The publication is an ongoing effort to produce a unified security framework throughout the government. This fifth revision incorporates two new control families focused completely on privacy and integrates other privacy controls throughout the draft — a first for any control catalog. This integration clarifies the relationship of security and privacy, improving overall control selection, and allowing agencies to address security and privacy risks in their entirety.

In addition, the new revision addresses the needs of not only the federal government but also industry and other organizations who have volunteered to take on the control catalog to increase security measures.

For example, the separation of the control selection process from the control catalog and its integration in the NIST Risk Management Framework. This action allows organizations outside the federal government to easily use NIST controls with frameworks they use, like the Cybersecurity Framework.

This newfound diversity includes the needs of groups previously left out, such as system engineers working on privacy and security, component product developers, and other industry professionals concerned with security and privacy.

Other major changes in this draft include:

• A focus on creating outcome-based structures for privacy and security controls;
• The integration of risk management and cybersecurity approaches and language, and;
  
• The incorporation of new, state-of-practice controls derived from empirical attack data and threat intelligence information.
  

Anyone with system development responsibilities, security and privacy responsibilities, oversight and risk management responsibilities and other commercial entities are encouraged to provide feedback on the new draft before Sept. 12. The final draft is set to be released in Oct. and the final version to be published no later than the end of 2017.

To read the fifth revision in full, visit crsc.nist.gov.

Looking to change this narrative, Lindsey Graham and Amy Klobuchar banded together to create and propose an amendment that will address the non-partisan issue plaguing the United States: insecurity of election systems. The proposed amendment would amend H.R. 2810 and give states the option of applying for Election Technology Improvement Grants that can be used to modernize and improve their voting systems.

To receive a grant, states must meet specific requirements, including:

• The adherence to best practices in cybersecurity and cyber-hygiene;
• The development, submission and publication of plans for election system modernization and enhancements, and;
  
• Undergo Security Risk and Vulnerability Assessments conducted by the Department of Homeland Security. 
  

In addition, there may be other requirements established by the amendment and the collaborative, federal-state commission of stakeholders.

The current election systems are “predominately amalgamations of insecure and obsolete …  technology, poorly designed black-box proprietary code, and hastily constructed applications” that “lack native security applications commensurate with the modern threat landscape,” ICIT reports.

The implementation of the proposed amendment, according to ICIT, would allow for the modernization and reformation of America’s national election cyber-culture while enabling improved transparency, communication, information sharing and oversight.

Dec. 29, the Department of Homeland Security released evidence for the tool used in the Russian hacking against the Democratic National Committee. That evidence pointed towards a malware program that was advertised on the dark web utilized by cybercriminals.

Shortly afterwards, the author, a young Ukrainian man known as “Profexer,” turned himself in to the Ukrainian Cyber Police. He admitted he wrote the malware, but did not know his customer’s intended use for it. Due to the legal grey zone, he is not under arrest but has become a key witness for the FBI, the first known to emerge and vastly impact the investigation, according to New York Times.

From this revelation, a clearer picture of the Russian cybercriminal group “Fancy Bear” has been drawn. Rather than being the military intelligence agency writing codes and malware and carries out attacks during their work hours, the group appears to operate as a place for financing and organization. The more technical work appears to be a result of a “far looser enterprise that draws on talent and hacking tools wherever they can be found,” Times reports.

There is no evidence to suggest Profexer knowingly worked for the Russian intelligence services, only that the malware he created did.

The private contact information of 22 Republican Congress members was released on the internet. The information contained private cellphone numbers and email addressed for the Republican members of Congress, including Sens. Ben Sasse, R-Neb., Bob Corker, R-Tenn., and Charles Grassley, R-Iowa. Some of the information has been verified, but it remains unknown how it was obtained.

Rob Pfeiffer, chief editor of the online publication The Anon Journal, told the Washington Post that the move was spurred on by the violence in Charlottesville and the president’s response that “both sides” were at fault.

The reveal comes a day before “Denouncement Day,” the day that some Anonymous members are calling for people to gather at Confederate statues and tear them down.

The recent removal of Confederate memorials has garnered a tweet from President Trump, who declared his sorrow for seeing the Confederate symbols taken away, adding more fuel to the ever-growing fire.

“HHS’ HCCIC Takes a Quantum Leap Forward to Secure the Health Sector: A Fortunate Solution to the Rampant Risk of Minimalistic, Self-Governing Bureaucracy,” released by the Institute for Critical Infrastructure Technology (ICIT), examines why the health care sector is unable to oversee itself and why the Healthcare Cybersecurity and Communications Integration Center is essential to securing medical information.

The HCCIC would put an end to the “self-regulating, checkbox-driven security standards” that will allow healthcare organizations to “skirt liability,” the analysis declares, and allow for effective oversight and management of the health care sector’s security.

Poor security habits and cost-cutting measures have led to a multitude of damaging attacks, one of which being the February 2015 exposure of 78.8 million patients with Anthem, Inc.

This attack compromised the patients’ names, medical IDs, Social Security numbers, addresses, email, employment information, income data and more. A subsequent lawsuit against the insurance provider was settled, with Anthem agreeing to pay $115 million but refusing to admit any wrongdoing or responsibility for the harm.

This incident is not an exception, rather just one example, according to the report. The number of attacks on the health care sector have been climbing but, remarkably, the security has not followed suit.

The HCCIC would serve as a much needed supplement to the National Cybersecurity and Communication Integration Center, allowing businesses to get improved access to threat data, collaborating with programs like the Information Sharing and Analysis Organizations and the Information Sharing and Analysis Centers, and ensuring the private companies remain security conscious.

To read the analysis in its entirety, go here.

On Aug. 10, however, the satellite successfully transmitted a message that is protected through the exploitation of quantum physics. Any attempt to eavesdrop or disrupt the message would result in detectable changes, giving everyone the peace of mind that their message and information was not touched.

Ground-based encryption using the same methods, entangled photons, has been possible for a while. The distance of a secure message cannot surpass 200 kilometers due to the cables gradually weakening the message’s security, introducing weak points that attackers can exploit.

The use of laser signals sent through the atmosphere give more promise, able to travel much farther before weakening. Using satellites, the potential transmission rate is about 20 times more efficient than using fiber-optic cables, Pan Jianwei, lead scientist on the experiment conducted by the state-run Chinese Academy of Sciences, told Reuters.

Although challenges remain, China continues to work on quantum communication with the hopes of developing a large, ground-based network to protect messages.

Susan Gordon, the deputy director of NGA since her appointment in January 2015, will be leaving her position to become the principal deputy director of national intelligence. Her position as deputy director will be taken over by Justin Poole.

“The current GEOINT landscape is evolving at a rapid pace,” said NGA Director Robert Cardillo. “A deputy with Justin’s background, skill and drive is required for us to make the most of this opportunity.”

Before this appointment Poole was director of the NGA’s Source Operations and Management directorate, a position that held him responsible for the creation, collection, and brokering of authoritative geospatial intelligence services and content that supports the priorities of national security. Prior to that, Poole was the NGA director of Xperience, where he enhanced user experiences.

As the seventh deputy director of NGA, Poole will be responsible for aiding the director in leading the NGA and managing the National System of Geospatial Intelligence. He began his career in 1991 with the Defense Mapping Agency, a predecessor of the NGA.

The mobile radar uses C- or X-band active electronically scanned array antennas to track anything that flies close to the ground. In addition, the radar system is equipped for high-precision time, space, and position information data on objects that fly above it.

“Our iMOTR solution is inexpensive compared to the legacy multiple-object tracking radar systems currently in use on test ranges,” acting president of BAE’s Intelligence and Security division Mark Keeler said in a news release.

Keeler added that the technology delivers “the enhanced radar performance capabilities necessary to meet today’s test range requirements” while also reducing the operation and sustainment costs associated with enhanced radars.

“The successful design of iMOTR leveraged industry advances in performance, availability, and affordability for both hardware and software,” Keeler said in the release. “It will deliver a multiple-object tracking radar solution best matched to meet the ever-increasing demands of test and evaluation ranges worldwide.”

Currently, these searches are permitted under an exception to the Fourth Amendment for routine enforcement of immigration and customs. Under the exception, digital devices that are seized by United States Customs and Border Protection agents can only have the device’s local data searched, not the cloud storage, and this is regardless of where cloud storage servers are located.

The average digital device, however, will hold much more data than ever anticipated. From documents, videos, messages, and even photos to offline emails, up-coming appointments, and more.

The information gathered from a digital device is “light years beyond the minimal information generally contained in other kinds of personal items we might carry in our suitcases,” Sophia Cope, EFF staff attorney, told Tech Crunch. She continues declaring the examination of digital devices is “highly intrusive,” not to mention the fact that data stored in the cloud can easily seem to be a part of the device’s local storage.

In addition, the EFF has referred to the creation of the border search exception. The exception is to be used for the narrow purposes of enforcing customs and immigration laws. There are questions asking how the general search of digital devices could further the purposes of CBP in a way that can justify the neglect of suspicion or warrant needed.

According to the FTC, scammers have been posing as government officials to get consumers to send in money. These scammers will impersonate the National Institutes of Health, offering a NIH grant of $14,000. The grant, however can only be obtained, according to the reported scammers, through a payment via iTunes, Green Dot cards, or with your bank account information.

If you receive a call declaring you are eligible for a grant, do not divulge any of your personal or financial information — hang up. The federal government will never call demanding information.

For more information on the NIH grant scam, go here.

For tips to help you stay safe online, go here.