Biden Proposes Billions For Cybersecurity After Wave of Attacks
President Joe Biden’s infrastructure proposal includes billions of dollars tied to improving cybersecurity, an area of intensified interest after the ransomware attack on the Colonial Pipeline Co. sent U.S. gasoline prices soaring last week. Biden Proposes Billions For Cybersecurity After Wave of Attacks
But the exact amount that will be spent on improving cyber defenses remains to be seen.
The $2 trillion American Jobs Plan, as the infrastructure proposal is known, includes $20 billion for state, local and tribal governments to modernize their energy systems contingent upon meeting cybersecurity standards, as well as $2 billion for grid resilience in high-risk areas that will be contingent on meeting cybersecurity targets, the White House said in a fact sheet obtained by Bloomberg News ahead of its release Tuesday.
The administration is also characterizing the plan’s call for $100 billion for high-speed broadband access as part of its wider security effort, since grant recipients will be asked to source from “trusted vendors” and implement cybersecurity measures. In addition, the plan lays out a new tax credit for transmission infrastructure that the administration believes will encourage stronger cyber capabilities.
The White House is negotiating with a group of Senate Republicans on an infrastructure bill that would include much of Biden’s proposal, with a counter-proposal expected from the senators on Tuesday. The original infrastructure plan, which was released at the end of March, doesn’t mention the need for cybersecurity spending.
Administration officials, speaking on the condition of anonymity to preview the outline of cybersecurity proposals, stressed that the jobs plan proposals are just one part of a broader effort to elevate cyber issues across the federal government. “Cybersecurity is one of the preeminent challenges of our time, which is why President Biden has made strengthening U.S. cybersecurity capabilities a top priority,” the White House said in the fact sheet.
Biden signed an executive order on May 12 intended to improve the federal government’s information sharing about cyberattacks with the private sector while adopting better safety practices throughout the government. The order is intended to help the U.S. respond more swiftly to attacks on both public and private infrastructure.
Biden’s fiscal 2022 budget blueprint, released last month, included $2.1 billion for the Cybersecurity and Infrastructure Security Agency, $110 million more than its funding for 2021. The American Rescue Plan, signed by Biden in March, authorized an additional $1.65 billion for cybersecurity efforts.
That includes $1 billion for the federal government’s Technology Modernization Fund, which will go toward immediate security upgrades and a shift to a secure cloud infrastructure, and $650 million for CISA to improve its response capabilities and to upgrade its ability to support security projects at federal departments and agencies.
The Colonial attack is the latest in a series of devastating hacks against American government agencies, businesses and health facilities. They include a cyber-attack by Russian hackers that targeted software updates in Texas-based SolarWinds Corp., which were then received by some of its customers. In all, nine government agencies and about 100 companies were infiltrated by the Russian hackers, using the SolarWinds’s backdoor and other methods.
The pipeline ransomware attack came after the Biden administration had announced several initiatives to try to curb ransomware, a type of attack in which hackers encrypt computer files and demand payment to restore access. The number of ransomware attacks has been growing in recent years and the targets have included hospitals, schools, businesses and police departments. The Colonial attack was attributed to a group called DarkSide. Biden and cybersecurity experts said there is some evidence linking the group to Russia.
The Biden administration began a 100-day effort in April to improve the cybersecurity of electric utilities’ industrial control systems. It plans to move on to natural gas, water supply and chemical pipelines, Biden said last week as he responded to the Colonial crisis.
Hackers Kept Busy During Covid Stealing 774 Million Records in Major Breaches
Colonial Pipeline. Microsoft Exchange. SolarWinds. More and more companies in the U.S. and around the world fall prey to cyberattackers, a trend driven in part by the proliferation of internet-connected devices and the low barriers for entry for would-be hackers, since ransomware and other types of malicious software are available for sale on the dark web.
In addition, the pandemic has facilitated hackers’ efforts, as employees have transitioned to working from their homes, which tend to be less secure than the office, and spend more time than ever on the internet. So-called “phishing” is one of the most frequently used mechanisms for hackers to deliver their attacks, usually through emails laced with malicious code in attachments or links.
Among the preferred types of attack for threat actors is now ransomware—a type of malware that attackers use to lock up files—according to a recent report by the Identity Theft Resource Center. Ransomware can generate big payouts, as the Colonial Pipeline incident earlier this month showed. On the other hand, cybercrimes where hackers exfiltrate an entire database they hope they can later sell declined 19% in 2020 compared with the year before, according to ITRC.
But it’s not just criminal hackers. In the last year, hacking teams tied to nation-states have attempted to breach vaccine makers, government agencies, even cybersecurity companies.
Most hacking attempts fail and some that succeed are relatively minor. But some hacks have exposed personal identifiable information of billions of individuals and caused major financial pain to tech, healthcare and retail giants. Bloomberg News gathers and analyses data on major cyber attacks that expose 1 million records or more.
Since January 2020, 58 corporate, government and non-profit organizations have experienced such breaches which exposed 774 million records. Over the course of more than a decade, the tally exceeds 11 billion records across almost 335 entities.
The number of records exposed in a breach is one measure of a hack’s severity. And even then, the numbers only tell part of the story. A breach that exposes email addresses isn’t great but isn’t nearly as bad as one that includes social security numbers or sensitive medical records.
One of the more damaging hacks occurred in 2014, Chinese attackers took advantage of lax security at the U.S. Office of Personnel Management and made off with a motherlode of sensitive personal information (including 5.6 million fingerprint records) on a total of 22.1 million government employees and individuals that had gone through security clearance background checks.
In the corporate world, hacks ranged from a few million records exposed to several billion, the 2013 breach of Yahoo! remains among the biggest of all time, as user information on all of its 3 billion users at the time was stolen. In 2015, 80 million records were taken in a hack on Anthem, including personal information and employment data for members of affiliated health plans.
More recently, in 2019, a hacker tapped into the vast trove of data stored on servers Capital One Financial Corp. was using and exposed personal information on more than 100 million Americans.
But other major hacks aren’t reflected in record tallies. For instance, Russian hackers installed a backdoor in software by Texas-based SolarWinds Corp., which they then used, in addition to other methods, to infiltrate nine U.S. government agencies and about 100 companies. The number of records stolen isn’t known. A Microsoft executive described the attack—which was disclosed in December 2020—as the “largest and most sophisticated attack” ever.
Nowadays, user and corporate data are among a business’s most valuable and most sensitive assets. As a growing number of hackers attempt to exfiltrate such information for their own benefit, Bloomberg News will be updating this story with more cybersecurity incidents when they become known.