Who can you trust to counter the growing threat of AI-generated election deepfakes?
That was just one of the questions addressed last week during a roundtable discussion at the inaugural Billington State and Local Cybersecurity Summit, held March 19-20 at the National Press Club in Washington, D.C. The event was attended by national experts from local, state, and federal government agencies, private businesses, nonprofit organizations, and more.
Topics on the agenda included:
- Behind-the-scenes details of ransomware attacks on governments
- Various aspects of election security — including threats from foreign nation-states
- National Guard Role in State and Local Cybersecurity
- Advances in AI — both for the better and for the worse
- Resources available from federal agencies to state/local governments – including the latest information on cyber grants
- The impact of White House cybersecurity policy on state and local residents
- Regional approach to cybersecurity cooperation
- Fireside chat (no actual fires) discussing priorities and future plans for state and local CISOs.
I was able to attend the entire event and moderate two sessions, one on elections and one on ransomware. I felt this event was different from other recent cybersecurity events. That's because there was a lot of discussion in the press that wasn't shared publicly, and the involvement of the federal government, including several three-letter agencies (think NSA, CIA, FBI, and DHS).
My favorite session was one titled “China in the Digital Backyard” with TJ Sayers, Director of Intelligence and Incident Response at the Center for Internet Security. Dave Frederick, Assistant Director for China Affairs, National Security Agency; Andrew Scott is associate director of China operations at the Cybersecurity and Infrastructure Security Agency. The session was moderated by Katherine Gronberg, Head of Government Services at NightDragon.
What struck me frankly in that session was the level of concern in the intelligence community about current attacks from China.
“Over the past six months, our incident response efforts have confirmed that cyber attackers from the People's Republic of China have been present on our critical infrastructure networks, in some cases for the past five years,” Scott said. said.
“They have the necessary access and, if ordered, could immediately suspend services in parts of this country,” he added.
In this regard, on March 18, the Biden Administration and the Environmental Protection Agency sent a letter to all governors outlining cyber threats to water systems across the United States. The letter begins:
“Water and wastewater systems across the United States are being battered by neutralizing cyberattacks. We would like to explain the nature of these threats and request your partnership in critical actions to protect water systems from the growing risk and impact of these attacks. I am writing this letter.”
Article from The Verge Learn more about cyber threats to water systems.
“Hackers believed to be affiliated with the Iranian government launched an attack in November against a U.S. water facility that had not changed the default manufacturing password for common operating technology it uses.” The White House. National Security Advisor Anne Neuberger said the incident calls for increased security around public facilities, and the U.S. Treasury Department in February sanctioned six Iranian military personnel responsible for the attack. He said that
“The letter also cited threats from Bolt Typhoon, a Chinese government-backed group that was revealed in February to have leaked information about U.S. drinking water systems.”
More than 30 cyber leaders spoke at this week's cybersecurity event, including the following state and local cybersecurity leaders:
- Vitaliy Panych, CISO, California
- Nancy Rainosek, Chief Information Security Officer, Texas Department of Information Resources
- Colin Ahern, New York State Chief Cyber Officer
- Katie Savage, Maryland Department of IT Secretary
- William Zielinksi, CIO, Dallas
- Brian Gardner, CISO, Dallas
- Nishant Shah, Senior Advisor, Responsible AI, Maryland
- Josiah Raiche, Director of Artificial Intelligence, Vermont
- Michael Geraghty, NJCCIC (New Jersey) Director and New Jersey CISO
- Michael Gregg, CISO, North Dakota
- Netta Squires, Director of Local Cybersecurity, Maryland State Security Administration
- Bruce Coffing, CISO, Chicago
- Ryan Murray, CISO, Arizona
- Ralph Johnson, CISO, Washington
A number of cybersecurity leaders were also in attendance on the federal side, including Department of Education CISO Stephen Hernandez, co-chair of the Federal CISO Council, and Drennan Dudley, acting director of the National Cyber Directorate for Strategic and Budgetary Affairs in the Department of State. Cyber director.
The full agenda is available on the event website, but many sessions were held in a format that cannot be shared on this blog due to confidentiality.
Still, public sessions will be posted online in the coming weeks, so we encourage you to watch as many sessions as possible. (If you can only choose one, check out Tuesday's final session on Chinese cyber threats.)
