Reposted from BBC

Palestine Action said one of its activists had "ruined" a 1914 painting of Lord Balfour at Trinity College, part of the University of Cambridge. A statement on the group's website said the painting had been "slashed" and sprayed with red paint. A Cambridgeshire Police spokeswoman said: "This afternoon we received an online report of criminal damage today to a painting at Trinity College, Cambridge. "Officers are attending the scene to secure evidence and progress the investigation. No arrests have been made at this stage." Lord Balfour was foreign secretary in 1917 when a declaration was made pledging Britain's support for the establishment "in Palestine of a national home for the Jewish people" and has been seen by some historians as a starting point for the Arab-Israeli conflict. A spokeswoman for Trinity College said: "Trinity College regrets the damage caused to a portrait of Arthur James Balfour during public opening hours. The police have been informed.

Support is available for any member of the college community affected." Palestine Action said, in a statement: "Palestine Action ruined a 1914 painting by Philip Alexius de László inside Trinity College, University of Cambridge of Lord Arthur James Balfour - the colonial administrator and signatory of the Balfour Declaration." They added that "an activist slashed the homage and sprayed the artwork with red paint".

See Original Post

Reposted from CISA

As we celebrate Women’s History Month, we honor and celebrate the remarkable women who have tirelessly advocated for equality and inclusion. Their contributions have paved the way for progress in various fields, including cybersecurity. At CISA, we recognize the importance of diversity in our workforce and the pivotal role women play in shaping the future of national security.

Within cyber, physical, and global security, there is a cadre of pioneering women who have fearlessly championed diversity and inclusion. Bold women like our Vice President, Kamala Harris, U.S. Director of National Intelligence, Avril Haines; and internationally, women like Lisa Fong, Director of New Zealand’s National Cyber Security Centre, Abigail Bradshaw Head of the Australian Cyber Security Centre (ACSC), and Lindy Cameron, former UK Head of Cybersecurity; and now, a new generation of women’s rights advocates like Presidential Medal of Freedom recipient and U.S. soccer champion Megan Rapinoe, national youth poet laurate Amanda Gorman, and Nobel Peace Prize laurate Malala Yousafzai have emerged to carry the torch for women across the globe. Through highlighting their extraordinary contributions, we illuminate the path they have forged towards equal opportunities for all women--including within the world of cybersecurity, technology, and infrastructure protection.

As the Director of CISA, I am honored to lead an agency dedicated to safeguarding our nation’s critical infrastructure. Every day, we work tirelessly to understand, manage, and reduce risk to the cyber and physical infrastructure that Americans rely on. I am inspired every day when I look at the amazing women leading CISA, including our Chief of Staff, Kathryn Coulter Mitchell; Val Cofield, CISA’s Chief Strategy Officer; Alaina Clark, Head of Stakeholder Engagement; Mona Harrington, Head of the National Risk Management Center; Bridget Bean, Chief Integration Officer; and Dr. Elizabeth Kolmstetter, CISA’s very first Chief People Officer. And these are only a few of the women leaders shaping our mission in immeasurable ways for our Nation’s safety and security.

In 2022, I set an ambitious goal and nationwide challenge to have 50% of the cybersecurity workforce made up of women by 2030. While there is still much more work to do, I’m proud to say that we are 38% women at CISA, and we continue to aggressively seek out and hire exceptionally talented women who have revolutionized the way we operate. The value of women’s voices in security have had cascading effects across our organization and, more broadly, our nation.

Within CISA, we are committed to promoting diversity as a fundamental pillar of our organizational ethos. Through the implementation of strategic recruitment initiatives, comprehensive training programs, and ongoing efforts to cultivate a culture of belonging, we endeavor to nurture a workforce that provides the diversity of thinking required to solve our most challenging problems. I encourage you to learn more about CISA’s efforts to promote Women in Cybersecurity, and to share this information widely with the women in your life. Reflecting on the important contributions of women across history and today, I am inspired by the resilience, courage, and compassion, shaped by unique experiences, that define women’s contributions to not only society, but history. I am committed to leveraging my platform to effect positive change and empower the next generation of women leaders. I recently sat down with Caitlin Sarian, also known as Cybersecurity Girl, to talk about Women in Cyber and how we are working to increase the number of women in the cyber field. As we celebrate Women’s History Month, let us honor the achievements of women past, present, and future. Together, we can continue to build a more equitable and inclusive world where every woman and girl has the opportunity to thrive and succeed.

See Original Post

Reposted from Tim Richardson

Last week I talked about how high performers should take regular breaks away from work to bring their best into their work. This week we will consider the advantages of workflow pauses for high performers.

Over the last few weeks, I have had several speaking engagements that were within driving distance. To help make them as stress free as possible, I made sure that my luggage was packed 48 hours before traveling. Over the years, I have forgotten many travel necessities by hurriedly packing too close to my departure. Packing earlier, and using a checklist, has all but eliminated this problem. I’ve also tried to give myself extra travel time to account for anything unexpected. When I am at the event venue, I have been early for my appointed meeting times with my client. I double check hotel reservations and communicate with the team setting up the meeting room the day before. Anything that I can do the night before my speech is taken care of to reduce the last-minute stress of trying to get everything done. This includes laying out my clothes and presentation materials.

Since I have traveled a lot by car recently, I have been more aware of signs to encourage me to slow down. A rest area sign, that I would have driven by in the past, was a reminder to stop even for a few minutes to break up the monotony of the highway. I have had a lot quieter time in my car instead of always filling it with music or a podcast or audio book. To have more thinking time, I haven’t turned on a TV in my hotel room and I request restaurant seating that is out of view of a television screen. Finally, I changed the screen color on my iPhone to gray to remind me that life is much more colorful and interesting in the real world. Less time staring at a screen is helpful in focusing on things that really matter. Other content ideas for how to slow down at work include: Slowing down to prepare for an important phone call. Take some time to prep for a call just as you would for an important in-person meeting. Write down objectives of the call and anticipate questions you might be asked as well as any objections that may be expressed.

Reread your emails before you send them. Check for understanding and clarity in what you write. Make them as brief as possible and limit the number of people who are copied on your emails. Advise the reader if you need additional information with a reasonable time frame for them to respond. Really think before you speak. Be as brief as possible when you do and include questions to others and repeating their key points to check for understanding.

See Original Post

Reposted from CISA

The Cybersecurity and Infrastructure Security Agency (CISA) joins the National Security Agency (NSA) as a partner in five cloud security Cybersecurity Information Sheets (CSIs) that provide recommended best practices and mitigation strategies for organizations transitioning their information technology resources to cloud environments. NSA released “Top Ten Cloud Mitigation Strategies”, a compilation of CSIs each on a different strategy to secure cloud environments and CISA co-sealed five of the ten. The CISA and NSA co-authored publications are:

• Use Secure Cloud Identity and Access Management Practices 
• Use Secure Cloud Key Management Practices 
• Implement Network Segmentation and Encryption in Cloud Environments  
• Secure Data in the Cloud
• Mitigate Risks from Managed Service Providers in Cloud Environments 

The CSI for each strategy includes an executive summary providing background information, details on threat models, best practices for strong cybersecurity and additional guidance to protect networks. All organizations need to understand that securing their information is a responsibility for both the cloud provider and user. All organizations using cloud environments are encouraged to review these strategies and assess how they can strengthen their security.

See Original Post

 Reposted from

Yesterday, the Cybersecurity and Infrastructure Security Agency (CISA) concluded a two-day Open-Source Software (OSS) Security Summit convening OSS community leaders and announced key actions to help secure the open-source ecosystem. Recognizing that OSS underpins the essential services and functions of modern life, the Summit sought to catalyze progress in advancing security of this critical ecosystem. This urgency was underscored by security flaws such as the Log4Shell vulnerability in 2021.
CISA Director Jen Easterly opened the summit with keynote remarks and was followed by a panel discussion with Office of National Cyber Director (ONCD) Assistant National Cyber Director for Technology Security Anjana Rajan, CISA Open-Source Security Section Chief Aeva Black, and CISA Senior Technical Advisor Jack Cable. The summit also featured a tabletop exercise on open-source vulnerability response and a roundtable discussion on package manager security with opening remarks by CISA Executive Assistant Director for Cybersecurity Eric Goldstein. During the summit, OSS community leaders, including open-source foundations, package repositories, civil society, industry and federal agencies explored approaches to help strengthen the security of the open-source infrastructure we all rely upon. As part of this collaborative effort, CISA announced several initial key actions that CISA will take to help secure the open-source ecosystem in partnership with the open-source community:

• CISA, as detailed below, is working closely with package repositories to foster adoption of the Principles for Package Repository Security framework. Developed by CISA and the Open-Source Security Foundation’s (OpenSSF) Securing Software Repositories Working Group, this framework was published earlier this month and outlines voluntary security maturity levels for package repositories.

• CISA has launched a new effort to enable voluntary collaboration and cyber defense information sharing with open source software infrastructure operators to better protect the open source software supply chain.

• Materials from the summit’s tabletop exercise will be published by CISA so that the lessons learned can be used by any open-source community to improve their vulnerability and incident response capabilities.

• The Rust Foundation is working on implementing Public Key Infrastructure for the Crates.io package repository for mirroring and binary signing and plans to issue a Request for Comment. The Rust Foundation also published a detailed threat model for Crates.io and has created tooling to identify malicious activity. Further steps are highlighted in the Rust Foundation’s Security Initiative Report.

• The Python Software Foundation is working to add additional providers to PyPI for credential-less publishing (“Trusted Publishing”), expanding support from GitHub to include GitLab, Google Cloud and ActiveState as well. Work is ongoing to provide an API and related tools for quickly reporting and mitigating malware, with the goal of increasing PyPI’s ability to respond to malware in a timely manner without consuming significant resources. Finally, the Python ecosystem is finalizing PEP 740 (“Index support for digital attestations”) to enable uploading and distributing digitally signed attestations and metadata used to verify these attestations on a Python package repository, like PyPI.

• Packagist and Composer have recently introduced vulnerability database scanning and measures to prevent attackers from taking over packages without authorization. Further work to increase security in line with the Principles for Package Repository Security framework is in progress, and a thorough security audit of existing codebases will take place this year.

• The package repository npm requires maintainers of high-impact projects to enroll in multifactor authentication. Additionally, npm has introduced tooling that allows maintainers to automatically generate package provenance and SBOMs, giving consumers of those open-source packages the ability to trace and verify the provenance of dependencies.

• Maven Central (maintained by Sonatype) is the largest open-source repository for Java and JVM languages and enforces validation and metadata requirements with clear namespaces. Since 2021, all staged repositories have automatically been scanned for vulnerabilities when published, and developers receive a report with any security issues. In 2024, Maven Central is transitioning publishers to a new publishing portal that has enhanced repository security, including planned support for multifactor authentication. Upcoming key initiatives include Sigstore implementation, Trusted Publishing evaluation, and access control on namespaces. This includes Maven Central benchmarking the maturity of its security processes against best practices, which will also guide backlog prioritization.

See Original Post

We are excited to extend an invitation to you for an insightful webinar series focused on Small and Medium Businesses (SMBs) organized by the Cybersecurity and Infrastructure Security Agency (CISA) in collaboration with the Information Technology Sector Coordinating Council (IT SCC).

In today's rapidly evolving digital landscape, SMBs face unique challenges and threats. This webinar series aims to equip participants with essential knowledge to navigate these challenges effectively. Our upcoming session will delve into the critical topic of Ransomware, shedding light on the prevailing threats, strategies for understanding Ransomware, and proactive measures for prevention.

Here are the key details:

Webinar Topic: Ransomware: Threats, Understanding, and Prevention
Date: March 25, 2024
Time: 1:30 p.m. – 2:30 p.m. EST

This session will feature insights from experts at CISA alongside industry leaders, offering invaluable perspectives and practical advice. Moreover, we encourage active participation by providing dedicated time for questions and answers, ensuring that attendees can engage directly with the presenters.

Who should attend? This webinar is tailored for federal, state, local, and private sector stakeholders interested in gaining a deeper understanding of the risks associated with critical infrastructure systems and their interdependencies.

Don't miss out on this opportunity to enhance your cybersecurity posture and safeguard your organization against evolving threats.

Join Now

Reposted from EMR-ISAC

Cybersecurity professionals can expect fresh reading materials in the coming months from the Office of the National Cyber Director, which aims to issue an update to the National Cybersecurity Strategy Implementation Plan before the summer is over, a White House cyber official said Tuesday. The implementation plan outlines how the White House will accomplish the goals outlined in the national cybersecurity plan and is supposed to be a “living document” that is updated as initiatives are complete or new initiatives are added. The implementation plan 2.0 is expected “late spring, early summer,” said Brian Scott, deputy assistant national cyber director for cyber policy and programs.

Cybersecurity pros can also expect an update on software liability reform in the next implementation plan release. In its recently released National Cybersecurity Strategy, the Biden administration called on Congress to develop legislation to develop a software liability regime, one that would allow consumer and businesses to sue software makers if they fail to take proper care in designing the security of their tools. Software companies, if the White House has its way, will no longer be able to disclaim liability for the products they produce.

The Biden administration is currently looking at developing a framework around software liability. One aspect of the framework will be exploring how best to implement safe harbor incentives for companies that are developing code using secure methods. Companies that align with those best practices — which are still being explored — are less likely to face legal issues down the road.

See Original Post

Reposted from EMR-ISAC

The Cybersecurity and Infrastructure Security Agency’s (CISA’s) Emergency Services Sector (ESS) Management Team has partnered with the Department of Homeland Security (DHS), Center for Prevention Programs and Partnerships (CP3) to educate first responders on the Targeted Violence and Terrorism Prevention (TVTP) Grant Program.

CISA and CP3 will host a webinar on Tuesday, March 19, 2024, at 1 p.m. EDT, Targeted Violence and Terrorism Prevention Grant Program. This webinar will discuss how homeland security, public safety, emergency management and emergency response personnel can apply to the TVTP program and how TVTP funds can be used to develop prevention capabilities in their community. This webinar is part of CISA’s quarterly Emergency Services Sector Resilience Development series. The series is facilitated by CISA’s ESS Management Team and focuses on topics of interest to ESS stakeholders.

No advanced registration is required to join this webinar. To participate, mark your calendar for March 19, 2024, at 1 p.m. EDT and go to CISA’s Homeland Security Information Network (HSIN) Connect Room at the scheduled time to join: https://share.dhs.gov/cisatargetedviolentprogram/. A HSIN account is not required to join; participants may enter the room as a guest.

See Original Post

Reposted from EMR-ISAC

Jurisdictions establish Emergency Operations Centers (EOC) to meet their unique requirements and needs, so no two EOCs are designed the same way. The Federal Emergency Management Agency (FEMA) provides tools and resources for building or maintaining EOCs, in accordance with the National Incident Management System (NIMS).

EOC Skillsets serve as a flexible framework for building the capabilities and qualifications of EOC personnel, allowing EOC leaders to build position qualifications according to their organization’s needs and resources.

FEMA’s National Integration Center (NIC) has just released updated EOC Skillsets for each function and level of responsibility of EOC personnel. Once finalized, this version of the EOC Skillsets will supersede the 2018 version. The NIC is seeking input on the updated EOC Skillsets during a national engagement period that concludes on Thursday, March 28, 2024.

This update is based on best practices related to operations; assessing processes and transitioning; capabilities; infrastructure (technology); personnel; and comprehensive training. The updates incorporate lessons learned related to supporting temporary or extended virtual EOC operations or replacing the typical EOC model with a hybrid/virtual option.

See Original Post

Reposted from EMR-ISAC

The National Institute of Standards and Technology (NIST) has updated the widely used Cybersecurity Framework (CSF), its landmark guidance document for reducing cybersecurity risk. The new 2.0 edition is designed for all audiences, industry sectors and organization types, from the smallest schools and nonprofits to the largest agencies and corporations — regardless of their degree of cybersecurity sophistication.

The CSF 2.0, which supports implementation of the National Cybersecurity Strategy, has an expanded scope that goes beyond protecting critical infrastructure, such as hospitals and power plants, to all organizations in any sector. It also has a new focus on governance, which encompasses how organizations make and carry out informed decisions on cybersecurity strategy. The CSF’s governance component emphasizes that cybersecurity is a major source of enterprise risk that senior leaders should consider alongside others such as finance and reputation.

See Original Post