The new product line from CISA, a component of the Department of Homeland Security that regularly releases cybersecurity best practices for various sectors, will focus on secure practices when adopting or expanding an organization’s telework environment.

“As many businesses and organizations have rapidly shifted to a maximum telework environment, CISA is providing a one-stop shop of cybersecurity and resources to protect networks in this new landscape,” said CISA Director Christopher Krebs, whose agency is tasked with securing critical infrastructure and federal networks.

Much of the guidance focuses on secure videoconferencing — a challenge organizations have faced after Zoom, a popular videoconferencing platform, was found to have several security flaws. For federal agencies, CISA urges the use of Zoom for Government, a platform approved for use in the government that’s different than Zoom’s commercial offering.

CISA’s product for critical infrastructure operators using videoconferencing sites includes information on tactics that malicious actors may use to disrupt business. It also recommends security practices to adpot.

The guidance from CISA comes a week after the National Security Agency released guidance for federal agencies on securing collaboration tools while teleworking. The NSA guidance, released April 24, emphasized that agencies check a collaboration platform’s encryption capabilities and privacy policies before using the service. CISA’s new guidance also stresses the importance of end users only using agency-approved tools.

To ensure the cybersecurity of these agencies during telework, some in industry say that agencies need to ensure mobile devices are accounted for in their cybersecurity policies.

“Agencies should align desktop and mobile policies, and any new endpoint should have security and management that aligns with existing policies,” said Tim LeMaster, director of systems engineering at mobile security firm Lookout. “There has been significant investment in securing traditional endpoints like laptops, but the mass migration of government workers to teleworking means there will be a larger attack surface created by the use of mobile devices. This means agencies should expand their endpoint security to include mobile devices, including the use of mobile threat defense to bring mobile endpoint security on par with laptop security.”

In a statement, Krebs said his agency will continue to provide telework guidance as the pandemic situation evolves.

“We are working with our federal and private sector partners to understand the threat landscape and provide a central point of the latest and most up-to-date information for organizations to keep their networks and employees safe,” he said.

The FBI has received thousands of complaints regarding scams and frauds related to the virus, FBI Assistant Director Matt Gorham said Tuesday in a statement responding to queries from The Associated Press.

“Unfortunately, there’s a lot of precedent for criminals taking advantage of natural disasters and government relief packages to conduct fraud, including through cyber means,” Gorham said.

The FBI’s Internet Crime Complaint Center has received more than 3,600 complaints regarding coronavirus scams, he said.

This uptick gives the FBI an additional set of investigations to tackle at a time when its agents are already busy trying to combat economic espionage and ward off election interference.

The Justice Department has made it a priority to go after a broad variety of crimes related to the coronavirus outbreak, including cybercrimes.

“From the start of this pandemic we’ve been able to quickly take new information gleaned from our investigations, consider other sources of intelligence, and share information which potential targets of this malicious activity can act on — including hospitals and research institutes,” Gorham said.

In a separate interview last week, Gorham told the AP that committing cybercrime is easier than ever thanks to readily accessible tools for hackers.

“Today you can go into a dark web and purchase exploits with little to no understanding of how they actually work,” Gorham said, referring to hidden areas of the Internet that offer software tools that take advantage of vulnerabilities and can facilitate hacking.

“The threshold of entry has lowered to the point where almost anyone can become involved in a hack,” he added.

Even so, it remains a challenge for the FBI to assign blame for particular hacks. “Attribution,” Gorham said, “is always the most difficult part.”

Aside from the coronavirus, the number of cyberthreats remains concerning, Gorham said, particularly those involving the online theft of intellectual property, a crime that “goes to the core of our economy.”

The Justice Department has brought prosecutions in recent years against Chinese government hackers accused of breaking into the networks of American companies, and announced charges stemming from a series of cyberattacks by a North Korean hacking team, including one on Sony Pictures Entertainment.

The FBI and other federal agencies remain on high alert heading into the presidential election about cyberattacks targeting campaigns and election infrastructure.

Russian hackers in 2016 stole emails belonging to Democrat Hillary Clinton’s campaign that were then published by WikiLeaks in what intelligence officials have said was an effort to help Republican Donald Trump.

Cassidy reported from Atlanta.

Now, as millions of Americans work from home, the Navy has expanded its network to 250,000 users and plans to increase that amount to 500,000 in two to three weeks.

The Navy’s change is part of a broader movement at the Pentagon as the Department of Defense has rolled out over 900,000 user accounts for a new remote work environment in April. That includes creating as many as 250,000 accounts in one day last week.

IT projects that once took years, may now take just days or weeks, officials said.

The effort is funded in part by $300 million from the most recent coronavirus relief package signed by President Donald Trump. For the Department of Defense and the military services, the pandemic has meant rapidly increasing network capacity, improving cybersecurity and expanding IT programs to ensure missions across the globe can continue uninterrupted.

“The speed and magnitude of what the department has implemented in such a short amount of time is truly extraordinary,” Dana Deasy, the Pentagon’s top IT official, said April 13 during a press conference.

Service networks

With more that 4 million military and civilian employees teleworking across the globe, preparing the DoD enterprise for telework was a massive undertaking, said Lt. Gen. Bradford Shwedo, the chief information officer for the Joint Chiefs of Staff.

Each of the services worked closely with the Defense Department CIO’s office to prepare for a telework increase for its employees and servicemen.

In March, the CIO’s office released do’s and don’ts of telework, as did Navy Personnel Command. Cmdr. Dave Benham, spokesperson for Fleet Cyber Command, said the Navy is improving capacity to ease the stress on networks and service help desks.

“The highest levels of the Navy’s operational leadership are being updated daily on network and Service Desk performance and efforts to improve telecommuter user effectiveness,” Benham said in a statement March 31. “We have gained many important insights during the past two weeks of large-scale telework, and we are moving rapidly to increase capacity, while maintaining network security.”

In additional, the Air Force successfully deployed additional telework capacity, capability and bandwidth to support telework, according to Air Force spokesperson Lt. Col. Bryan Lewis.

Lewis told C4ISRNET that the Air Force implemented its large-scale End User Remote Access Management, or EURAM, virtual private network connections, which he described as a “monumental accomplishment.” Shwedo said that before the pandemic, the Air Force’s VPN could accommodate 10,000 users. But Lewis said EURAM — the modern VPN replacement — can scale to 400,000 concurrent connections.

Deasy also said the Air Force upgraded 12 key infrastructure sites, which increased its bandwidth by more than 130 percent.

Shwedo noted that the capacity upgrades the services are undertaking typically take one to two years from planning to completion, but under the coronavirus pandemic, that timetable is now “days to weeks.”

The Army also significantly increased its telework capabilities. According to Shwedo, the service has roughly 800,000 telework employees on DoD networks, and “the overall demands there are [increasing] daily.”

Improvements by the Army led to a 400 percent increase in network access for data and voice capacity, Deasy said. Army Lt. Gen. Bruce Crawford, the Army CIO/G-6, told C4ISRNET in a statement that the service rolled out collaboration tools and improved internet connection, along with teleconferencing capacity.

With more users traversing the network, however, cybersecurity risks increase, which service officials said they take seriously. “We have disseminated clear guidance that the same discipline, awareness, and security measures required for on-site work must be observed by our personnel when working remotely, and additionally, have provided information and guidance on new emerging threats,” Crawford said in a statement.

DoD networks

Inside the Pentagon, network capacity needed to expand significantly as the majority of the department’s employees work from home. This has led to a surge in the need for remote networks, accounts and “unprecedented” demand for devices for remote use, Deasy said.

To pay for it, the Coronavirus Aid, Relief and Economic Security Act provided the department with an additional $300 million to procure information technology.

“We are truly in unprecedented times in our nation,” Deasy said during a press briefing. “The national emergency due to the coronavirus COVID-19 global pandemic has no doubt brought new changes to the ways Americans go about their daily jobs. Specifically, the way we work has changed dramatically within the last month.”

To maintain insight over the new risks and needs associated with telework, Deasy established the COVID-19 telework readiness task force. According to Deasy, the task force members include U.S. Cyber Command, Joint Force Headquarters DoD-Information Network, the National Security Agency, the Defense Information Systems Agency, the Joint Chiefs of Staff, military staff and representatives from the DoD CIO’s office.

The team is meeting daily for two hours “to review and address various technical issues and requests as they arise,” Deasy said. Officials discuss seven topics: equipment needs; network capacity; IT personnel and contracting readiness; supply chain; cybersecurity/intelligence; financial requirements; and high-interest items.

“Our networks have seen significant increase[s] in traffic as well,” Deasy said. “The task force has successfully navigated this increase in demand, and we are rolling out equipment and increasing network capacity where needed.”

Within the walls of the Pentagon, the department’s IT officials have handed out additional devices to 2,000 personnel, Deasy said. In the early days of telework for the DoD workforce, the Pentagon also had to establish who needed remote email access, remote access to file sharing and email, and remote access to a full office experience, Essye Miller, deputy principal in the DoD CIO’s office, said in late March.

The Defense Information Systems Agency, tasked with providing connectivity and securing DoD networks, has increased the DoD’s internet service provider connections by 30 percent, Deasy said. He added that the DoD’s telecommunications provider has doubled the Pentagon’s call volume capacity.

In the press conference, Deasy also said the department has seen a tenfold increase in global video services, Outlook web access and enterprise audio conferencing.

“This is the largest rollout ever implemented in this short amount of time,” Deasy told reporters.

One of the department’s biggest accomplishments so far is the rollout of the Commercial Virtual Remote environment, an enterprisewide Microsoft Office environment remotely accessible. As of April 13, the platform had 900,000 accounts and 78,000 active logins, Deasy said. He touted that 250,000 new accounts were added in a single day last week.

One question that remains is why the DoD, which prides itself on being prepared for worst-case scenarios, had networks that weren’t already built to handle such a spike in traffic.

“Despite the fact that many DoD organizations have adopted telework in recent years and even built it into their contingency plans for things like pandemics, it has never been utilized at the scale it is being now with the majority of employees working remotely,” said David Mihelcic, former chief technology officer of DISA.

Current security measures in place like virtual private networks for the DoD’s teleworking employees just weren’t built for a situation like this, he said.

“Simply, they were not sized for the number of simultaneous users,” Mihelcic said.

In an April 8 alert, DHS’ Cybersecurity and Infrastructure Security Agency and the U.K.’s National Cyber Security Centre said that an increasing amount cybercriminals and advanced persistent threat actors were sending malicious emails pretending to be from trusted institutions to exploit fears caused by COVID-19.

The emails sent have been masked as updates from the World Health Organization, or used “Dr.” as a title to demonstrate authenticity. One specific phishing campaign pretended to be from the director general of the WHO. Other campaigns offered thermometers and face masks to protect against COVID-19.

“As the COVID-19 outbreak continues to evolve, bad actors are using these difficult times to exploit and take advantage of the public and business. Our partnerships with the NCSC and industry have played a critical role in our ability to track these threats and respond,” Bryan Ware, CISA’s assistant director for cybersecurity, said in a statement. “We urge everyone to remain vigilant to these threats, be on the lookout for suspicious emails and look to trusted sources for information and updates regarding COVID-19. We are all in this together and collectively we can help defend against these threats.”

In other examples, phishing attempts pretend to be from an employee’s human resources department.

Links in phishing emails have led to malicious websites that distribute ransomware. These emails have coronavirus in their subject line:

• 2020 Coronavirus Updates
• Coronavirus Updates
• 2019-nCov: New confirmed cases in your City
• 2019-nCov: Coronavirus outbreak in your city (Emergency)

Others have included malicious email attachments that have coronavirus in their file names.

“Malicious cyber actors rely on basic social engineering methods to entice a user to carry out a specific action,” the alert read. “These actors are taking advantage of human traits such as curiosity and concern around the coronavirus pandemic.”

The two agencies warned that actors will continue to exploit coronavirus fears for the “coming weeks and months.” In a news release, CISA also noted that it hasn’t seen an increase in the overall amount of cyber crime.

CISA and NCSC also warned that hackers were targeting known vulnerabilities in virtual private networks used for telework — a problematic situation given that millions of people working from home because of the pandemic.

“With the sudden, unexpected, and unplanned conversion to remote work, the vulnerabilities that have been created will persist far beyond the end of the pandemic event,” Michael Hamilton, former chief information security officer for the city of Seattle and now co-founder and chief security officer of CI Security, said in a statement. “Threat actors have been handed a gift, and systems that support critical services are now in the sights for extortion … think water purification, waste treatment, and emergency management. Organizations across public and private sectors need to have a deeper understanding of what this new attack surface has brought and where threats are likely to land.”

On March 18, CISA released a coronavirus risk-management document that outlined several ways in which organizations could improve their cybersecurity posture, including patching VPNs, implementing multifactor authentication and updating incident response plans.

Now, as scientists at the Defense Advanced Research Projects Agency are halfway through their projected timeline, a pandemic has swept across the globe, with the most reported cases of COVID-19 coming from the United States.

In response, the military organization that typically focuses on projects to address future threats at least five to 10 years off finds itself sprinting to develop diagnostic tools and treatment for the new coronavirus pandemic, and using technology it’s invested in over the last decade.

For example, in the next two weeks, one DARPA program hopes to have developed a test that can detect if a patient is infected with coronavirus and can observe changes in human cells to identify if a patient is infected.

“You live your life thinking this could happen, but when it does happen it’s a bit surreal,” said Amy Jenkins, a program manager in DARPA’s Biological Technologies Office. “Most of us, we haven’t had a chance to really breathe and really think about what’s happening right now because we’ve been trying to prepare for this. But it’s all a bit surreal that it’s actually happening now.”

The early days

COVID-19, the disease caused by coronavirus, came to DARPA’s attention when the epicenter was limited to Wuhan, China.

“This outbreak was very much on our radar in December when we were just getting initial reports from China that there was a novel pneumonia unrelated to influenza occurring,” Jenkins said in an interview with C4ISRNET. “We made the decision as a program to start investigating this once we had the first U.S. case.”

That initial U.S. case was confirmed Jan. 21, but the first sample arrived at DARPA’s partner labs during the first week of March.

In the meantime, however, Jenkins’ office worked with DARPA’s partner labs so scientists could begin testing when the first sample arrived. They also researched the virus’ genetic sequence and how it related to SARS, another respiratory disease caused by a coronavirus that killed about 800 people from 2002-2004. DARPA’s partner labs are AbCellera Biologics, AstraZeneca, Vanderbilt and Duke.

“It wasn’t a necessary pause,” Jenkins said. “If we had had samples the last week of January, we could’ve started immediately.”

Jenkins, along with Brad Ringeisen, office director of DARPA’s Biological Technologies Office, said the biggest challenge the agency has encountered is access to samples.

“It’s frustrating to know that we have the tools and the technology,” Ringeisen said. “But those tools and technology do us no good until we get the samples.”

He added that the office has worked with the National Institutes of Health, the Department of Health and Human Services, the Defense Department, and several other entities to get the samples it needs for rapid research.

Past investment, present payoffs

Since the early 2010s, DARPA has invested in a new type of vaccine technology — nucleic acid vaccines — which use the human body as its “bioreactor” to create the antibodies needed for immunity. DARPA funded this type of vaccine because traditional vaccine manufacturing is cumbersome, Jenkins said, and can take up to 18 months.

DARPA’s efforts on new mRNA vaccines have perhaps led to the best chance of effective immunization against COVID-19. This is in part thanks to a $25 million grant it awarded in 2013 to biotech company Moderna to manufacture mRNA vaccines to protect against a “wide range of known and unknown emerging infectious diseases and engineered biological threats.”

Now, a Moderna mRNA vaccine for COVID-19 is undergoing a clinical trial with the NIH. DARPA leaders are confident it will be deemed safe “because of some of our past investments that we’ve done on similar products for different diseases,” Ringeisen said.

Because there’s no RNA immunization for COVID-19 approved by the Food and Drug Administration, Jenkins said that DARPA has also realigned its efforts to work on traditional vaccine manufacturing.

“It’s not the role DARPA has been investing in, but it is the most applicable to this outbreak,” Jenkins said.

In 2018, DARPA signed the first contracts for the Pandemic Prevention Platform (P3) program, a project that aims to create a “medical countermeasure” for a pandemic disease within 60 days of that pathogen’s identification using the mRNA vaccine technology.

The platform relies on ongoing research into rapid antibody-discovery technology that must be linked with tech able to quickly manufacture those antibodies. The rapid antibody-discovery technologies are “hardened off,” Jenkins said, meaning that their focus is now on manufacturing the antibodies, a process that can be done in the human body, as described earlier.

“Given this outbreak, what we are doing now is actually utilizing those rapid discovery platforms to find … antibodies that target the SARS-2 coronavirus,” Jenkins said.

The P3 program is expected to be completed in 2022 or 2023, Jenkins said.

DARPA’s coronavirus effort also includes creating a rapid detection and diagnostic platform through its Epigenetic CHaracterization and Observation, or ECHO program. According to Ringeisen, DARPA hypothesized years ago that infectious diseases left “epigenetic marks” on human cells, or chemical changes in cells that indicate exposure to toxins, much like epigenetic marks left in smokers. In this test, medical professionals wouldn’t be looking for the virus, but rather for the marks indicating the host’s response to the virus.

“These marks are most likely being made almost immediately after the body is exposed to the virus,” Ringeisen said. In addition, they could show up well before the virus would be evident in a nasal swab.

In this case, blood would be drawn and then scientists could look for the marks. DARPA was able to focus the ECHO program to respond to the new coronavirus, Ringeisen said.

Ringeisen told C4ISRNET that he thought that test could be a “powerful tool,” especially as “we talk about going back to the workforce and who might be more vulnerable or less vulnerable to being exposed to the disease.” He hopes this program will produce the epigenetic signature in the next 10-12 days.

Ringeisen said DARPA is targeting August 2020 as its goal for getting the FDA’s approval of that test. The test would be an important service in case there’s a second wave of the virus in the fall this year.

Another diagnostic test, called Detect It with Gene Editing Technologies, which used computers and algorithms to identify genetic codes, was able to uncover specific genetic codes associated with the new coronavirus. An FDA-approved version of that test could also improve testing for the virus. Ringeisen said that DARPA was able to fast-track that project as well, and the agency is aiming for FDA approval in August.

The investments in these programs over the last decades has accelerated DARPA’s near-term work on the current pandemic.

“By having these projects already going, it’s very, very easy for us to sort of plug in pathogen ‘X’ into these projects,” Ringeisen said.

But to do more research, scientists across the United States are urging people who have recovered from the virus to donate blood so more samples become available.

“As a U.S. government, we have a dearth of samples,” Jenkins said. “We do not have all of the samples we need, but it is not as extreme as a bottleneck at this point.”

Update: This story has been updated with clarification from a DARPA spokesperson that the first test samples arrived at DARPA’s P3 partner labs, not directly to DARPA. The spokesperson also clarified that DARPA’s partner labs prepared their labs for the arrival of the samples, not DARPA, which doesn’t have labs.

The guidance comes as federal networks are strained and employees in headquarters reduced as the federal government makes adjustments to ensure its workforce remains safe from exposure to COVID-19.

The guidance works to address the potential that agencies will be unable to issue new personal identity verification (PIV) cards in case of an extended telework period. In the FAQ section of the memo, OMB encouraged agencies to work with it and the General Services Administration to “resolve any issues” with issuing PIV cards.

“If agencies are unable to issue a PIV credential, they should be prepared to issue an alternate credential/authenticator for physical and logical access,” Deputy Director for Management Margaret Weichert wrote in the guidance.

The guidance from OMB was praised by Sean Frazier, federal advisory chief information security officer at Cisco’s Duo Security, a multi-authentication platform.

“Users who are being asked to work from home — some of whom never have — will need the same level of security as if they were working in the office,” Frazier said in a statement. “This means consistent, easy to use security across all applications, across all access methods. If agencies use smart cards (PIV/CAC) with inherent multi-factor authentication on government work systems, they need to be sure federal workers and contractors have comparative controls when they work from home.”

The increase in telework provides great risk for federal networks outside of the authentication. Experts told Fifth Domain that users are more susceptible to spear-phishing attacks and that the difficulty of pushing security patches increases. Experts also warned about people performing official business on personal devices.

“Agency technology leaders also need to anticipate their workforce may be using their own devices and technology,” Frazier said. “If a user is moved to remote status and these basic protections don’t exist, a threat vector will be created.”

“Given the increased telework demand, we’ve seen a tremendous increase on the network. Unprecedented demand just over the last weekend or so,” Essye Miller, said.

She explained that, as a result of the increased demand on the network, they are asking that streaming services such as Pandora be limited if they are not mission essential. She also noted that access to YouTube will be blocked, effective tonight.

Lisa Hershman, the Pentagon’s chief management officer, said that the department is stress-testing telework opportunities. Given that, Miller noted a 240 percent increase in the help-desk requests.

Officials also explained that increased telework provides a larger cyberattack surface for adversaries to exploit, though, officials noted, Secret and Top Secret information is not available in a telework environment.

“They’re already taking advantage of the situation and the environment that we have on hand. With that, we’re developing best practices for you to use as you move from working in the office into a telework environment,” Miller said, without offering any additional information. “If you walk away from nothing else, it’s please, please, please, the same practices that you use in an office environment need to convey to wherever you’re teleworking from … We are creating a do’s and don’ts for healthy, clean hygiene on the network that we will make sure we give to WHS to distribute.”

The Washington Headquarters Service issued guidance for employees on cyber hygiene and best practices.

“[S]ome of the inherent security measures that we take for granted while working directly within a DoD network may not be fully articulated while working remotely at home. For this reason, DoD personnel need to be especially alert and attentive to cyberattacks, malware, phishing expeditions, network security protocols, encryptions requirements, et al, which may threaten government information stored on telework devices and transmitted across external networks,” the website states. “Employees who telework from home need to keep government property and information safe, secure, and separated from their personal property and information. Some helpful tips to keeping your home WI-FI, computers and mobile devices protected can be found in a ‘Protect Yourself’ booklet published by the Pentagon Force Protection Agency.”