Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

Show NLP summaries collection recirc on article pages

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Trump team throws out GOP plan and builds a ‘leaner’ 2024 operation 

2024 election latest news: Biden raising money in San Francisco, Seattle areas

Trump thinks his anti-green culture war is worth a $1 billion donation

Israel’s shameful ban on Al Jazeera

Checks, not sex, and other takeaways from Trump’s New York hush money trial

In Arizona, election workers trained with deepfakes to prepare for 2024

The urgent air defense lessons of April 16 

Are smartphones destroying childhood? It’s complicated.

In the campaign against Donald Trump, do the ends justify the means?

The case for eating at Italian gas stations

Cruise ship drags dead whale into New York, prompting investigation

5 big travel lessons from an accomplished conservationist

Photos of his mom at lunch are a balm people didn’t know they needed

Dog hit by car loses leg, is adopted by firefighter who helped her

Postal worker finds WWII-era letters, drives 5 hours to deliver them

Claire Messud turns her family’s history into a masterpiece

Kristi Noem’s dog killing is pure Southern gothic

Joseph Epstein, conservative provocateur, tells his life story in full

Vegetables star at Mita, where you get taste after taste (after taste)

To get outs with his fastball, Trevor Williams put his ego aside

4 best things to do with kids in the D.C. area this weekend

5 myths about Social Security as the program faces a funding crisis

Social Security has to be fixed. But you still need your own savings.

An I bond is now at 4.28 percent. Are they still a good deal?

What actually happens within your lawn when you don’t mow it

What Trump said in his 10 gag order violations

Find your Westminster show dog name: You may be a CH Lolly’s Marble Tuxedo MX

Google’s new ‘Find My’ device network is useful but a stalking risk

Apple apologizes for iPad ad after blowback 

Hack targeting hospital chain Ascension is impacting patient care

Battles rage around Rafah’s edge as more than 100,000 flee the city

Biden’s weapons sales to Israel breach legal limits, former officials say     

China’s latest wellness trend? Marathons. But good luck getting a spot.

Miss Manners: Why were other diners laughing at us?

Ask Amy: Man doesn’t want cancer to define him

Carolyn Hax: In-laws stalk the live stream to check couple’s attendance at church

US-POLITICS-BIDEN

See more coverage in your recommendations

Get the weekly Campaign Moment newsletter

Set alerts for major election developments

Election 2024

The Campaign Moment newsletter

Politics alerts

Welcome to The Cybersecurity 202! I’m looking forward to handing out some candy tonight. Bring your “A” game on those costumes, kids.

Was this forwarded to you? <a href="https://www.washingtonpost.com/newsletters/the-cybersecurity-202/">Sign up here.</a>

Below: The global cyber workforce increases, and an executive order gives the Homeland Security Department several tasks. First:

The SEC did some new things in its SolarWinds enforcement case

Andrew Kelly

The Securities and Exchange Commission on Monday sued SolarWinds over what the commission argued were its poor digital safeguards and its failure to disclose them leading up to the landmark breach of the software firm, which has been called one of the worst ever.

The SEC accused SolarWinds and chief information security officer Tim Brown of ignoring red flags about vulnerabilities for years leading up to the eventual disclosure of the breach in late 2020. The U.S. government in April 2021 formally <a href="https://www.whitehouse.gov/briefing-room/statements-releases/2021/04/15/fact-sheet-imposing-costs-for-harmful-foreign-activities-by-the-russian-government/">blamed hackers</a> in Russia’s foreign intelligence service for committing the breach.&nbsp;

I already wrote about the details of the case and <a href="https://www.washingtonpost.com/national-security/2023/10/30/solarwinds-computer-breach-sec-russia/">recapped some of the details of the breach here</a>, but there’s more to say about what happened and what it means.&nbsp;

There are at least three noteworthy unique elements to the case, a former assistant director in the SEC’s enforcement division, Jenner &amp; Block partner Jennifer Lee, told me. Lee oversaw the SEC’s first cyber enforcement action, in which Yahoo settled with the commission in 2018.

It’s the first time in an SEC cyber case that the commission has alleged that an organization intended to deceive investors, she said.

It’s the first time in an SEC cyber case that the commission has brought action against an individual, she said.

It’s the first time in an SEC cyber case that the commission has alleged that a company had failures in its internal controls for safeguarding itself, she said.

On the second point, when the SEC first alerted SolarWinds that it might be subject to an enforcement action, <a href="https://www.washingtonpost.com/politics/2023/06/29/sec-notices-spark-alarm-cyber-executives/">it set off alarms among cyber executives</a>.

Another thing my earlier story didn’t delve into were some of the specifics of the SEC allegations.

The SEC relied heavily on statements by company employees and officials to emphasize that SolarWinds was aware of its security woes. <a href="https://www.sec.gov/news/press-release/2023-227">According to the complaint</a>:

An engineer said in 2018 that the company’s remote access setup was “not very secure,” and that someone who exploited that insecurity “can basically do whatever without us detecting it until it’s too late” and cause “major reputation and financial loss” for SolarWinds.

Multiple presentations in 2019 and 2020 warned that the company had problems with its controls over who could access its systems.

In July 2020 Brown said hackers were familiar with SolarWinds’ software and knew “how to deploy software, shut off backup, etc.” That same month an engineering team member said they were “spooked” “by activity at a SolarWinds customer, prompting Brown to say that the incident was “very concerning” and adding, “As you guys know our backends are not that resilient and we should definitely make them better.”

We are “so far from being a security minded company,” an information security manager wrote in November 2020, saying that every time “I hear about our head geeks talking about security I want to throw up.”

Gurbir Grewal, director of the SEC’s division of enforcement, said in a statement that “[r]ather than address these vulnerabilities, SolarWinds and Brown engaged in a campaign to paint a false picture of the company’s cyber controls environment, thereby depriving investors of accurate material information.”&nbsp;

“Today’s enforcement action not only charges SolarWinds and Brown for misleading the investing public and failing to protect the company’s ‘crown jewel’ assets, but also underscores our message to issuers: implement strong controls calibrated to your risk environments and level with investors about known concerns.”

SolarWinds had already signaled it was prepared to fight the SEC on this, and the company reiterated that message Monday.

“We are disappointed by the SEC’s unfounded charges related to a Russian cyberattack on an American company and are deeply concerned this action will put our national security at risk,” the company said in a statement. “The SEC’s determination to manufacture a claim against us and our CISO is another example of the agency’s overreach and should alarm all public companies and committed cybersecurity professionals across the country. We look forward to clarifying the truth in court and continuing to support our customers through our Secure by Design commitments.”

Alec Koch, an attorney at King &amp; Spalding representing Brown, said: “Tim Brown performed his responsibilities at SolarWinds as Vice President of Information Security and later as Chief Information Security Officer with diligence, integrity, and distinction. Mr. Brown has worked tirelessly and responsibly to continuously improve the Company’s cybersecurity posture throughout his time at SolarWinds, and we look forward to defending his reputation and correcting the inaccuracies in the SEC’s complaint.”

Global cybersecurity workforce up, but demand still outpaces supply

Wilfredo Lee

The global cybersecurity workforce has reached a record high of 5.5 million people, but a gap of some 4 million people still needs to be filled to adequately safeguard digital assets, a <a href="https://www.isc2.org/Research">new report</a> out this morning finds.

The International Information System Security Certification Consortium, or ISC2, said that 440,000 new jobs were added to the global cyber workforce over the past year but that the gap of 4 million professionals marks a record level of demand outpacing supply in the industry.&nbsp;

The past year’s growth of the cybersecurity workforce amounts to an 8.7 percent increase, according to the report. But the gap amounts to a 12.6 percent year-over-year increase, it said.

ISC2's report also draws from surveys of nearly 15,000 “international practitioners and decision-makers” about workforce issues, it said.

U.S.-led coalition developing commitment to not pay ransomware hackers

Demetrius Freeman

A U.S.-led group of nations is developing a joint policy statement to declare that member countries will commit to not paying ransomware hackers when they hold sensitive data hostage in exchange for a ransom payment, a senior administration official told a group of reporters on the condition of anonymity to be transparent about the plans.

The news comes as the United States hosts member countries at its third International Counter Ransomware Initiative summit in D.C., where the joint commitment and other measures are being developed to help expel global ransomware threats.

Among additional steps to fight back against ransomware, the Treasury Department will also pledge to share data on blacklisted cryptocurrency wallets so that countries can see wallets that are moving <a href="https://www.wsj.com/finance/currencies/most-popular-cryptocurrency-keeps-showing-up-in-illicit-finance-71d32e5e">illicit payments</a> for funding the cyberattacks and alert their own digital asset providers to obstruct or freeze those transactions. The coalition is also developing an information-sharing platform for member states to quickly alert one another about ransomware threats.&nbsp;

The more assertive approach being taken this year reflects a coalition-wide goal of axing the main incentive for ransomware hackers that pushes them to keep operating: money.

“As long as there’s money flowing to ransomware criminals, this [problem] will continue to grow,” Anne Neuberger, deputy national security adviser for cyber and emerging technology, told reporters.

Notably, U.S. adversaries like Russia will not be major focuses of the meeting, despite headline-making <a href="https://www.washingtonpost.com/dc-md-va/2023/05/16/babuk-ransomeware-attack-dc-police-indictment/">ransomware incidents</a> linked to them and other major state-backed groups this year. “We don't focus on who the actor is, we build the capability to respond independent of the actor,” the senior administration official said.

DHS has laundry list of cyber, privacy priorities in AI executive order

Kevin Wolf

The Homeland Security Department is facing down a <a href="https://www.dhs.gov/news/2023/10/30/fact-sheet-biden-harris-administration-executive-order-directs-dhs-lead-responsible">slew of cyber and privacy priorities</a> directed to the agency following President Biden’s signing of a sweeping <a href="https://www.washingtonpost.com/technology/2023/10/30/biden-artificial-intelligence-executive-order/">AI executive order</a> Monday.

The department will have to address the emerging technology’s use in securing critical infrastructure and cyberspace. Secretary Alejandro Mayorkas has been directed to establish and chair an AI Safety and Security Advisory Board that would bring together industry leaders from research labs, infrastructure providers and AI companies to recommend best practices for AI uses.

“The unprecedented speed of AI’s development and adoption presents significant risks we must quickly mitigate, along with opportunities to advance and improve our work on behalf of the American people,” Mayorkas said in a statement that acknowledged the advisory board and other directives.

The department’s Cybersecurity and Infrastructure Security Agency will also examine AI’s use in critical infrastructure sectors and will be further exploring the use of AI in discovering <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">software vulnerabilities</a>.

DHS is also directed to investigate how AI systems may be hijacked to help people develop <a href="https://www.sciencealert.com/ai-experiment-generated-40-000-hypothetical-bioweapons-in-6-hours-scientists-warn">biological weapons</a> or <a href="https://thebulletin.org/2023/03/what-happened-when-wmd-experts-tried-to-make-the-gpt-4-ai-do-bad-things/">weapons of mass destruction</a>.

<a href="https://www.computerworld.com/article/3709609/data-poisoning-anti-ai-theft-tools-emerge-but-are-they-ethical.html">Intellectual-property theft</a> also gets a spotlight for the department in the executive order, with a call to “create a program to help AI developers mitigate AI-related IP risks” using current agency resources.&nbsp;

The department made commitments to ensure ethical use of the tool to protect people’s privacy, though several groups have highlighted that the executive action does not enable any sort of federal privacy measures, which would have to be <a href="https://www.washingtonpost.com/politics/2022/07/28/house-senate-collision-course-over-childrens-privacy/">taken up by Congress</a>.&nbsp;

<a href="https://www.nextgov.com/emerging-tech/2023/10/house-dems-seek-guardrails-law-enforcements-use-facial-recognition/391619/" target="_blank">House Dems seek guardrails for law enforcement’s use of facial recognition (Nextgov)</a>

<a href="https://www.404media.co/youtube-is-monetizing-the-suffering-of-an-open-air-drug-market/" target="_blank">YouTube is monetizing human suffering at an open air drug market (404 Media)</a>

<a href="https://themessenger.com/tech/hackers-artificial-intelligence-phishing-scams-attacks" target="_blank">Hackers are weaponizing AI to improve phishing attacks (The Messenger)</a>

<a href="https://www.reuters.com/technology/israeli-cyber-security-company-check-points-q3-profit-tops-estimates-2023-10-30/" target="_blank">Israel's Check Point says cyberattacks rising, sees higher profit (Reuters)</a>

<a href="https://www.bloomberg.com/news/articles/2023-10-31/modi-s-rivals-claim-iphones-hit-by-state-backed-hacking-attempts" target="_blank">India to probe Modi rivals’ claims of iPhone hack attempts (Bloomberg News)</a>

<a href="https://cybernews.com/news/russia-multiscanner-virustotal-alternative/" target="_blank">Russia creating VirusTotal alternative to escape Western ‘surveillance’ (Cybernews)</a>

<a href="https://www.reuters.com/technology/canada-bans-wechat-kaspersky-applications-government-devices-statement-2023-10-30/" target="_blank">Canada bans WeChat, Kaspersky applications on government devices (Reuters)</a>

<a href="https://www.thestar.com/news/canada/toronto-public-library-website-some-services-affected-by-cybersecurity-incident/article_8e077a0c-8259-53b8-adca-5a2639bf6cf1.html" target="_blank">Toronto Public Library website, some services affected by cybersecurity 'incident' (Toronto Star)</a>

<a href="https://www.bloomberg.com/news/articles/2023-10-30/hackers-accessed-632-000-email-addresses-at-defense-doj?srnd=technology-vp" target="_blank">Hackers accessed 632,000 email addresses at Justice Department, Defense Department (Bloomberg News)</a>

<a href="https://www.bleepingcomputer.com/news/security/rce-exploit-for-wyze-cam-v3-publicly-released-patch-now/" target="_blank">RCE exploit for Wyze Cam v3 publicly released, patch now (Bleeping Computer)</a>

<a href="https://therecord.media/dallas-county-play-ransomware-incident" target="_blank">Dallas County confirms cybersecurity 'incident' after ransomware gang claims attack (The Record)</a>

<a href="https://www.cybersecuritydive.com/news/five-guys-hack-employees-emails/698185/" target="_blank">Five Guys discloses hack of 2 employees’ emails (Cybersecurity Dive)</a>

<a href="https://www.reuters.com/technology/tiktok-snapchat-others-sign-pledge-tackle-ai-generated-child-sex-abuse-images-2023-10-30/" target="_blank">TikTok, Snapchat and others sign pledge to tackle AI-generated child sex abuse images (Reuters)</a>

<a href="https://therecord.media/norwich-diocese-sex-abuse-case-data-privacy-settlement" target="_blank">Alleged sex abuse victims win settlement in data mishandling case (The Record)</a>

DHS Secretary Alejandro Mayorkas, FBI Director Christopher A. Wray and National Counterterrorism Center Director Christine Abizaid <a href="https://www.hsgac.senate.gov/hearings/threats-to-the-homeland-3/">testify to the Senate Homeland Security Committee</a> at 10 a.m.

CISA kicks off a two-day <a href="https://www.cisa.gov/news-events/events/2023-national-summit-k-12-school-safety-and-security">online summit</a> on national school safety and security beginning tomorrow at noon.

State election leaders <a href="https://www.rules.senate.gov/hearings/ongoing-threats-to-election-administration">testify to the Senate Rules Committee</a> about ongoing threats to election administration tomorrow at 3 p.m.

Thanks for reading. See you tomorrow.

2022 American Society of Business Publication Editors, Bronze National Award, Government Coverage

2022 American Society of Business Publication Editors, Silver Regional Award, Government Coverage

2022 American Society of Business Publication Editors, Bronze Regional Award, Single Topic Coverage by a Team

2022 Society of Professional Journalists Washington, D.C., Chapter, Finalist, Staff

2021 Best in Business Awards, Honorable Mention, Technology, Small Division (for editing role)

2009 National Press Club Sandy Hume Memorial Ward for Excellence in Political Journalism

2001 Indiana Associated Press Managing Editors, 1st Place, Non-Deadline News Reporting (with another reporter)

2001 Hoosier State Press Association, 3rd Place, Business Writing (team project)

University of Southern Indiana, BA in Print Journalism

Tim Starks is the author of the Cybersecurity 202 newsletter at The Washington Post. He previously served as senior editor at CyberScoop and ran Politico's cybersecurity newsletter. The Evansville, Ind., native also has held reporting roles for CQ Roll Call, the New York Sun and the Evansville Courier & Press.

Tim Starks

George Washington University, BBA in business analytics

Georgetown University, MS in business analytics

David DiMolfetta researches The Cybersecurity 202 and The Technology 202, the morning newsletters at The Washington Post keeping readers up to date on cybersecurity and technology policy.

David DiMolfetta

washpost

The Washington Post

FILE PHOTO: The seal of the U.S. Securities and Exchange Commission (SEC) is seen at their headquarters in Washington, D.C.

Reuters

name

prism://prism.query/site-and-tag,/politics/powerpost,cybersecurity202&limit=20

Your daily guide to cybersecurity news and policy, by reporter Joseph Marks.

The Cybersecurity 202

A newsletter briefing on cybersecurity news and policy.

https://newsletter-imgs.s3.amazonaws.com/prod/the-202s/primary/cybersecurity.svg

https://newsletter-imgs.s3.amazonaws.com/prod/the-202s/secondary/cybersecurity.svg

Your daily guide to cybersecurity news and policy, by reporter Tim Starks.

prism://prism.query/site,/us-policy/cybersecurity-policy&limit=20

Cybersecurity Policy

prism://prism.query/site,/politics/powerpost&limit=20

The 202s

The 202s - The Washington Post

PowerPost, by The Washington Post, delivers essential intelligence for D.C. decision-makers.

THE 202s

/politics/powerpost/the-cybersecurity-202

The Cybersecurity 202;Cybersecurity Policy;THE 202s