That’s right, it’s time for the annual CyberCon.

Join us on Tuesday, Nov. 28, for the annual gettogether of top federal and military officials and academic thinkers in cyber, from information security to offensive and defensive operations.

This year’s theme ― Beyond Cybersecurity ― reflects the latest thinking in cyber, moving past concentrating on securing data to a wider view of the landscape. To be sure, cybersecurity is an integral part of the puzzle. But to attain true security in cyberspace, the conversation must include all aspects of the cyberthreat and options for deterrence and response.

From its inception, CyberCon has been a venue to discuss the latest in cyber from a holistic standpoint, bringing together civilian and military, government and academia, U.S. and international partners. This year is no different, with an impressive lineup of speakers, including, among others:

• Sen. Sheldon Whitehouse, D-R.I.
  
• Rep. Elise Stefanik, R-N.Y.
  
• Dr. Brian Pierce, Director of DARPA’s Information Innovation Office
  
• Brig. Gen. Timothy Haugh, Director of Intelligence for U.S. Cyber Command
  
• Col. Todd Stratton, Director of AFCYBER Forward
  
• Deborah Pierre-Louis, Director of Policy, Liaison and Training Office at the State Department
  
• Trent Teyema, Cyber Readiness Section Chief in the FBI Cyber Division
  
• Jim Piche, Homeland Sector Director at GSA FEDSIM
  
• Kate Charlet, former acting Deputy Assistant Secretary of Defense for Cyber Policy
  
• Sean Kanuck, former National Intelligence Officer for Cyber Issues
  

Panel topics include taking the cyberwar to terrorists online, battling information warfare in cyberspace, the new critical infrastructure in need of defending and the latest training techniques for our cyber defenders and warriors.

The conference is a unique opportunity for attendees to have face-to-face interaction and dialogue with senior leadership across the branches of government and the military, including high-level policy setters and decision-makers.

Fifth Domain, Federal Times, C4ISRNET and Defense News are proud to present the third annual CyberCon at the Ritz-Carlton in Pentagon City on Nov. 28. We look forward to seeing you there, as well.

Register now to secure your seat.

While the program has a shiny new name — CDM DEFEND, which stands for Dynamic and Evolving Federal Enterprise Network Defense — program managers assert that this is more than just a rebranding.

“It’s an effort to replace the CDM BPAs that expire in August of 2018,” explained Kevin Cox, CDM program manager at DHS, during a discussion Oct. 30 at the annual American Council for Technology and Industry Advisory Council (ACT-IAC) Executive Leadership Conference in Williamsburg, Va. “It will follow the same model of how the agencies are grouped, then we will be competing different task orders for system integrators to partner with those agencies.”

The focus on partnerships is key, said Cox, as the new CDM model will be less about buying specific services and technologies and more about creating a strong cybersecurity posture that can evolve over time.

“We’re not looking for a specific technology; we’re not looking for a specific cyber solution,” said Jim Piche, homeland security director for FEDSIM. “We’re going to take the acquisition cycles out of it so that we can identify, acquire and deploy those cybersecurity tools at the speed they need to be deployed rather than getting into another procurement cycle.”

Using GSA’s Alliant contract vehicle — and, subsequently, Alliant 2 as that contract goes into effect — CIO offices will issue a task order with a system integrator that will help the agency develop cybersecurity goals and discover the right technical solutions to achieve those goals. Then, over the life of the task order — five to six years, according to Cox — that framework can be adjusted as new tools and solutions are developed, and those products can be acquired without having to issue a new task order or contract.

“This is not a BPA, it’s not an IDIQ,” Piche said. “It is a single-award task order to an integrator that is incrementally funded as a cost-type task order.”

That doesn’t mean the whole CDM system will be thrown out.

“What’s still the same is the inextricable relationship that Kevin and I have, the CDM program office and GSA … to bring the best innovation solutions to support the CDM program,” Piche said. “The other thing that hasn’t changed is the scope: every federal agency is a customer.”

Finally, Piche noted the program’s reliance on industry. The program currently works with more than 100 companies and that isn’t expected to change going forward.

“What we’re trying to get out of the CDM program is better cybersecurity,” Piche said. “You can also read that as ‘compliant cybersecurity’ or ‘more efficient cybersecurity.’ But we’re also trying to do it more affordably.”

To be both effective and affordable, the contract vehicle needs to be able to adapt to the ever-changing landscape of cybersecurity.

“We don’t know today what better cybersecurity is going to look like in 2019 or 2020 or as we get to the tail end of this project,” Piche said. Using this more flexible model will allow agencies to “redefine what is better cybersecurity in 2019 and 2020.”

The last piece of major federal legislation to get passed, FITARA, was also wrapped into NDAA. What do you think about using the defense authorization bill to take care of civilian IT issues?

I think it’s a vehicle to move legislation. And it’s going to be something that ultimately impacts the Department of Defense, as well, as well as security and being able to improve the defense of the .gov infrastructure. I think it’s within the same realm of making sure that we’re defending our digital infrastructure.

Are you expecting the IT modernization amendment to change at all in conference?

I take every step in the process separately. But the likelihood that there are any changes are low. Whenever you have agreement in the House and Senate on something, that is unlikely to be something that’s changed in the conference.

I feel good because the majority leader and the policies office and [Rep.] Steny Hoyer [D-Md.] have been instrumental in getting this legislation moving. The recent legislation in the Senate, with Sen. [Ron] Johnson [R-Wisc.], Sen. [Jerry] Moran [R-Kan.] and Sen. [Tom] Udall [D-N.M.] putting this all together, I think we’re not going to have any problems with the conference committee.

I’m looking forward to getting this to the president’s desk to sign and getting this new tool to the CIOs across government.

How the law actually rolls out will depend on the guidance issued by the Office of Management and Budget. What would you like to see in that guidance? What would you like OMB to know about your intent behind the legislation?

OMB and the Office of American Innovation have been instrumental in the process. We’ve been working with them from the very beginning on the intent and the capabilities. They’ve already put in a lot of time and significant effort thinking through how to use the MGT Act as a tool for CIOs to modernize and to upgrade to the latest technology.

My advice to OMB is, this is a tool designed for federal CIOs to modernize: give them the broader authorities and powers to utilize this tool.

The main funding mechanism requires agencies to reprogram funds. There is also a central working fund, but no dollar-figure attached in the MGT Act. How big should that central fund be and how should it be used?

I think what we had in the recent [budget] legislation – $250 million – is more than enough. I think the real focus of MGT was having every federal agency be a laboratory in how to do modernization.

Some are better prepared to take advantage of MGT than others. Those ones that aren’t as prepared, utilizing this centralized fund will be a vehicle to help jumpstart those modernization activities.

I was always fine with the $250 million number. I think the president’s budget was fine with that level of appropriation.

How do you think the bill turned out and what impact will it have on federal operations?

I’m excited to finally get this done. I feel good that we are now giving another tool for our federal CIOs to introduce the latest technology to defend their digital infrastructure and provide a more efficient service to the American people.

It’s a good day.

If MGT does make it through reconciliation, what’s the next big federal IT legislation you’d like to work on?

By the end of the next fiscal year, integrating the oversight of these working capital funds into the FITARA scorecard.

We call it the FITARA scorecard but it really is a digital hygiene scorecard. So, making sure to see whether agencies are utilizing these working capital funds or not. It’s another point we’ll be able to do oversight on. That’s step one.

Now, legislatively, the big initiative we’re going to move to now is the concept of a Cyber National Guard. It’s something that we’ve been talking about and researching on and I think we have an idea on a framework of how to get this done. Now it’s time that my staff and my team will be able to focus our attention on over the next few months.

Wrapped into the 2018 National Defense Authorization Act passed by the Senate Sept. 18 is a version of the House Modernizing Government Technology (MGT) Act, which requires federal agencies to upgrade their IT systems for efficiency and cost savings, as well as security.

The last major IT reform bill — the Federal IT Acquisition Reform Act (FITARA) — passed in 2014 as part of that year’s defense authorization, as well.

The MGT Act is the final version of a bill that has taken many forms, beginning with a call from then-President Obama to modernize the government’s technology using a $3.1 billion central fund. While the bill includes the fund, it does not include a dollar amount. Instead, the main funding mechanism in the bill is agencies own budgets, portions of which will be diverted toward working capital funds dedicated to modernization efforts.

“The amount of money that our federal government spends on antiquated technology is mindboggling,” Rep. Will Hurd, R-Texas, who sponsored the House version of the bill, said Monday. “Outdated technology policies and poor cybersecurity hygiene have riddled government agencies for decades, leaving our digital information vulnerable to hacks and costing taxpayers billions.”

The working capital funds will enable agencies to set aside funding for four priority goals:

The central Technology Modernization Fund will be administered by GSA Technology Transformation Service Commissioner Rob Cook, with additional oversight from a to-be-created Technology Modernization Board.

• Improve, retire or replace existing information technology systems to enhance cybersecurity and to improve efficiency and effectiveness;
• Transition legacy information technology systems to cloud computing and other innovative platforms and technologies;
  
• Assist and support efforts to provide adequate, risk-based and cost-effective information technology capabilities that address evolving threats to information security; and
  
• Reimburse amounts transferred to the agency from the Technology Modernization Fund (established under this bill), with the approval of such agency’s Chief Information Officer.
  

While the MGT Act is focused on civilian agencies, aging IT systems pose a serious risk to national security, making the amendment a surprisingly good fit for a defense bill.

“This major legislation to modernize the federal government’s grossly outdated IT systems will strengthen our national security and save taxpayers millions,” said Sen. Tom Udall, D-N.M., who co-sponsored the NDAA amendment along with Sen. Jerry Moran, R-Kan.

Udall pointed out that some 75 percent of the government’s $80 billion IT budget is spent maintaining legacy systems.

“With the MGT Act’s flexible funding options, we can break that cycle and bring the federal government into the modern era — tackling dangerous cyber vulnerabilities and protecting the American people from increasingly severe cyberattacks, and empowering agencies to move forward with long-overdue projects to streamline how the federal government operates,” he said.

This year’s NDAA also included a provision on open government, the Open, Public, Electronic and Necessary (OPEN) Government Data Act, which requires agencies to publish open data in machine-readable formats.

“By requiring all federal agencies to publish their information in open, machine-readable formats, this reform will bring about greater efficiency within government and unprecedented transparency outside government,” said Hudson Hollister, executive director of the Data Coalition.

The NDAA — with the MGT and OPEN amendments — now heads to conference to be reconciled with the House bill passed in July.

“This action is based on the information security risks presented by the use of Kaspersky products on federal information systems,” Duke said in a release announcing the BOD. “The department is concerned about the ties between certain Kaspersky officials and Russian intelligence agencies to request or compel assistance from Kaspersky and to intercept communications transiting Russian networks.”

Duke cited the anti-virus’ broad access to files and secure areas of federal networks on which the software is installed.

“The risk that the Russian government, whether acting on its own or in collaboration with Kaspersky, could capitalize on access provided by Kaspersky products to compromise federal information and information systems directly implicates U.S. national security,” she added.

The directive gives agencies 30 days to identify all instances of Kaspersky products on their networks; 60 days to work up plans to remove those products; and 90 days to implement those plans. That means agencies must be clear of Kaspersky by Dec. 12, “unless directed otherwise by DHS based on new information.”

“This is a risk-based decision we need to make,” White House Cybersecurity Coordinator Rob Joyce said Wednesday while speaking at the annual Billington Cybersecurity Summit. “For us the idea of a piece of software that’s going to live on our networks, going to touch every file on those networks, going to be able to at the discretion of the company decide what goes back to their cloud in Russia — and then what you really need to understand is under Russian law the company must collaborate with the FSB. So for us in the government that was an unacceptable risk.”

DHS said Kaspersky will be given a chance to offer a “written response addressing the department’s concerns or to mitigate those concerns,” an offer that is also extended to other companies that feel they will be adversely impacted by this directive.

“Given that Kaspersky Lab doesn’t have inappropriate ties with any government, the company is disappointed with the decision by the U.S. Department of Homeland Security, but also is grateful for the opportunity to provide additional information to the agency in order to confirm that these allegations are completely unfounded,” Kaspersky Lab told Fifth Domain in an email Wednesday.

The comment continued:

U.S. intelligence community officials have long been skeptical of Kaspersky products being used within the government and critical infrastructure, though few have spoken publicly about those concerns.

Richard Ledgett, who was most recently deputy director of NSA until his retirement at the end of April, spoke about the U.S. intelligence community’s concerns in a July podcast interview.

“The concern over Kaspersky is well founded and I think that there’s growing recognition — there has been for a while and more recently [within] Congress — that we probably don’t want that in really significant parts of the government or critical infrastructure networks,” he said.

Ledgett, like most current officials, noted there is much he cannot say on this topic.

Fifth Domain reporter Mark Pomerleau contributed to this report.

Chatting live with Gen. Gregory Touhill, the first federal CISO, on the state of federal cybersecurity and his new ventures with Cyxtera and Bay Dynamics.

But, as with every new thing, there is a learning curve. During the 2017 Black Hat conference in Las Vegas, bug bounty program managers with three major companies – Indeed, Salesforce and Silent Circle – offered some advice to organizations standing up a program for the first time.

Be Social

While the financial incentives are typically what define bug bounty programs, participants are rarely just in it for the money.

“It’s super important to go out into the community and find out what motivates them,” said Lori Rangel, director of product management for Silent Circle.

“One of the biggest challenges is understanding the value of a vulnerability,” she said. “My initial thought was that the dollar amount – the payout for a bounty – was the most important thing to the user community. [Now I’m] understanding the differences between a dollar value and reputation value.”

For many researchers in the bounty community, the prestige of finding a well-hidden flaw can be as important as the bounty itself, as reputation can lead to more opportunities in the future.

“Find out what their concerns are,” Rangel added. “That really builds your reputation, as well.”

Be Human

Charles Valentine, vice president of technology services for the jobs website Indeed, pointed out that these are individuals, not companies you’ll be dealing with.

“This is not a business you’re talking with; it’s an individual,” he said. “So having somebody in place who has really good customer service skills to be able to communicate with that external person and bring it to a human level. So, not acting like a corporation. The communication should not be filtered by a legal department; it should be a human-to-human communication.”

Another important note: “In many cases … English is probably not their first language,” so be prepared.

Be Mature

Finally, if your internal security team isn’t equipped to remediate the bugs as they are discovered, what’s the point?

“One of the key things you need to have is a very mature OpSec practice,” said Angelo Prado, senior product security manager for Salesforce. “You need to have a very mature set of individuals who are able to understand risk, impact and are able to fix any vulnerabilities that come your way. Because, without that, you’re doing yourself a disservice. If you don’t have strong application security engineers, your program is not going to be successful.”

Speaking at the annual Black Hat conference in Las Vegas, Tom Grasso, supervisory special agent with the FBI’s Cyber Division, continually reiterated the bureau’s interest in working with the private sector, particularly when working with complex threats like botnets.

“Our overall botnet strategy really starts with the private sector … I’m looking to my private sector partners to tell me where the threats are,” he told the roomful of hackers – both white and black hat. “You guys are down in the trenches, you’re fighting the fight every day, so I want you to tell me what those threats are.”

Grasso cited the bureau’s work taking down the GameOver ZeuS botnet, ultimately dismantled by the FBI in 2014.

That network was so complex, Grasso said he had all but given up on defeating it. That resignation lasted two years, until an industry partner came to the FBI with a method of attack.

“He basically laid out the plan for us and then we put that plan into action with court orders and legal processes,” he said. “For those of you who have really good ideas on how to do things … and you maybe want to go and take the threat down yourself but you think, ‘I don’t know, it might not be quite legal,’ … we can make it legal for you to do that.”

Though lawmakers have proposed legislation that would legalize some level of “hacking back” – going after the attackers directly – those have yet to be enacted and top federal and law enforcement officials continually warn against private citizens taking vigilante action.

However, by teaming up with the FBI, individuals can do just that within the proper legal frameworks.

“We can take your good ideas and we can put them into action,” Grasso said.

“I’m not going to tell you [the FBI] is the savior of the internet,” Grasso said during a briefing at the 2017 Black Hat convention in Las Vegas. “We’re not. You all are – we all are, actually, is what it comes down to.”

Grasso explained the bureau’s three-pronged approach to defeating botnets, which include neutralizing the threat actors, disabling the underlying infrastructure through active operations and mitigating the effects of malicious activity by sharing indicators of compromise across relevant sectors.

“We do more than just arrest the bad guys,” Grasso said. “The tools we have in law enforcement for identifying criminals and taking them out of action – that’s important – but there’s other things that we can do, as well.”

Neutralize

The more traditional law enforcement approach: Identify the bad guy and take them down.

“Find the people that are operating these things, take them off the playing field so they can’t continue to do the damage that they do,” Grasso said.

Mitigation

In every instance, the FBI wants to limit the amount of damage these actors and perpetrate. Most of those mitigation efforts center on sharing information with industry and relevant sectors.

“We can share intelligence with the private sector, and maybe the private sector can do mitigation and develop a technical solution,” he said.

If researchers in the private sector – whether in industry or independent – discover patches or technical solutions that make the attack vectors moot, “They’ve effectively defeated it and it’s not necessary for us to come in and do our thing from the law enforcement side.”

Technical Operation

“The last thing we can do, is kind of the sexy thing that everyone likes to talk about, which is a botnet takedown,” Grasso said. “Sometimes we can, by working with our private sector partners, do some kind of technical operation, some type of intervention where we go and take this threat away from the criminals and direct it somewhere safe, and then work on mitigation.”

The key to all of this, Grasso explained, is cooperation with the private sector.

AlphaBay, formerly the internet’s largest darknet site, had already gone offline July 5 with the arrest in Thailand of its alleged creator and administrator. But on Thursday, European law enforcement revealed that Dutch cyberpolice had for a month been running Hansa Market. Like AlphaBay, Hansa operated in the darknet, an anonymity-friendly internet netherworld inaccessible to standard browsers.

AlphaBay’s users had flocked to Hansa, which is largely based in the Netherlands. The announcements Thursday on both sides of the Atlantic sowed panic among the sites’ tech-savvy buyers and vendors.

Darkness over the Darknet

“The cryptomarket community (is) spooked,” said darknet researcher Patrick Shortis, of Brunel University in London. “Reddit boards are filled with users asking questions about their orders.”

In Washington, U.S. Attorney General Jeff Sessions deemed the operation “the largest darknet marketplace takedown in history.”

Darknet vendors are “pouring fuel on the fire of the national drug epidemic,” he said, specifically citing cases of two U.S. teenagers killed this year, one a 13-year-old Utah boy, by overdoses of synthetic opioids purchased on AlphaBay.

More than two-thirds of the quarter million listings on the two sites were for illegal drugs, said Sessions. Other illicit wares for sale included weapons, counterfeit and stolen identification and malware.

The police agency Europol estimates AlphaBay did $1 billion in business after its 2014 creation.

Dead in Prison

A California indictment named AlphaBay’s founder as Alexandre Cazes, a 25-year-old Canadian who died in Thai police custody on July 12. The country’s narcotics police chief told reporters Cazes hanged himself in jail just prior to a scheduled court hearing. He’d been arrested with DEA and FBI assistance.

Cazes amassed a $23 million fortune, much of it in digital currencies, according to court documents. He bought real estate and luxury cars, including a $900,000 Lamborghini, and pursued “economic citizenship” in Liechtenstein, Cyprus and Thailand. A $400,000 villa purchase in February had already bought him and his wife Antiguan passports, a U.S. forfeiture complaint said.

He used what he claimed was a web design company, EBX Technologies, as a front, the indictment said.

Just two other arrests were announced Thursday. Both were of Hansa system administrators in the German town of Siegen, who were taken into custody in June. Europol spokeswoman Claire Georges said they were not named under privacy law.

The U.S. indictment lists several AlphaBay co-conspirators by title but not name. They include a security chief, a public relations manager and moderators. A U.S. attorney handling the case, Grant Rabenn, would not comment on whether additional arrests were expected.

“Psychological Warfare”

Nicolas Christin, a darknet expert at Carnegie Mellon University, called the one-two takedown punch “psychological warfare.”

“It is definitely going to create a bit of chaos,” he said, though after takedowns in the past buyers and sellers move to other former second-tier sites after a few weeks of turmoil.

But this time, Dutch police have upped the ante by craftily tracking darknet users, and that’s expected to yield future arrests.

They began running the Hansa site on June 20, impersonating its administrators, collecting usernames and passwords, logging data on thousands of drug sales and informing local police in nations where shipments would be arriving. Dutch cybercrime prosecutor Martijn Egberts said Dutch police had scooped up some 10,000 addresses for Hansa buyers outside Holland.

Running the site was a challenge, Egberts said, with police forced to mediate frequent disputes between buyers and sellers. “It turned out to be a lot of work!” he said. “The biggest effort for us was to get the site going on a way that nobody noticed it was us.”

Egberts noted with satisfaction that online rumors about other darknet drug marketplaces possibly being compromised were already spreading.

“This is the moment to show the world that you can’t trust dark markets anymore, because you never know who is the admin,” he said.

But seasoned buyers and sellers aren’t likely to get tripped up, and will simply become more cautious, Christin said.

Branches off the Silk Road

Darknet websites have thrived since the 2011 appearance of the Silk Road bazaar, which was taken down two years later. Merchants and buyers keep their identities secret by using encrypted communications and anonymity-providing tools such as the Tor browser. The darknet itself is only accessible only through such specialized apps.

Cazes’ own carelessness apparently tripped him up — not the underlying security technology AlphaBay used.

According to the indictment, he accidentally broadcast his personal Hotmail address in welcome messages sent to new users. And when he was tracked down and arrested in Thailand, Cazes was logged into the AlphaBay website as its administrator, it says.

Cazes also used the same personal email address — “pimp_alex-91@hotmail.com — on a PayPal account.

The success of this operation may only cause a temporary disturbance in illicit online markets. After a November 2014 takedown called Operation Onymous took down more sites, the illicit markets not only recovered — but grew.

For perspective, Christin said, a slow day for AlphaBay alone — one amounting to roughly $600,000 in transactions — would have been equivalent to a typical late-2014 day for the entire darknet.

Satter reported from Paris. AP Technology Writer Anick Jesdanun in New York and AP reporter Kaweewit Kaewjinda in Bangkok contributed to this report.