams.

Also, one of the things where that guy in the basement can become a major concern is the technology for developing ransomware itself—the S-bombs and other coding. I’m not saying this well; my apologies.

First have these very coordinated, highly funded cybercriminals developing these ransomware strains. Law enforcement entities are constantly trying to find ways to counteract them and break them down.

But once that gets out there, once somebody posts it or you can buy it on the dark web, then the guy in the basement can use it to impact a school or do other things with these strong ransomware attacks on folks. And those will continually evolve as well, so you’ll see major cyber threat actors, and after a while, you’ll see smaller ones using that software they had developed.

EXP: Yeah, and this may be the subject for our next discussion with you. These efforts are supercharged by AI automation as well, or they’re becoming that way now.

We’re nearing the end of our time. I’m going to offer a brief summary, and I’ll give you the last word, too, Barrett. If I’m hearing right, some of the recommendations you’re offering are things like antivirus—we might even suggest endpoint detection and response, or EDR, or MDR, managed detection and response. Next-generation antivirus, but that was one of your recommendations. A big firm recommendation for multi-factor authentication everywhere, patch management—be sure you’re not running unpatched infrastructure or running on outdated, unsupported operating systems. Training—you’ve referenced a lot of training resources within CISA, and also, I will say, EXP Technical offers a lot of free training as well at EXP Academy.

With that, we’re near the end of our time here, Barrett. Do you have any final comments or any other things in summary that you’d like to add to that?

Barrett Adams-Simmons: No, nothing to add except maybe, hopefully, this is not the last time you think about CISA. Kind of walk away, have continued conversation, continued engagement moving forward.

EXP: Alright, well, thank you so much for joining us. You’ve made it really fun and entertaining, and even though it’s a difficult topic, I’ve learned a few things. I hope people in attendance have as well. We’ll make the recording and presentation materials available. It should be about a week, but be on the lookout for an email from me via Zoom, and that should be in your inbox within about a week.

Once again, Barrett, thank you so much for joining us today.

Barrett Adams-Simmons: Thank you for having me.

EXP: Alright!

Barrett Adams-Simmons: Thank you everyone.

Speaker Bio:

Barrett Adams-Simmons, Deputy Regional Director, Region 10  (WA, OR, ID, AK)
Cybersecurity and Infrastructure Security Agency (CISA)

Ms. Adams-Simmons is the Deputy Regional Director for DHS’ Cybersecurity and Infrastructure Security agency (CISA) Region 10 in Seattle, WA. She recently became the Deputy after serving as Region 10’s Outreach Coordinator since 2017. Prior to joining CISA, Ms. Adams-Simmons served as a Senior Policy Advisor for DHS’s Office of Strategy, Policy, and Plans for both cyber and counterterrorism.  

Before joining DHS, she specialized in critical infrastructure protection and risk management across the Department of Defense including the Defense Critical Infrastructure Protection Office and Mission Assurance Division at Naval Surface Warfare Center Dahlgren Division. 

She was trained as a Surface Warfare Officer after graduating from the United States Naval Academy and deployed to support conflicts from 1999 to 2003 then took her first policy position in the Pentagon with the Office of Chief of Naval Operations Staff.

Ms. Adams-Simmons holds a Bachelor of Sciece from the United States Naval Academy and a Master of Arts from the Catholic University of America. 

About CISA

The Cybersecurity and Infrastructure Security Agency (CISA) was established in 2018 as part of the Department of Homeland Security (DHS). Its mission is to protect the nation’s critical infrastructure from physical and cyber threats. This involves enhancing the security, resilience, and reliability of key infrastructure sectors, such as energy, transportation, and communications.

CISA was founded to address the growing and evolving cyber threats that pose significant risks to national security, economic stability, and public safety. By providing comprehensive cybersecurity services, including threat analysis, incident response, and security guidance, CISA helps government agencies, private sector partners, and the public safeguard against cyber attacks.

CISA’s creation aimed to consolidate and streamline the federal government’s cybersecurity and infrastructure protection efforts, ensuring a coordinated and effective approach to defending against both cyber and physical threats. Its focus is on proactive risk management, information sharing, and building a resilient infrastructure capable of withstanding and recovering from potential disruptions.