Mandatory breach reporting bill on deck, lawmakers say

Congress could be poised to require companies to report hacks in the wake of the massive breach linked to vulnerabilities on SolarWinds' IT management software.

 

Key industry leaders welcomed the prospect of a first-ever national cybersecurity breach reporting law for private companies, as floated by members of Congress from both parties at a hearing on Friday to look at the fallout from a massive hack linked to vulnerabilities in SolarWinds' IT management software.

Rep. Michael McCaul (R-Texas) announced that he and Rep. Jim Langevin (D-R.I.), both members of the House Homeland Security Committee are working on a bill that would establish the Cybersecurity and Information Security Agency as a kind of 911 for breach notification. McCaul said his legislation is designed to protect companies from repercussions in the market by removing sources and methods and company names out of reporting.

"It would just simply send a threat information itself to CISA so that they could deal both industrywide and federal government wide and state, the threat information they would need to address it on a larger scale," McCaul said at a joint hearing of the House Committee on Oversight and Reform and the House Homeland Security Committee on Feb. 26.

Microsoft President Brad Smith supported notification legislation at the hearing and noted that there are victims of the hack who have not identified themselves to the public as having been hit.

"Some of the largest companies in our industry, that are well-known to have been involved in this that still have not spoken publicly about what they know," Smith said. "There's no indication that they even informed customers. And I'm worried that…to some degree some other companies, some of our competitors even, just didn't look very hard."

The hack has affected about 100 private firms and at least nine federal agencies, but it appears from testimony at the hearing that the hackers were particular about what they were looking for.

According to information shared by Langevin in his questioning, about 77 individual email accounts were accessed in the hack, which has been said by federal officials to have been likely perpetrated by Russian intelligence. That number, Langevin observed is quite small when compared to the total number of accounts across the thousands of organizations that installed compromised SolarWinds' code.

"I think that was indicative of the stealthy practices that this actor tends to deploy, namely, to take great care to be very discreet," Smith said.

“The damage assessment's going to be based on the content of the emails," FireEye CEO Kevin Mandia said. "How that information is intended to be used -- we don’t know. That's the problem. We have to get our arms around all the content, and all the potential use and misuse of all that content."

SolarWinds CEO Sudhakar Ramakrishna, said it is closer to understanding how the malware was injected into company updates for its Orion IT management software product.

They're focused on three possibilities, he said. One is the password spraying; the next, credential theft, and the third is through a vulnerability in third party software used by the company in their on-premise infrastructure.

"Just like other companies on this witness stand, we use a lot of third-party software as well, and we are looking at it in those three dimensions at this point. We are evaluating several petabytes of data to be able to sift through this in the hopes that we can pinpoint patient zero in this context," Ramakrishna.

Lawmakers also honed in on a claim from SolarWinds that one possible vector of compromise was the use of an insecure password -- SolarWinds123 – to provide access to company servers.

"I've got a stronger password than SolarWinds123 to stop my kids from watching too much YouTube on their iPad. You and your company were supposed to be preventing the Russians from reading Defense Department emails," Rep. Katie Porter (D-Calif.) said to Ramakrishna.

"Do you agree that companies like yours should be held liable when they don't follow best practices, yes or no," Porter added. Ramakrishna didn't answer directly, but the issue of liability has proven a sticking point for breach notification legislation in the past.

As far as how hackers got into U.S. federal government networks, witnesses told lawmakers that once hackers were in a network, they were able to take advantage of lapses in basic cybersecurity practices. It’s likely they were able to access Justice Department accounts using methods like stealing passwords, Smith said.

Some lawmakers also asked focused questions about cloud migration and threat hunting, the practice of looking for cyber threats in a network proactively.

The ability for CISA he ability to conduct threat hunting on federal agency networks, as provided by the 2021 NDAA, is "exactly the right thing to do," Mandia said.

Rep. Gerry Connolly (D-Va.) asked how the federal government can support private companies that threat hunt on federal networks.

The most important step will be centralized cyber breach reporting, Smith told him, as well as sharing information back out to the private sector. The area will need more legislation, he said.

One hurdle Congress will also need to address is the ways that agencies restrict contractors from sharing their cybersecurity information about what they are seeing with other parts of the federal government.

"One of the specific things that we had to do in December was go to each agency, tell them that we had identified that they were a victim of this and then we had to say, 'you need to go over to this person in the other part of the government to let them know. Please do that, we cannot do that for you,'" Smith explained.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.