TODAY'S TOP 5

MAJOR RANSOMWARE ATTACK: Rhode Island's public benefits computer system was shut down Friday after it was breached by hackers, potentially exposing the personal information of hundreds of thousands of Rhode Islanders, The Providence Journal reports. Deloitte, the information technology vendor that built and runs the computer system known as RIBridges and UHIP, first alerted the state and police about a potential attack on Dec. 5. On Tuesday, the attackers sent the vendor screenshots showing personal data files. Gov. Dan McKee said the decision to shut down the system and the HealthyRhode.ri.gov website came late Friday afternoon after Deloitte discovered that dangerous malware was embedded in the RIBridges computer code.

• Cybercriminals could release personal data of many Rhode Islanders as early as this week as the hackers are demanding a ransom, the Associated Press reports. Anyone who has been involved in Medicaid, the Supplemental Nutrition Assistance Program known as SNAP, Temporary Assistance for Needy Families, Childcare Assistance Program, Rhode Island Works, Long-term Services and Supports, the At HOME Cost Share Program and health insurance purchased through HealthSource RI may be impacted, McKee said Saturday.

WATER SECTOR WARNING: CISA and the Environmental Protection Agency (EPA) released a joint fact sheet providing water and wastewater systems facilities with recommendations for limiting the exposure of Human Machine Interfaces (HMIs) and securing them against malicious cyber activity. HMIs enable operational technology owners and operators to read supervisory control and data acquisition (SCADA) systems connected to programmable logic controllers. Threat actors can exploit exposed HMIs at sector utilities without cybersecurity controls, resulting in operational impacts and forcing victims to revert to manual operations.

‘CYBER WEAPON’ AGAINST FUEL SYSTEMS: An Iranian state hacking group is using custom malware that researchers liken to a "cyber weapon" to compromise IoT and OT infrastructure in Israel and the United States, GovInfoSecurity reports. Researchers from New York-based Claroty said Friday that an attack wave from an Islamic Revolutionary Guard Corps-affiliated group going by the persona "CyberAv3ngers" swept up fuel management systems made by U.S.-based firm Gilbarco Veeder-Root.

• The same Iranian threat actor in late 2023 hacked programmable logic controllers manufactured by an Israel firm in order to display anti-Israeli messages. Around the same time of the PLC hacking, CyberAv3ngers on Telegram claimed it attacked 200 gas stations in Israel and the United States by compromising Orpak systems.

ANTICIPATING THE NEXT OUTAGE: Most executives expect their organization to experience a CrowdStrike-level IT outage within the next year, according to a PagerDuty survey of 1,000 IT and business leaders conducted by Wakefield Research, Cybersecurity Dive reports. The July global outage caused by a faulty Falcon sensor update was a wake-up call, the report found. Nearly 9 in 10 respondents said they now realize their organization had prioritized security at the expense of service disruption readiness. More than half said they’d observed a shift toward continuous preparedness assessments rather than one-time investments in systems or protocols in the wake of the crisis.

CLEO CONCERNS, CLOP CLAIM: An active ransomware campaign against the Cleo managed file transfer tool is about to ramp up now that a proof-of-concept exploit for a zero-day flaw in the software has become publicly available, Dark Reading reports. Defenders should brace for widespread deployment of the Cleopatra backdoor and other steps in the attack chain.

• CISA said federal civilian agencies have until January 3 to patch CVE-2024-50623, The Record reports.
• The Clop ransomware gang has confirmed to BleepingComputer that they are behind the recent Cleo data-theft attacks, utilizing zero-day exploits to breach corporate networks and steal data.

CYBER FOCUS PODCAST

In the latest episode of Cyber Focus, host Frank Cilluffo sits down with Eric Geller, a leading cybersecurity journalist who contributes to top outlets including POLITICO, WIRED and The Record. Together, they unpack Geller’s reporting on expectations for changes in AI regulation and cybersecurity under the incoming Trump administration. They also discuss vulnerabilities within critical infrastructure sectors such as agriculture and telecommunications. Geller offers insights into systemic challenges, the evolving threat environment, and the need for innovation in tackling cybersecurity policy and governance.

SUBSCRIBE TO CYBER FOCUS: YouTube | Spotify | Apple Podcasts

CYBER AND CI UPDATES

ATTACKS AND INCIDENTS

Breaches

Auto parts giant LKQ says cyberattack disrupted Canadian business unit

LKQ is a public American company specializing in automotive replacement parts, components, and services to repair and maintain vehicles. The company has 45,000 employees in 25 countries and operates numerous brands, including Keystone, Tri Star, and ADL. In a Friday evening FORM 8-K filing filed with the SEC, the company says one of its business units in Canada was breached on November 13, disrupting business operations. (BLEEPINGCOMPUTER.COM)

South Carolina credit union says 240,000 impacted by recent cyberattack

The credit union filed breach notification documents with regulators in Maine and Texas on Friday acknowledging that it recently detected suspicious activity on its network. SRP was founded in 1960, and said it has more than $1.6 billion in assets as of 2022. After law enforcement was notified, an investigation was conducted and they realized that hackers accessed SRP Federal Credit Union systems “at times from September 5, 2024, and November 4, 2024, and potentially acquired certain files from our network during that time.” (THERECORD.MEDIA)

Cybercrime

Arizona man arrested for alleged involvement in violent online terror networks

Baron Martin, a 20-year-old resident of Tucson, Arizona, was arrested Wednesday on charges of producing child sexual abuse material and cyberstalking. His arrest is connected to his involvement in online terror networks, specifically 764 and CVLT, which are known for violent extremist activities. The unsealed complaint provides a grim overview of the 764 network’s operations. (CYBERSCOOP.COM)

Healthcare

Canadian eyecare firm Care1 exposes 2.2TB of patient records

Cybersecurity researcher Jeremiah Fowler recently discovered a massive database belonging to Care1, a Canadian company that provides AI-powered software solutions to optometrists. The database, containing over 4.8 million records of patient information (with a total size of 2.2 TB), was left completely unprotected, exposing sensitive data like patient names, addresses, medical histories, and even their unique Personal Health Numbers (PHNs). (HACKREAD.COM)

Grinches

UK shoppers frustrated as bots snap up popular Christmas gifts

Almost three quarters of UK consumers (71%) believe malicious bots are ruining Christmas by snapping up all the most wanted presents, according to research by Imperva. The company warned that ‘scalping’, the practice whereby cybercriminals use bots to buy items from online retailers and sell them for a profit on resale sites, is only set to get worse this Christmas. (INFOSECURITY-MAGAZINE.COM)

ALSO: Is AI manipulating us into spending more? (CYBERNEWS.COM)

Leaks

Massive data leak might have exposed locations of millions of Muslims online

The Cybernews research team discovered an unprotected Elasticsearch server exposing more than 3.6 million extremely sensitive data records to anyone on the internet. The data has been attributed to users of the Quran Kuran app developed by Sigma Telecom, an Istanbul-based telecommunications company. The app, downloaded over 1 million times from the Google Play Store, helps users study, read, and learn the Quran, the Muslim holy book, while supporting prayer practices. (CYBERNEWS.COM)

Malware

Germany disrupts BADBOX malware on 30,000 devices using sinkhole action

BADBOX was first documented by HUMAN's Satori Threat Intelligence and Research team in October 2023, describing it as a "complex threat actor scheme" that involves deploying the Triada Android malware on low-cost, off-brand Android devices by exploiting weak supply chain links. Once connected to the internet, the malware embedded into the devices can collect a wide range of data such as authentication codes, and install additional malware. (THEHACKERNEWS.COM)

390,000 WordPress accounts stolen from hackers in supply chain attack

Researchers at Datadog Security Labs, who spotted the attacks, say that SSH private keys and AWS access keys were also stolen from the compromised systems of hundreds of other victims, believed to include red teamers, penetration testers and security researchers, as well as malicious actors. The victims were infected using the same second-stage payload pushed via dozens of trojanized GitHub repositories delivering malicious proof-of-concept (PoC) exploits that targeted known security flaws, along with a phishing campaign prompting targets to install a fake kernel upgrade camouflaged as a CPU microcode update. (BLEEPINGCOMPUTER.COM)

Thai officials targeted in Yokai backdoor campaign using DLL side-loading techniques

The starting point of the attack chain is a RAR archive containing two Windows shortcut files named in Thai that translate to "United States Department of Justice.pdf" and "United States government requests international cooperation in criminal matters.docx." The exact initial vector used to deliver the payload is currently not known, although Hegde speculated that it would likely be spear-phishing due to the lures employed and the fact that RAR files have been used as malicious attachments in phishing emails. (THEHACKERNEWS.COM)

Password spray

Citrix shares mitigations for ongoing Netscaler password spray attacks

Citrix Netscaler is the latest target in widespread password spray attacks targeting edge networking devices and cloud platforms this year to breach corporate networks. Germany's BSI cybersecurity agency warned of numerous reports that Citrix Netscaler devices are now targeted in similar password spray attacks to steal login credentials and breach networks. "The BSI is currently receiving increasing reports of brute force attacks against Citrix Netscaler gateways from various KRITIS sectors and from international partners," the BSI said. (BLEEPINGCOMPUTER.COM)

Phishing

'Dubai Police' lures anchor wave of UAE mobile attacks

Researchers at BforeAI observed a recent surge in phishing attacks leveraging alleged police communications, which encourage text recipients to click on a malicious URL to respond to supposed legal trouble or to register with an "official" online portal. The included links redirect victims to fake websites designed to harvest sensitive information, including bank details or personal identification details. (DARKREADING.COM)

Ransomware

Akira and RansomHub surge as ransomware claims reach all-time high 

Ransomware claims reached an all-time high in November 2024, with Corvus Insurance reporting 632 victims claimed on ransomware groups’ data leak sites (DLS). More than double the monthly average of 307 victims, the November count exceeds the previous peak of 527 victims recorded in May 2024. (INFOSECURITY-MAGAZINE.COM)

Scams

New FTC data show skyrocketing consumer reports about game-like online job scams

According to a new FTC data spotlight, these scams, known as task scams, have increased massively in the last four years, with reports of these scams increasing from zero in 2020 to 5,000 in 2023, then quadrupling to about 20,000 in just the first half of 2024. These scams helped drive an overall increase in reported losses to job scams across the board, according to the spotlight. Overall reported losses on job scams tripled from 2020 to 2023 and were more than $220 million in just the first six months of 2024. Task scams were estimated to account for nearly 40 percent of the 2024 job scam reports. (FTC.GOV)

THREATS

Artificial intelligence

With 'TPUXtract,' attackers can steal orgs' AI models

Using many thousands of dollars worth of equipment and a novel technique called "online template-building," a team of four managed to infer the hyperparameters of a convolutional neural network (CNN) — the settings that define its structure and behavior — running on a Google Edge Tensor Processing Unit (TPU), with 99.91% accuracy. (DARKREADING.COM)

Deepfakes

Women in congress are 70 percent more likely to be victims of AI-generated deepfakes than male counterparts

An analysis published by disinformation think tank the American Sunlight Project (ASP) via The 19th uncovered more than 35,000 pieces of digitally altered nonconsensual intimate imagery (NCII) depicting 26 members of Congress. ASP's numbers, when broken down, outline a stark reality for victims of NCII: Of those thousands of images, the organization found 25 women politicians depicted by AI. Only one man was the subject of such content. (MASHABLE.COM)

Ransomware

NotLockBit ransomware targets Apple users with advanced file-locking and data exfiltration

Ransomware targeting Mac devices tends to lack the necessary tools to truly lock files or exfiltrate data. The general perception has been that macOS is better protected against these kinds of threats, partially due to Apple's built-in security features, such as Transparency, Consent, and Control (TCC) protections. However, the emergence of macOS.NotLockBit signals that hackers are actively developing more sophisticated methods for targeting Apple devices. (TECHRADAR.COM)

Resilience

IAM: It’s not sexy, but it saves your bacon

Identity and access management (IAM) proved its worth by quietly saving organizations from disaster. As breaches like MOVEit, Okta's credential compromise, and the Microsoft email hack rocked the cybersecurity world, IAM emerged as a critical, if unsung, defense. The MOVEit breach, which compromised millions of records through a third-party software vulnerability, taught organizations that IAM isn’t just about preventing unauthorized access — it’s about understanding how to handle identities across the full attack surface. (SCWORLD.COM)

How to turn around a toxic cybersecurity culture

A toxic cybersecurity culture affects team turnover, productivity, and morale. Worse yet, it places enterprise systems and data at risk. In a toxic cybersecurity culture, everybody believes that cybersecurity is somebody else’s job, says Keri Pearlson, executive director for Cybersecurity at MIT Sloan (CAMS), a research consortium focusing on cybersecurity leadership and governance issues. “They don’t see any value in making efforts that help keep the organization secure.” (CSOONLINE.COM)

Vulnerabilities

2024 sees sharp increase in Microsoft tool exploits

Threat actors’ abuse of legitimate Microsoft tools rose by 51% in the first half of 2024 compared to 2023, according to Sophos’ latest Active Adversary Report. The researchers observed 187 unique Microsoft Living Off the Land Binaries (LOLbins) used by threat actors in 190 cyber incidents analyzed in H1 2024. Over a third of them (64) appeared just once in the Sophos dataset. (INFOSECURITY-MAGAZINE.COM)

PDQ Deploy users warned of credential-theft risk

The risk comes when an administrator uses PDQ Deploy’s “Deploy User” run mode, which temporarily creates credentials on the target device or devices for the purpose of installing software and updates. After installation, these credentials are deleted from the device; however, they can be retrieved from active memory prior to the deletion step using information stealing tools such as Mimikatz, according to CERT/CC. (SCWORLD.COM)

ADVERSARIES

China

Understanding the Biden administration’s updated export controls

On December 2, 2024, the Biden administration published two new (with more evidently still to come) updates to the China AI and semiconductor export controls that it released in October 2022. As with the first Trump administration — which made major changes to semiconductor export control policy during its final months in office — these late-term Biden export controls are a bombshell. (CSIS.ORG)

Winnti hackers target other threat actors with new Glutton PHP backdoor

The Chinese Winnti hacking group is using a new PHP backdoor named 'Glutton' in attacks on organizations in China and the U.S., and also in attacks on other cybercriminals. Chinese security firm QAX's XLab discovered the new PHP malware in late April 2024, but evidence of its deployment, along with other files, dates back to December 2023. XLab comments that, while Glutton is an advanced backdoor, it has notable weaknesses in stealth and encryption, which might be an indication that it's in an early development phase. (BLEEPINGCOMPUTER.COM)

U.S. updates a science and technology pact with China to reflect growing rivalry and security threats

The new agreement, signed Friday after many months of negotiations, has a narrower scope and additional safeguards to minimize the risk to national security. The State Department said the agreement sustains intellectual property protections, establishes new guardrails to protect the safety and security of researchers and “advances U.S. interests through newly established and strengthened provisions on transparency and data reciprocity.” (SECURITYWEEK.COM)

Russia

Japanese game and anime publisher reportedly pays $3 million ransom to Russia-linked hackers

Kadokawa previously confirmed that some of its data — including contracts, internal company documents, and personal information on all employees — was leaked in the ransomware attack. BlackSuit is said to have accessed 1.5 TB of the company’s data. BlackSuit is a rebrand of the Royal ransomware group, whose operators are believed to originate from the now-defunct Conti cybercrime gang. (THERECORD.MEDIA)

Russia blocks Viber in latest attempt to censor communications

Russian telecommunications watchdog Roskomnadzor has blocked the Viber encrypted messaging app, used by hundreds of millions worldwide, for violating the country's legislation. "Access to the Viber service is restricted due to the violation of the requirements of Russian legislation for organizers of information dissemination," Russia's internet regulator said in a press statement. This comes after a Moscow court ordered Viber to pay a 1 million robles fine in June 2023 for failing to remove what Russia described as illegal content, including information on Russia's war in Ukraine. (BLEEPINGCOMPUTER.COM)

Threat actors

Foreign hackers need to face real consequences, Mike Waltz says

Following a massive Chinese-backed hack of eight U.S. telecommunications providers, Rep. Michael Waltz said Sunday there needs to be “higher costs and consequences” for those who steal Americans’ data. “We have been over the years trying to play better and better defense when it comes to cyber,” Waltz (R-Fla.), who will serve as President-elect Donald Trump’s national security adviser, said on CBS’ “Face the Nation.” (POLITICO.COM)

GOVERNMENT AND INDUSTRY

Artificial intelligence

U.S. Mission to the Organization of American States launches new initiative on artificial intelligence

The initiative, supported by over $1.1 million in grant funding from the U.S. government, will advance the development of safe, secure, and trustworthy artificial intelligence policy frameworks and ecosystems by OAS member states across the Western Hemisphere. The OAS Executive Secretariat for Integral Development will spearhead this initiative, bringing together decision makers from governments, the private sector, and academia across the Americas. (STATE.GOV)

Ex-Google CEO warns there's a time to consider ‘unplugging’ AI systems

Regulations are in a state of flux, with discussions on Capitol Hill sputtering as this chapter of Congress nears its close. But companies are still charging ahead. "I've never seen innovation at this scale," Schmidt said on ABC's "This Week." While he celebrated "remarkable human achievement," he warned of the unforeseen dangers of rampant development. (AXIOS.COM)

The AI export dilemma: Three competing visions for U.S. strategy

While Washington focuses intensely on constraining AI advances by China, another group of emerging economies—including states like Saudi Arabia and the United Arab Emirates (UAE)—are increasingly positioning themselves as influential players in the AI landscape. U.S. policymakers are only just beginning to grapple with the opportunities and dilemmas posed by such countries’ AI aspirations. (CARNEGIEENDOWMENT.ORG)

Why Sundar Pichai never panicked

In an exclusive interview, Alphabet and Google CEO Sundar Pichai told Semafor he’s ready to work on a “Manhattan Project” for AI when Donald Trump moves into the White House next year. “I think there is a chance for us to work as a country together,” he told Semafor. “These big, physical infrastructure projects to accelerate progress is something we would be very excited by.” (SEMAFOR.COM)

The potential, pros and cons of Atlanta’s new AI commission

Atlanta wants to get a jump on artificial intelligence via a new commission — a move that could eventually help the city deal with its lean finances and perhaps even have an impact among suppliers of government technology. The city, among the fastest growing in the U.S., recently set up one of the newest AI study groups in the country via a unanimous City Council vote. (GOVTECH.COM)

Artificial intelligence looms large at Black Hat Europe

Review board members said that this year, AI-themed submissions of varying quality dominated. Some passed muster. Others included "AI talks written by AI, so we had to reject them," said Vandana Verma, also a member of the OWASP board of directors. The poor quality of AI-generated submissions made them easy to spot. (GOVINFOSECURITY.COM)

Trump’s Silicon Valley advisers have AI ‘censorship’ in their crosshairs

AI censorship is a term used to describe how tech companies put their thumb on the scale with their AI chatbots’ answers in order to conform to certain politics, or push their own. Others might call it content moderation, which often refers to the same thing but has a very different connotation. Much like social media and search algorithms, getting AI answers right for live news events and controversial subjects is a constantly moving target. (TECHCRUNCH.COM)

Character.AI steps up teen safety after bots allegedly caused suicide, self-harm

Following a pair of lawsuits alleging that chatbots caused a teen boy's suicide, groomed a 9-year-old girl, and caused a vulnerable teen to self-harm, Character.AI (C.AI) has announced a separate model just for teens, ages 13 and up, that's supposed to make their experiences with bots safer. In a blog, C.AI said it took a month to develop the teen model, with the goal of guiding the existing model "away from certain responses or interactions, reducing the likelihood of users encountering, or prompting the model to return, sensitive or suggestive content." (ARSTECHNICA.COM)

Collaboration

Authoritarians are hijacking global tech cooperation to undermine human rights

Hosting IGF 2024 is an attempt by the Saudi government to sanitize its track record and pitch itself as a legitimate player on the international stage. But this move is also part of a global strategy by autocrats to draft treaties and take a leading role at international forums — bringing global norms of internet governance closer to their own authoritarian worldviews. In addition to hosting IGF, the Saudi government has also thrown its support behind the UN Cybercrime Convention. The controversial agreement could further embolden authoritarians’ efforts to shape the international system in their own image and provide more ways for governments to crack down on human rights, both inside and outside of their borders. (FREEDOMHOUSE.ORG)

IPR Center, IP House announce new partnership

The National Intellectual Property Rights Coordination Center (IPR Center) and IP House have announced a new partnership to combat counterfeiting, illicit trade, and digital piracy across critical industry sectors, including consumer goods, pharmaceuticals, and electronics. This historic collaboration, formalized through a memorandum of understanding (MOU), aims to enhance the enforcement of intellectual property (IP) rights, protect the global economy, and safeguard innovations by connecting resources and sharing intelligence within the anti-counterfeiting, brand protection, and anti-piracy communities. (DHS.GOV)

Defense

DoD officials see progress in tackling weapons cybersecurity but a long way to go

The Pentagon’s cyber and IT professionals have made progress raising awareness among senior military leaders about cyber threats to weapons systems and other critical technology, but there are still some who don’t take it seriously enough, DoD Chief Information Security Officer David McKeown told an audience of Air Force contractors. (AIRANDSPACEFORCES.COM)

Are AI defense firms about to eat the Pentagon?

In an unprecedented wave of collaboration, leading AI firms are teaming up—sometimes with rivals—to serve a Pentagon and Congress determined to put AI to military use. Their growing alignment may herald an era in which software firms seize the influence now held by old-line defense contractors. “There's an old saying that software eats the world,” Byron Callan, managing director at Capital Alpha Partners, told Investors Business Daily on Wednesday. “It's going to eat the military too." (DEFENSEONE.COM)

Energy

Grid constraints limit near-term data center growth in Northwest: NPCC panelist

The Pacific Northwest faces major load growth from data centers, but near-term expansion will be limited by existing power supply and transmission capacity, according to Brian Janous, chief commercial officer at Cloverleaf Infrastructure and former vice president of energy at Microsoft. However, there are measures that can unlock existing system capacity, Janous said during a briefing on data centers for the Northwest Power and Conservation Council. (UTILITYDIVE.COM)

IT modernization

Veterans Affairs action needed to address continuing IT management challenges

After three unsuccessful attempts between 2001 and 2018, the department undertook a fourth effort — the Electronic Health Record Modernization program — to modernize its legacy health information system. However, in 2023, VA announced it was halting further deployments and instead was prioritizing making improvements at the five sites using the system. GAO has also made numerous recommendations on VA's IT governance, software licenses, and cloud computing. Yet none of these have been implemented. (GAO.GOV)

Decentralizing battle data: CDAO, Anduril open tactical ‘mesh’ to third-party developers

As the US military embraces artificial intelligence and big data, the Pentagon is trying to wean itself from reliance on centralized mega-systems and instead empower frontline leaders at the “tactical edge.” That’s why, last week, the Pentagon’s Chief Digital & AI Office (CDAO) awarded startup defense firm Anduril a $100 million, three-year contract to expand its Lattice Mesh. Lattice is a system that lets frontline forces rapidly access data from over a hundred different types of sensors — for example, to track incoming hostile drones — over existing tactical networks, without having to first relay that data through central processing hubs. (BREAKINGDEFENSE.COM)

Social media

Lawmakers tell Apple, Google to prepare for TikTok ban

The top lawmakers on the House Select Committee on the Chinese Communist Party (CCP) told Apple and Google on Friday to prepare to remove TikTok from their app stores, as a potential ban looms next month. Committee Chair John Moolenaar (R-Mich.) and Ranking Member Raja Krishnamoorthi (D-Ill.) said in a pair of letters to Apple CEO Tim Cook and Google CEO Sundar Pichai that their companies “must take the necessary steps to ensure it can fully comply” with the law by Jan. 19. (THEHILL.COM)

Trade

Cyberattacks rise in Mexico as cross-border trade grows

Mexico has seen a surge in cybercrime, including ransomware, phishing, spoofing and extortion, according to the 2024 report from the LatAm Cyber Summit, and the country’s trade industry is a popular target. Mexico averages about 298 malware attack attempts per minute, second only to Brazil (1,554 attack attempts per minute) in Latin America, the report said. The trade industry in Latin America is the third most targeted sector for cyberattacks, accounting for 11% of incidents. Government websites were the most targeted, at 31%, followed by manufacturing, at 12%. (FREIGHTWAVES.COM)

Workforce

ISC2 survey reveals critical gaps in cybersecurity leadership skills

The accreditation and training body found that in responses to open-ended inquiries, survey participants indicated that their cybersecurity leaders demonstrate limited or no skills in areas such as communication, strategic mindset and business acumen. Speaking to Infosecurity, ISC2 CISO, Jon France, explained that the findings are a major concern, especially at a time when regulations push cyber responsibility into the boardroom, making cybersecurity very much a business issue. (INFOSECURITY-MAGAZINE.COM)

The woman turning Africa into a cybersecurity talent powerhouse

Confidence Staveley is turning the tables on Africa’s cybersecurity talent shortage—and redefining what it means to lead in a male-dominated industry. Through her CyberGirls Fellowship, Staveley has trained over 3,000 young women in cybersecurity, helping 60% secure jobs and boosting their incomes by more than 400%. Her work isn’t just about filling jobs; it’s about transforming lives and shattering stereotypes. (SCWORLD.COM)

Threat of personal liability has CISOs sweating

CISOs are feeling the pressure over stories of their peers being held personally liable for cybersecurity incidents. In the most notorious example, the US Securities and Exchange Commission (SEC) last year announced that it was filing charges against both SolarWinds and its CISO, Tim Brown, amid allegations of "fraud and internal control failures relating to allegedly known cybersecurity risks and vulnerabilities.” While Brown beat the charges earlier this year, others haven’t been quite as lucky. (ITPRO.COM)

LEGISLATIVE UPDATES

TELECOM SECURITY: Rep. Randy Weber (R-Texas) introduced legislation to establish an interagency working group to assess the challenges of protecting military and commercial telecommunications networks in the United States from security threats related to the Signaling System 7 telecommunication protocol standard. (H.R. 10408)

CRITICAL MINERALS: Rep. Rob Wittman (R-Va.) introduced the Securing Essential and Critical U.S. Resources and Elements (SECURE) Minerals Act of 2024 to establish a critical mineral Resilient Resource Reserve as a permanent organization within the U.S. government. (H.R. 10378)

IMMERSIVE TECH: Rep. Suzan DelBene (D-Wash.) introduced the United States Leadership in Immersive Technology Act to establish an advisory panel tasked with creating a national immersive technology strategy. (H.R. 10359)

SPACE SECURITY: Rep. Don Bacon (R-Neb.) introduced legislation to direct the Secretary of Defense to conduct an assessment of space and satellite security relating to ally and partner countries in the Middle East. (H.R. 10353)

EVENTS

COMMERCE: On Dec. 16 the Center for a New American Security will host a fireside chat with Deputy Secretary of Commerce Don Graves to discuss shaping and implementing policy at the intersection of national and economic security, from managing export controls to securing supply chains and promoting critical technologies like semiconductors and AI.

SPACE: On Dec. 17, CSIS presents the daylong event Celebrating the U.S. Space Force and Charting its Future with leaders across the enterprise.

CHINA SECURITY POLICY: House Homeland Security Committee Chairman Mark Green (R-Tenn.) and Hudson’s Dr. Jonathan Ward will discuss the importance of cybersecurity, critical infrastructure defense, maritime and border security, the fentanyl crisis, and more amid America’s rising confrontation with China in a Dec. 17 event at the Hudson Institute.

ELECTION SECURITY HEARING: The House Administration Committee will hold the hearing “American Confidence in Elections: Prohibiting Foreign Interference” on Dec. 18.

THE STRATEGIC FUTURE OF SUBSEA CABLES: CSIS will host an event Dec. 18 to discuss cuts of critical cables and ways the U.S. government, partners and allies, and key stakeholders can take to create and maintain a secure and resilient subsea cable infrastructure.

SUPPLY CHAIN SECURITY: On Dec. 19, the Center for Technology Innovation at Brookings will host a speech and fireside chat with White House National Economic Advisor Lael Brainard and Brookings Senior Fellow Darrell West in which they will discuss ways to strengthen and secure America’s supply chains.

ENERGY OUTLOOK: Daniel Yergin, vice chairman of S&P Global and a Pulitzer Prize-winning author, discusses the forces behind the evolving energy landscape and what they mean for the world energy outlook on Jan. 6 at the Atlantic Council.

NUCLEAR SECURITY: CSIS’ Project on Nuclear Issues will host a live debate on AI Integration in U.S. Nuclear Command, Control and Communications (NC3) on Jan. 24. As Russia continues its saber-rattling and China accelerates its nuclear buildup, should the United States increase its reliance on artificial intelligence to enhance resilient decision-making in its NC3 systems to prevent inadvertent escalation? 

SPACE SECURITY: Chatham House’s 2025 Space Security Conference online and in person on March 5 convenes policymakers and leaders from the private sector, multilateral organizations, academia and NGOs for a day of high-level interactive discussions examining conflict, competition and cooperation in outer space. 

FOLLOW THE McCRARY INSTITUTE ON LINKEDIN | X | FACEBOOK

SUBSCRIBE TO THE CYBER FOCUS PODCAST: YOUTUBE | SPOTIFY | APPLE PODCASTS

GET THE DAILY CYBER BRIEFING IN YOUR INBOX: SUBSCRIBE