Resource Library

The Department of Defense plans to spend $12 billion on its 29 largest business information technology systems during FYs 2019-2022. DoD’s efforts to modernize business systems has been a topic on our High Risk List since 1995. In a recent study, GAO found: 22 programs that were actively developing software reported using approaches that reduced […]

CISA warns that ransomware attacks targeting critical infrastructure such as Colonial Pipeline have demonstrated the rising threat that ransomware poses to operational technology (OT)...

NIST’s National Cybersecurity Center of Excellence (NCCoE) has released a new Preliminary Draft report, NIST Interagency or Internal Report (NISTIR) 8374, Cybersecurity Framework Profile for Ransomware Risk Management. Ransomware is a type of malicious attack where attackers encrypt an organization’s data and demand payment to restore access. In some instances, attackers may also steal an organization’s information and demand additional […]

NIST is inviting comments on Draft NIST Special Publication (SP) 800-216,  Recommendations for Federal Vulnerability Disclosure Guidelines, which establishes a flexible, unified framework for establishing policies and implementing procedures for reporting, assessing, and managing vulnerability disclosures for systems within the Federal Government. Per the Internet of Things Cybersecurity Improvement Act of 2020, Public Law 116-207, and […]

Last year, the GAO concluded that the Continuous Diagnostics and Mitigation program overseen by the Department of Homeland Security had improved the cybersecurity posture of three agencies: the Federal Aviation Administration, Indian Health Services, and the Small Business Administration. However, the DHS inspector general now reports that the agency has made limited progress implementing its […]

Alorica Inc., a technology services company, was the victim of an apparent phishing attack in October 2017. After gaining access to Alorica’s email system, hackers emailed Alorica’s clients, asking them to send payments to fraudulent bank accounts. One of those clients wired more than $4.8 million to the hackers’ bank account, and subsequently refused to […]

The National Security Agency has released a new video in its Cybersecurity Collaboration Center speaker series. In this edition, Dr. Josiah Dykstra speaks with Lieutenant Zachary Dannelly, United States Navy, about the effective use of Protective DNS. Source: YouTube: The Effective Use of Protective DNS

In a recent audit, GAO reiterated to federal agencies the importance of addressing multiple major cybersecurity challenges and 10 critical actions to fix them. While the government has strengthened its cybersecurity posture, GAO says agencies need to adopt a greater sense of urgency that is equal to the grave threats presented to the country. In […]

The U.S. grid’s distribution systems—which carry electricity from transmission systems to consumers and are regulated primarily by states—are increasingly at risk from cyberattacks. Distribution systems are growing more vulnerable, in part because their industrial control systems increasingly allow remote access and connect to business networks. As a result, threat actors can use multiple techniques to […]

To implement the requirements of the Cybersecurity and Infrastructure Security Agency Act of 2018, CISA leadership within the Department of Homeland Security launched an organizational transformation initiative. The act elevated CISA to agency status; prescribed changes to its structure, including mandating that it have separate divisions on cybersecurity, infrastructure security, and emergency communications; and assigned […]