Understanding And Mitigating Russian States Sponsored Cyber Threats To Us Critical Infrastructure

Cyber attacks are a real threat to our country. This report presents the opposed views of USA and Russia on cyber security and gives insight into the activities of the Russian civilian and military intelligence Services (RIS) conducted during the 2016 U.S. presidential election campaign. The Grizzly Steppe Report provides details regarding the tools and hacking techniques used by the Russian hackers in order to interfere the 2016 U.S. elections. This activity by RIS is just part of an ongoing campaign of cyber-enabled operations directed at the U.S. government and its citizens. These cyber operations have included spearphishing campaigns targeting government organizations, critical infrastructure entities, think tanks, universities, political organizations, and corporations leading to the theft of information. In foreign countries, RIS actors conducted damaging and/or disruptive cyber-attacks, including attacks on critical infrastructure networks. In some cases, RIS actors masqueraded as third parties, hiding behind false online personas designed to cause the victim to misattribute the source of the attack. This report provides technical indicators related to many of these operations, recommended mitigations, suggested actions to take in response to the indicators provided, and information on how to report such incidents to the U.S. Government. The edition also provides crucial information on the legality of hostile cyber activity at state level. While the United States and its allies are in general agreement on the legal status of conflict in cyberspace, China, Russia, and a number of like-minded nations have an entirely different concept of the applicability of international law to cyberspace.

In December 2016, the U.S. Department of Homeland Security disclosed that malicious software (malware) found on a computer system owned by a Vermont utility called the Burlington Electric Company was the same variant as that used to breach the Democratic National Committee (DNC). This admittedly overhyped episode is the latest in a string of cybersecurity incidents that involve U.S. critical infrastructure (CI) and that have been linked to Russia. Already, a number of nations have seen their systems compromised by such attempts, such as Ukraine, which experienced several of its substations crashing in December 2015 in “the first-ever confirmed cyberattack against grid infrastructure.” Unfortunately, the same pattern played out in Ukraine on December 23, 2016. This Article examines the most recent such hacks and investigates the current state of U.S. efforts to advance cybersecurity, including to what extent the recently released draft Version 1.1 of the National Institute of Standards and Technology (NIST) Cybersecurity Framework will contribute to safeguarding vulnerable U.S. CI, and what further steps -- such as an effective deterrence strategy -- are needed going forward.

Today's hearing is timely and very relevant. We are examining the cyber threat today that is posed by nation-states, namely China, Russia, and Iran. I focus on the nation-state aspect of this threat because it represents a new battlefield in state relationships and one in which we must prepare accordingly. There have been significant developments in the cyber domain, highlighted by the fact that the U.S. Government has finally begun to name the nation-states most responsible for cyber attacks against the United States. Tom Donilon, the President's National security adviser, outed China as the place where cyber intrusions are emanating on an unprecedented scale. The annual threat assessment by the United States intelligence community delivered to Congress-Director of National Intelligence, James Clapper, named cyber as the top threat to the United States' National security. This represents a major shift in the threat assessment by the United States intelligence community and makes our work on this committee even more important.

The United States is being bombarded with cyber-attacks. From the surge in ransomware groups targeting critical infrastructure to nation states compromising the software supply chain and corporate email servers, malicious cyber activities have reached an all-time high. Russia attracts the most attention, but China is vastly more sophisticated. They have a common interest in exploiting the openness of the Internet and social media—and our democracy—to erode confidence in our institutions and to exacerbate our societal rifts to prevent us from mounting an effective response. Halting this digital aggression will require Americans to undertake sweeping changes in how we educate, organize and protect ourselves and to ask difficult questions about how vulnerable our largest technology giants are. If we are waiting for a “Cyber 9/11” or a “Cyber Pearl Harbor,” we are misunderstanding how our adversaries wage cyber warfare. This is a timely and critically important book. No other book has analyzed the threat of cyber warfare with the depth and knowledge brought to the subject by the authors. It has now become a cliché to argue that a “whole of government” or “whole of society” response is necessary to respond to this crisis, but that concept has never been more important. It will take many years and billions of dollars to even begin to secure our IT systems and prevent the slow rot that is destroying America. Using language that the layman can understand, we wish to educate Americans about what has happened and inspire them to seek solutions.

This analysis report provides information and gives insight into the activities of the Russian civilian and military intelligence Services (RIS) conducted during the 2016 U.S. presidential election campaign. The Grizzly Steppe Report provides details regarding the tools and hacking techniques used by the Russian hackers in order to interfere the 2016 U.S. elections. This activity by RIS is just part of an ongoing campaign of cyber-enabled operations directed at the U.S. government and its citizens. These cyber operations have included spearphishing campaigns targeting government organizations, critical infrastructure entities, think tanks, universities, political organizations, and corporations leading to the theft of information. In foreign countries, RIS actors conducted damaging and/or disruptive cyber-attacks, including attacks on critical infrastructure networks. In some cases, RIS actors masqueraded as third parties, hiding behind false online personas designed to cause the victim to misattribute the source of the attack. This report provides technical indicators related to many of these operations, recommended mitigations, suggested actions to take in response to the indicators provided, and information on how to report such incidents to the U.S. Government.

Cyber threats from China, Russia, and Iran : protecting American critical infrastructure : hearing before the Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies of the Committee on Homeland Security, House of Representatives, One Hundred Thirteenth Congress, first session, March 20, 2013.

This analysis report provides information and gives insight into the activities of the Russian civilian and military intelligence Services (RIS) conducted during the 2016 U.S. presidential election campaign. The Grizzly Steppe Report provides details regarding the tools and hacking techniques used by the Russian hackers in order to interfere the 2016 U.S. elections. This activity by RIS is just part of an ongoing campaign of cyber-enabled operations directed at the U.S. government and its citizens. These cyber operations have included spearphishing campaigns targeting government organizations, critical infrastructure entities, think tanks, universities, political organizations, and corporations leading to the theft of information. In foreign countries, RIS actors conducted damaging and/or disruptive cyber-attacks, including attacks on critical infrastructure networks. In some cases, RIS actors masqueraded as third parties, hiding behind false online personas designed to cause the victim to misattribute the source of the attack. This report provides technical indicators related to many of these operations, recommended mitigations, suggested actions to take in response to the indicators provided, and information on how to report such incidents to the U.S. Government.