“This acquisition is an important step in the execution of QinetiQ’s five-year ambitions to expand our presence in the US, the largest security and defence market in the world,” the company’s CEO, Steve Wadey, said in a statement Aug. 5.

The deal would double QinetiQ’s U.S. business, according to the release, and is to be completed by the end of this year, subject to regulatory approvals. A combination of existing cash and new debt facilities are expected to finance the acquisition.

QinetiQ was the 64th largest defense firm in 2021, per Defense News’ Top 100 list, which ranks companies according to defense revenue. Its total revenue for the fiscal year that ended March 31, 2022, was about £1.32 billion, or $1.8 billion, per the list. According to the company, its revenue has grown for the last five years.

Avantus, which was not on the list, brought in $298 million in total revenue in the fiscal year that ended June 30, 2022, and its revenue has grown by double-digit rates over the last three years, according to the release.

Founded in 2016 and based in McLean, Virginia, Avantus provides data and cyber services to the departments of Defense and Homeland Security, among other American military and government entities. QinetiQ also provides products and services to the U.S. government.

Australia is investing millions of dollars into research and development to close gaps in the country’s cyber defense apparatus, they told the Australian Defence Science, Technology and Research Summit in Sydney on June 20.

And while the talent pool for workers with for AI and machine learning in Australia is deep, Anton van den Hengel, director of the Centre for Augmented Reasoning at the Australian Institute for Machine Learning, said their are simply not enough jobs and career opportunities in the country to keep them at home.

“We’ve made very little — very little — progress towards artificial intelligence,” he said.

The U.S. faces a critical cyber labor shortage, with some 700,000 cybersecurity positions open nationwide, according to estimates from the White House. More than 35,000 job openings are currently posted on the Indeed hiring wesbite using the search term “Artificial Intelligence.”

Van den Hengel, who also works as a director of applied science at Amazon, and other industry leaders at the summit pointed to the government’s inability to compete with tech companies as a major issue when expanding the country’s AI abilities. In both the U.S. and Australia, governments come up against the draw of private industry, creating high salary costs and other the hurdles to attracting and retaining talent.

“Defense no longer has the best tech,” he said, noting that private companies have committed billions of dollars to develop technologies and have the open positions to attract workers in the AI field.

The Defence Science and Technology Group, a part of the Australian defense department aimed at providing science and technology support to national security interests, hosted the summit.

Private-sector competition intensifies for AI talent

With high salaries and access to breaking-edge technologies, the private AI field has become increasingly lucrative. In recent years, many western counties, including the U.S., have turned to the private sector to compete with investments made by China.

Van den Hengel said outsourcing to the private sector only goes so far. Governments have to try and keep track of the technologies coming out of companies while also trying to understand them deeply enough to figure out their defense applications, he said.

In November, the Australian government said it would invest $10 million in innovative AI tech. The move followed the September announcement that Australia would partner with Britain and U.S. in a new working group, known by the acronym AUKUS, to share advanced technologies, including AI.

Kate Devitt, the chief scientist of Trusted Autonomous Systems, said Australia specifically needs experts in the field of deep learning and natural language processing compared to companies such as Google and Meta as well as specialists in reinforcement learning.

“We lack the digital infrastructure and investment required to enable the human capital with these skills to flourish in universities,” she said. “These gaps make Australia vulnerable and dependent on the choices of our allies and our rivals.”

Trusted Autonomous Systems is Australia’s first defense cooperative research center. It partners the country’s defense industry and research organizations with Australia’s defense department to develop autonomous and robotic technology.

While Devitt said the “obvious” answer is more investment in technical AI capabilities and infrastructure, she said that Australia needs to be decisive in its investments. As a medium-sized country, the government must use its limited resources to make “scrappy” decisions that yield outsized impacts, she said.

The measure, championed by retiring Rep. Jim Langevin, a Rhode Island Democrat, would designate certain critical infrastructure entities as “systemically important” for the wellbeing of the U.S. and establish new avenues for information sharing, risk management disclosures and rapid responses to digital intrusions, among other steps.

“In the nearly 22 years that I’ve served in Congress, we have come a long way in cyberspace,” Langevin said in a statement following the 329-101 House vote. “When I was elected in 2000, nobody was talking about cybersecurity.”

As many as 200 entities could initially be named, according to the language of the measure, with room for 150% more in four years. Entities could appeal placement on the list.

The vast majority of stateside critical infrastructure is stewarded by the private sector, with assets ranging from communications to chemicals, dams to the defense industrial base. Their destruction would debilitate U.S. economic security, public health and safety, according to the Cybersecurity and Infrastructure Security Agency.

Russia’s February invasion of Ukraine trained a spotlight on critical infrastructure and related digital vulnerabilities.

Lawmakers and analysts warned of potential cyberattacks on American assets — physical and virtual — and CISA issued a so-called Shields Up notice, urging heightened online awareness. The longer the Russia-Ukraine war grinds on, the more likely Moscow will act belligerently in cyberspace, according to Neal Higgins, deputy national cyber director for national cybersecurity.

The measure included in the House’s defense policy package is an offshoot of work done by the Cyberspace Solarium Commission, a bipartisan group assembled to analyze and improve U.S. cybersecurity. Its flagship report, published in 2020, included a recommendation that Congress codify systemically important critical infrastructure, also known as SICI.

“Both the private sector and the U.S. government have a vested interest in protecting these systems and assets and have unique responsibilities for their security and resilience,” the report stated.

Langevin was a member of the commission.

While the military services have banned the use of TikTok from government devices, troops and family members do use the app on personal devices.

TikTok is owned by the Beijing-based ByteDance, said Brendan Carr, the senior Republican on the Federal Communications Commission. And he’s concerned about the amount of non-public sensitive data Americans upload that could be flowing into the hands of the Chinese government.

TikTok has grown in popularity in the military community. For example, troops often upload videos of barracks, military equipment and maneuvers, Carr said in testimony Wednesday before the House Oversight Committee’s panel on national security.

“With TikTok, this is a device right in your pocket. It’s going inside the military installation, looking at location data, which can give people information on troop movements,” Carr said. “There’s a range of ways that that sensitive data going back to Beijing with their sophisticated [artificial intelligence] can ultimately be used to harm U.S. national security.”

The hearing was held to explore financial fraud targeting service members and veterans. The threats to active duty and veterans come from a variety of sources, according to Carr, and many of the frauds seen on other online platforms are also perpetrated on TikTok. But there are unique national security concerns when it comes to this video-sharing app.

“TikTok has engaged in a pattern of misrepresentation regarding both the amount and extent of data it’s collected as well as how much has been accessed from inside China,” Carr said.

He cited a recent BuzzFeed News report of leaked audio from 80 internal TikTok meetings that showed China has repeatedly accessed Americans’ user data.

“The flow of this non-public sensitive data into China is particularly troubling given the [People’s Republic of China’s] track record of engaging in espionage and other nefarious acts,” Carr said.

“At its core, TikTok functions as a sophisticated surveillance tool that harvests extensive amounts of sensitive data from search and browsing history, keystroke patterns, location data, and biometrics including face prints and voice prints,” Carr added. “All of the concerns with TikTok are heightened in the military context.”

Rep. Glenn Grothman, R-Wisc., proposed that the military should be proactively urging troops to not use the app.

“Should the military be doing more to tell our members to stay off of TikTok?” he asked.

The federal government should be doing more, Carr said. The government “should address the continued use of TikTok on military installations, as well as any use that depicts U.S. military operations,” he added.

Ongoing national security reviews of TikTok, currently being conducted by officials in the Treasure and Commerce departments, should be finished soon, according to Carr.

Leaders of the Senate Select Committee on Intelligence, chairman Sen. Mark Warner, D-Va., and vice chairman Sen. Marco Rubio, R-Fl., called on the Federal Trade Commission in a July 5 letter to initiate an investigation of TikTok.

In light of reports about the Chinese government’s access to the data, they wrote, the FTC should immediately launch an investigation “on the basis of apparent deception by TikTok, and coordinate this work with any national security or counter-intelligence investigation that may be initiated by the U.S. Department of Justice.”

Carr has also called on Google and Apple to remove TikTok from their app stores. In a July 5 blog, a TikTok official addressed the company’s approach to keeping U.S. data secure.

“The security of the data our community entrusts us with is a top priority at TikTok, despite recent reports questioning that commitment,” wrote Michael Beckerman, TikTok’s head of public policy for the Americas.

TikTok recently stood up a new U.S. data security division “to bring heightened focus and governance to our ongoing efforts to strengthen our data protection policies and protocols, further protect our users, and build confidence in our systems and controls in the United States,” he stated.

The creation of that division was an important milestone in the goals they previously laid out, he said: “minimizing access to U.S. user data and minimizing data transfers across regions – including to China.”

A Brazilian-drafted presidential statement approved by all 15 council members said the U.N. must “improve the culture of strategic communications across civilian, military and police components” of peacekeeping missions in order to protect civilians — a key mandate for the U.N.’s 90,000 peacekeepers in Africa, the Middle East, Asia and Europe.

The council noted “with great concern the increasing amount of disinformation and misinformation directed against United Nations peacekeeping operations, which may negatively impact missions and peacekeepers.”

Brazilian Foreign Minister Carlos França, whose country holds the council presidency this month and chaired Tuesday’s meeting, said that “strategic communications are essential for a successful peacekeeping operation.”

U.N. Secretary-General Antonio Guterres told the council that the world in which peacekeepers operate “is more hazardous today than any time in recent memory,” with geopolitical tensions reverberating locally and conflicts “more complex and multi-layered.”

“Peacekeepers are facing terrorists, criminals, armed groups and their allies — many with access to powerful modern weapons, and many with a vested interest in perpetuating the chaos in which they thrive,” the U.N. chief said.

But, he added, “The weapons they wield are not just guns and explosives. Misinformation, disinformation, and hate speech are increasingly being used as a weapon of war.”

Guterres said a recent survey found that nearly half of all U.N. peacekeepers feel misinformation and disinformation severely affect their work and threaten their safety and security.

As an example of false information spreading “like wildfire,” Guterres said a fake letter alleging that U.N. peacekeepers in Mali were collaborating with armed groups “went viral on WhatsApp and was picked up by national media.” It stirred up hostility and resentment against peacekeepers and made their efforts to protect civilians even harder, he said.

Lt. Gen. Marcos Da Costa, commander of the peacekeeping force in Congo, told the council that it operates in a country where successive surveys find “an overall poor perception” among the population about the mission’s relevance in improving their security.

“Anti-mission sentiment prevails in certain parts of the country that even prevent some of our deployments,” he said. “Unfair speeches by several actors against the mission put in risk the safety of our peacekeepers. The extensive use of social media by armed groups and other spoilers undermines the confidence in the U.N.”

He said these armed militias “use regular information warfare techniques” and their fake news diffusing through messaging and social media is difficult to distinguish from reality.

“These emerging technologies are driving a fundamental change to the character of the war, and peace operations are already being affected,” Da Costa said.

Guterres said the U.N. is moving to improve communications in peacekeeping operations between uniformed and civilian personnel, seek military and police officers skilled in communicating, and work with tech and media companies and member states to collect and share best practices.

Speaking during a C4ISRNET webcast, Kenneth McNeill said an initiative called “Bring Your Own Approved Device” would allow guardsmen to use personal mobile equipment to perform the same functions in the field that they would otherwise carry out at a desktop in their offices.

“In a typical state, all of our guardsmen, unfortunately, they may not have government-furnished devices — mobile cellphones, iPads,” McNeill said. “It cuts down on time when we’re planning for a mobilization.”

The initiative, which is a collaboration with the Department of the Army and the Pentagon’s cybersecurity office, is in its third phase of a pilot program consisting of a yearlong trial with the largest sample size to date. After this trial, if deemed successful, the initiative will be enacted, McNeill said.

Work began on the initiative before the pandemic, which drove a transition to remote work. The realities of the situation forced the Guard to accelerate its efforts.

“This is another tool in the toolkit that will give us an opportunity to allow our workforce, even after the pandemic, to continue to telework and [perform] remote work that is critical in the National Guard,” McNeill said. “I don’t think we’re going back [to] everyone in the office. I think this is the future of how we’re going to operate here in the government and in the Department of Defense.”

While deployed to the streets of Washington, D.C., following the Jan. 6 insurrection on the Capitol, the National Guard employed a similar capability called Commercial Virtual Remote to carry out the mission that was limited in scope and time.

“Now we will have a capability that really links our force, even before they are called up for deployment,” he said. “This will be a game-changer.”

JADC2

McNeill also discussed an addition to the Joint All-Domain Command and Control concept being implemented by the DoD that would focus on the needs of the National Guard’s mission set. Called “Project Homeland,” the initiative would apply the same capabilities of JADC2 to the domestic front.

JADC2 is a project by the Department of Defense to connect all the sensors from the individual services and compile data collected into a single information network. Previously, each service had their own tactical networks that were unable to interface with each other.

“JADC2 is a warfighting necessity to keep pace with the volume and complexity of data in modern warfare and to defeat adversaries decisively,” the department said in a statement. “JADC2 enables the Joint Force to ‘sense,’ ‘make sense,’ and ‘act’ on information across the battle-space quickly using automation, artificial intelligence (AI), predictive analytics, and machine learning to deliver informed solutions via a resilient and robust network environment.”

Project Homeland would apply those same capabilities during domestic deployments across the 54 states and territories National Guard units and their civilian interagency partners as opposed to the military services and their coalition forces.

McNeill spoke to the challenges the National Guard faced during their humanitarian relief operations post Hurricane Katrina. On the ground, the Guard was unable to talk with the local first responders because they did not have cross-banding communication systems.

“We learned from that experience that we’ve got to think out of the box,” McNeill said. “We’ve got to look at capabilities that can talk to first responders and focus on what we do in the homeland.”

Federal leaders are no longer surprised when attackers identify the next crack in the dam. That doesn’t mean they can sit complacently by and wait.

The onset of COVID-19 and the shift to hybrid work expedited the need for government agencies to reevaluate how best to utilize their limited resources to plug the unfilled holes. The need to fast-track remote access has led to the recent adoption, emphasis on, and implementation of Zero Trust innovations.

White House Executive Order 14028 on May 12, 2021, made ZT architecture central to the federal security landscape, required agencies to develop new standards that could better prevent cyber incidents, and mandated the transformation of government systems into more secure digital infrastructures.

Since then, the Office of Management and Budget released its federal strategy in January, and the Cybersecurity and Infrastructure Security Agency issued its latest ZT guidance for agencies this March.

While guidance abounds, there are many steps required to implement federal efforts to identify, detect, deter, prevent and respond to these ever-evolving threats. Agency leaders are working to adopt the mindset of trust nothing and verify everything to prioritize the transformation of legacy systems.

The General Service Administration is supporting the implementation phase with plans to issue ZT playbooks this year. These roadmaps will help operationalize the ZT strategies required by the EO and recently submitted by each federal agency.

So, what should these playbooks contain? First, they should define the key tenets of ZT. Second, playbooks need actionable and proven guidelines that go beyond top-line EO-driven agency strategies to guide adoption in six key steps.

Define Key Tenets of ZT

For starters, ZT is not a destination but rather an ongoing journey. It optimizes and improves security by increasing levels of automation, refining access to data and making sound decisions based on policies and risk. It includes six key tenets that leaders must fully understand to drive implementation. These key tenets include:

Identities: people, services and internet-of-things components

Devices: monitoring and enforcing device health and compliance

Apps and Services: ensuring appropriate permissions and secure configurations

Data: giving the necessary attributes and encryption to safeguard out in the open

Infrastructure: hardening against attacks on-premises or in the cloud

Networks: establishing controls to segment, monitor, analyze and encrypt end-to-end traffic

Implementing Trust Resilience

Agencies can benefit from proven strategies poised to tackle EO ZT requirements in actionable bites and implement a “trust resilience framework” in six key steps.

• Establish a ZT Accelerator. Assess current plans to understand the operating environment of basic ZT tenets and create a strategic roadmap.
• Build a Risk Management Framework (RMF). RMF as a service coupled with continuous authorization to operate (ATO) can be pre-packaged to meet the National Institute of Standards and Technology (NIST) framework.
• Ensure Continuous ATO. Give the highest level of assurance for existing systems to pass annual audits.
• Secure Cloud Infrastructure. Ensure the technology stack is designed on ZT principles.
• Secure Access Service Edge (SASE). Ensures authorized users have access anytime anywhere
• Enterprise IT Support: Provide as-a-service delivery of the previous four items (2-5)

The transition to, and implementation of, ZT across the federal government will be challenging, but is of the utmost importance. Transformation will require experienced people who know how to interpret the technologies implemented and understand that every arm of government operates at a different pace.

Enhanced collaboration with private industry will go a long way in supporting the federal government throughout the adoption process and into the future. Best practices stand ready to support agencies as they build the tailored, specialized and playbook-aligned approaches necessary to meet the nation’s cyber threats.

Shawn Kingsberry is Vice President, Cybersecurity at SAIC

Have an opinion?

This article is an Op-Ed and as such, the opinions expressed are those of the authors. If you would like to respond, or have an editorial of your own you would like to submit, please email C4ISRNET Senior Managing Editor Cary O’Reilly.

Want more perspectives like this sent straight to you? Subscribe to get our Commentary & Opinion newsletter once a week.

This year’s $1.5 trillion omnibus spending package includes an unprecedented budget increase for the Cybersecurity and Infrastructure Security Agency, as well as tightened cyber incident reporting requirements for sectors like transportation and energy.

To build cyber resilience in this heightened threat environment, agencies must work closely with both international counterparts and industry to align on a proactive, global approach to all cyber threats –– not just state-sponsored attacks. That means understanding the threat landscape, shoring up critical infrastructure and developing a plan to coordinate well before attacks happen.

Understanding an increasingly turbulent cyber threat landscape

In general, the massive state-sponsored cyberattacks many analysts expected on critical infrastructure in Ukraine and elsewhere have yet to materialize. Still, the conflict has given rise to a complex and shadowy landscape of citizen cyber hacktivists, vigilantes and criminal groups taking advantage of the crisis to steal money and working as potential proxies for state actors.

Chatter within ransomware groups indicates some threat actors are siding with Russia, some with the West and some are simply using the theater of war as a smokescreen to facilitate cybercrime. FortiGuard Labs researchers also identified email phishing scams perpetrated by opportunistic criminals posing as trusted organizations like the United Nations to fraudulently solicit donations and potentially infect devices.

History shows the potential for outsized impact when the tools of cyber conflict inevitably proliferate. In 2017, for example, the NotPetya ransomware initially was launched in the update servers for accounting software in Ukraine but quickly and predictably spread worldwide, affecting even large and well-prepared firms and causing an estimated $10 billion in damage.

Many analysts believe that despite having some of the surface charactaristics of ransomware, NotPetya was intended from the outset to be destructive, rather than a tool for criminal profit. And as the conflict in Ukraine continues, threat researchers are encountering increasing amounts of “wiperware”––malicious software designed to disrupt operations or delete data.

Shoring up critical infrastructure

Within the United States, new investments in cybersecurity from both the omnibus bill and the Infrastructure Investment and Job Act offer a unique opportunity to help mitigate the risk of both state-sponsored and criminal cyberattacks on critical infrastructure.

Recent CISA guidance emphasizes the vital importance of including cybersecurity in the design of new infrastructure projects, regardless of the sector or the size of the organization. This is where national cybersecurity becomes a state and local issue as well. This summer, CISA is expected to issue guidelines to help mayors and governors utilize the law’s $1 billion cyber grant program dedicated to building cyber maturity at the state and local level. However, if we spent only $1 billion on cybersecurity out of a $1.2 trillion total, we would be woefully underinvesting in cybersecurity and resilience.

For those state and local governments, it’s better to build in cyber protocols now as the infrastructure upgrades are being planned and implemented than trying to chase down vulnerabilities as they’re being exploited.

Coordinating across borders and sectors

In addition to fortifying our defenses domestically, slowing the success of malicious cyber actors will require robust cooperation beyond our borders, as well collaboration with the private sector.

That means more information sharing before, during and after attacks. President Biden even went so far as to write guidelines into his 2021 cyber executive order, ensuring that IT services providers be able to share information with the government as a whole and require them to share certain breach information. And the recently enacted Cyber Incident Reporting for Critical Infrastructure Act requires that critical infrastructure providers notify CISA of any significant cyber incident within 72 hours or any ransomware payment within 24 hours.

Internationally, governments and the private sector should be aligning cyber defense and mitigation playbooks among NATO allies—a critical first step to mitigate the risk of burgeoning threats. Beyond that, multilateral organizations such as the World Economic Forum Centre for Cybersecurity could convene global public-private partnerships to encourage information-sharing and the development of cyber norms.

This is just a taste of what we’ll need to do in the coming months and years, but it’s a good start.

Delivering more effective cybersecurity to protect our nation’s networks is a complex challenge –– one that will require governments and industry to work together effectively to confront. Progress is necessary and it will take an effort of allies. No single government or organization or cybersecurity vendor can take this on alone.

Jim Richberg is public sector field CISO at Fortinet. He formerly served as the national intelligence manager for cyber in the Office of the Director of National Intelligence, where he set national cyber intelligence priorities.

Concerns about cybersecurity threats posed by foreign adversaries were on the rise even before the conflict. According to the 2022 SolarWinds Public Sector Cybersecurity Survey Report, 56% of federal IT operations and security decision-makers state foreign governments are now one of the top security threats, along with the general hacking community and untrained insiders.

To combat these threats, protect American critical infrastructure and safeguard personal information, the federal government is actively seeking to strengthen its cybersecurity workforce. Agencies must find innovative ways to compete with lucrative private sector positions to do so, but it’s a perpetual challenge. In recent years, many federal agencies have seen their pool of cyber talent shrink.

Here are some best practices federal agencies can implement to better attract and retain a federal cybersecurity workforce.

Make a Case for a Rotational Cyber Workforce Program

On June 21, President Joe Biden signed the Federal Rotational Cyber Workforce Program Act into law, offering agencies a practical solution to the cyber staffing crisis—if they act proactively.

Under this new law, the Office of Personnel Management must establish a cross-agency rotational workforce development program allowing employees to work outside a single position within a single public office. The idea is that as cybersecurity professionals move across departments, agencies will benefit from knowledge transfer and collaborative efforts to address advanced threats.

The program could also be used as a recruitment and retention tool. In theory, cybersecurity professionals will gain substantial experience across different departments, enhancing career opportunities and facilitating the expansion of each person’s professional network.

The program will be open to IT, cybersecurity, and cyber-related functions. The OPM will be charged with developing policies, processes, and procedures for detailing employees among rotational positions.

Therefore, it behooves IT and security leaders to make a case for their agencies’ participation and eligibility for the program sooner rather than later.

Address the Soft Skills Gap

Today’s cybersecurity professionals have a broad range of responsibilities. In addition to technical ability, they’re often called on to display nontechnical skills. For instance, they may be required to make a business case for IT investments, resource allocation, and new risk reduction strategies. They must also collaborate and share best practices within the federal government and industry.

Unfortunately, these “soft” or “people” skills are rarely sought or fostered within the federal cybersecurity workforce. As agencies enter a new paradigm of cyber risk, they must do everything they can to address this gap and ensure employees have the soft skills to adapt quickly and easily to the future of cybersecurity and succeed in a federal career. Indeed, strengthening and empowering the high-tech federal workforce is a key goal of the Biden administration’s management agenda.

For instance, strong communication skills are essential to ensuring teams understand the criticality of a project. Each stakeholder must appreciate the technical goals of any cybersecurity initiative and how it relates to the agency’s mission and convey all this in nontechnical terms (i.e., speak “the language of the business”). This is especially important if a project impacts many staffers and cyber professionals are called on to gain broader buy-in from the rest of the agency.

Collaboration is also vital. No agency works in a vacuum, and different groups must work together to share intelligence and accelerate efforts to lock their digital doors.

Adaptability is another crucial soft skill. Change is constant in today’s world, and the pressures on federal cyber pros have been unrelenting over the past few years. After successfully helping the federal government pivot to ensure secure remote work policies, many are hoping for a return to normal. But once again, society is at an inflection point, and there’s no room for overconfidence or security apathy.

The ability to function in this ever-changing environment is becoming increasingly important. Federal cyber pros must be able to shift their thinking quickly and be willing to embrace—and thrive through—change.

Communication, collaboration and adaptability will take on new significance with the recent implementation of the Federal Rotational Cyber Workforce Program Act. As such, IT and security leaders must revisit their job requirements (even for the most technical staffers) and prioritize skills development with strategic training opportunities capable of bringing value to the organization and the workforce—and time is of the essence.

Brandon Shopp is Group Vice President, Product Strategy, at SolarWinds, a supplier of network and systems management software.

The Cybersecurity and Infrastructure Security Agency has posted a “Shields Up” warning, which the Pentagon emailed to members of the defense industry Monday morning, alerting organizations to the potential for cyberattacks.

Cyberattacks have been a central part of Russia’s playbook in the past, CISA said, particularly in Ukraine in 2015. And while CISA said the U.S. homeland is not now facing any specific, credible threats, Russia could “consider escalating its destabilizing actions in ways that may impact others outside of Ukraine.”

“The Russian government understands that disabling or destroying critical infrastructure — including power and communications — can augment pressure on a country’s government, military and population and accelerate their acceding to Russian objectives,” CISA wrote.

CISA, which is part of the Homeland Security Department, helps organize the nation’s efforts to prevent and respond to cyberattack. Its mission includes connecting government and industry members with one another and help them find the tools and other resources they need to strengthen cybersecurity.

CISA said it’s been working with partners in critical infrastructure in recent months to make them aware of what threats could be out there and to prepare in advance, instead of just responding after something happens.

CISA advised organizations of all sizes to ensure personnel use multi-factor authentication when logging on remotely to their networks or for privileged and administrative access, and to ensure their software is up to date to lessen the chances of a cyber intrusion. They should also make sure their IT departments have turned off any ports or protocols that aren’t needed to conduct business, and put strong controls in place if using cloud services.

If an organization becomes aware it may have been breached, CISA said their cybersecurity or IT personnel should quickly spot and assess anything out of the ordinary on their network, and make sure their network has the right software to protect against viruses or malware.

Organizations that work with Ukrainian organizations should take particular caution to monitor, inspect and isolate that traffic, and closely review the access controls, CISA said.

And organizations need to be prepared to respond if a cyberattack does occur, CISA said, such as by designating in advance a crisis response team. That team should designate the main points of contact and spell out the roles and responsibilities people within the organization — such as in the technology, communications or legal departments — should take if something happens. They should also make sure key personnel would be available if something happens and have a plan to surge support to respond when a cyber intrusion happens, CISA said. Organizations should hold tabletop exercises to make sure all personnel know what they should do if a cyber intrusion happens.

Organizations also need to test their backup procedures to make sure they can quickly restore critical data if it is hit by a destructive cyberattack such as ransomware, CISA said. They should also make sure their backups are isolated from network connections.

CISA said any incidents or suspicious activity should be reported to them or the FBI at the FBI’s CyWatch line, at 855-292-3937, or CyWatch@fbi.gov.