Rapidly escalating geopolitical tensions have increased concerns about the risk of cyber threats that can disrupt essential services with potential impacts to public safety.  Most recently, public and private sector entities in Ukraine have suffered a series of malicious cyber incidents, including website defacement as well as reports of potentially destructive malware on their systems that could result in severe harm to critical functions.  The identification of destructive malware is particularly alarming because similar malware has been deployed in the past (e.g., NotPetya and WannaCry ransomware) to cause significant, widespread damage or lack of availability of/to critical functions and critical cyber-dependent infrastructure.

Based on this heightened threat, please consider consulting some of the following links from CISA for controls and other best practices in cyber risk mitigation:

https://www.cisa.gov/shields-up

This page consolidates CISA's published resources on cyber threats related to the current geopolitical tensions.  It is designed to help critical infrastructure owners and operators mitigate possible cyber threats and strengthen their cybersecurity posture.

Alert (AA22-047A): Russian State-Sponsored Cyber Actors Target Cleared Defense Contractor Networks to Obtain Sensitive U.S.  Defense Information and Technology https://www.cisa.gov/uscert/ncas/alerts/aa22-047a (February 2022) – A joint cybersecurity advisory with the FBI and the NSA about Russian state-sponsored cyber actors targeting cleared defense contractors in the United States; includes detection and mitigation recommendations to reduce the risk of data exfiltration.

CISA Insights: Implement Cybersecurity Measures Now to Protect Against Potential Critical Threats https://www.cisa.gov/sites/default/files/publications/CISA_Insights-Implement_Cybersecurity_Measures_Now_to_Protect_Against_Critical_Threats_508C.pdf (January 2022)

An executive-level product that recommends urgent, near-term steps to reduce the likelihood and impact of a potentially damaging compromise.

Alert (AA22-011A): Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S.  Critical Infrastructure https://www.cisa.gov/uscert/ncas/alerts/aa22-011a (January 2022)

A joint cybersecurity advisory with the FBI and NSA about the Russian threat to critical infrastructure, including specific tactics, techniques, and procedures associated with Russian actors.

CISA has no-cost Cyber Hygiene services https://www.cisa.gov/cyber-hygiene-services – including vulnerability scanning, web application scanning, phishing campaign assessments, and remote penetration tests – as well as free services and tools offered by trusted private sector partners (see the Free Cybersecurity Services and Tools https://www.cisa.gov/free-cybersecurity-services-and-tools page on CISA's website).  Always remember to report cyber incidents to CISA Central (central@cisa.dhs.gov).

Multi-State Information Sharing and Analysis Center (MS-ISAC) https://www.cisecurity.org/ms-isac and the Election Infrastructure Information Sharing and Analysis Center (EI-ISAC)

Funded by CISA, the MS-ISAC and EI-ISAC serve as no-cost resources for situational awareness, best practices, information sharing, and incident response for SLTT government entities.  Register now for the MS-ISAC (https://learn.cisecurity.org/ms-isac-registration) and the EI-ISAC (https://learn.cisecurity.org/ei-isac-registration).

Malicious Domain Blocking and Reporting https://www.cisecurity.org/ms-isac/services/mdbr

A no-cost protective Domain Name System (DNS) resolver service provided by the MS-ISAC and funded by CISA; blocks malicious DNS requests while keeping state and local partners informed through regular reports.

Endpoint Detection and Response https://www.cisecurity.org/insights/spotlight/cybersecurity-spotlight-endpoint-detection-and-response-edr

A service provided by the MS-ISAC and funded by CISA to help SLTT entities involved in managing elections maintain awareness of and isolate malicious activity that may be impacting workstations, servers, and other network endpoints, including malware and ransomware.  This program is currently only available to SLTT election organizations.

Real-Time Indicator Feeds https://www.cisecurity.org/ms-isac/services/real-time-indicator-feeds

A service provided by the MS-ISAC and funded by CISA that provides real-time cyber threat intelligence indicator feeds that are easy to implement and available for free to SLTT entities.

Our hope is that the resources provided above will support your overall security posture.  We look forward to the continued partnership, please don't hesitate to get in contact if you would like sign up for services or require any security advice.

Respectfully,