The Cyber Safety Review Board (also called the CSRB) was established by United States Secretary of Homeland Security Alejandro Mayorkas on February 3, 2022.[1][2][3][4] Modeled after the National Transportation Safety Board, the Board reviews significant cybersecurity incidents and issues reports.[5][6] President Joe Biden directed the Board's creation through Section 5 of Executive Order 14028, issued on May 12, 2021.[7][8]
Overview
editThe Board reviews and assesses significant cyber incidents and provides findings and recommendations to the United States Secretary of Homeland Security. The Board’s construction is a unique and valuable collaboration of government and private sector members, and provides a direct path to the Secretary of Homeland Security and the President to ensure the recommendations are addressed and implemented, as appropriate.
Executive Order 14028 provides that the Board is composed of up to twenty members, chosen by the Director of the Cybersecurity and Infrastructure Security Agency.[9] Those members must include representatives from various federal agencies, as well as individuals employed by the private sector.[9] The CSRB lacks subpoena power and instead relies on voluntary cooperation from organizations with relevant information, though the Biden Administration has published a legislative proposal requesting that Congress grant the CSRB subpoena power.[10]
Reports
editAs of 2024, the CSRB has issued three substantive reports.
Review of the December 2021 Log4j Event
editOn July 11, 2022, the CSRB published its first report, reviewing the Log4Shell vulnerability and associated incidents.[11]
Review of the Attacks Associated with Lapsus$ and Related Threat Groups
editOn July 24, 2023, the CSRB published a report reviewing the Lapsus$ international hacker group.[12]
Review of the Summer 2023 Microsoft Exchange Online Intrusion
editOn March 20, 2024, the CSRB published a report detailing how in May 2023, a cyber threat actor classified by Microsoft as STORM-0558 compromised the mailboxes of a broad range of victims in the United States and United Kingdom, including email accounts in the U.S. Department of State, U.S. Department of Commerce, and U.S. House of Representatives.[13] The CSRB reported that STORM-0558 was able to compromise Microsoft's corporate network using unknown means and steal a Microsoft Services Account (MSA) key, which STORM-0558 then used to sign forged authentication tokens granting it access to specific mail accounts.[13] This malicious cyber activity was eventually detected by the U.S. Department of State, rather than by Microsoft itself.
The CSRB concluded that "Microsoft’s security culture was inadequate and requires an overhaul," noting that Microsoft "failed to detect the compromise of its cryptographic crown jewels on its own, relying instead of a customer."[13] This report was widely covered by traditional media and cybersecurity trade press.[14][15][16][17]
Following the publication of the report, Microsoft CEO Satya Nadalla released a blog post acknowledging the CSRB's report and pledging to prioritize security in the future.[18]
Current Composition
editThe CSRB is composed of 15 cybersecurity leaders from the federal government and the private sector:[3]
- Robert Silvers, Under Secretary for Policy, Department of Homeland Security (Chair)
- Heather Adkins, Vice President, Security Engineering, Google (Deputy Chair)
- Dmitri Alperovitch, Co-Founder and Chairman, Silverado Policy Accelerator and Co-Founder and former CTO of CrowdStrike, Inc.
- Leslie Beavers, Acting Chief Information Officer, Department of Defense
- Harry Coker, Jr., National Cyber Director, Office of the National Cyber Director
- Jerry Davis, Chief Information Security Officer, Software and Digital Platforms, Microsoft
- Mike Duffy, Acting Federal Chief Information Security Officer, Office of Management and Budget
- Jeff Greene, Executive Assistant Director for Cybersecurity, Cybersecurity and Infrastructure Security Agency
- Jamil Jaffer, Venture Partner, Paladin Capital Group and Founder and Executive Director, National Security Institute, GMU Scalia Law School
- Rob Joyce, Owner, Joyce Cyber LLC.
- Chris Krebs, Chief Intelligence and Public Policy Officer, Sentinel One
- David Luber, Director, Cybersecurity Directorate, National Security Agency
- Marshall Miller, Principal Associate Deputy Attorney General, Department of Justice
- Katie Nickels, Senior Director of Intelligence Operations, Red Canary
- Bryan Vorndran, Assistant Director, Cyber Division, Federal Bureau of Investigation
Former Members
editPrivate sector CSRB members serve for a term of two years, which may be renewed up to three times.[9][19]
- Chris Inglis, National Cyber Director, Office of the National Cyber Director
- Katie Moussouris, Founder and CEO, Luta Security
- David Mussington, Executive Assistant Director for Infrastructure Security, Cybersecurity and Infrastructure Security Agency
- Chris Novak, Co-Founder and Managing Director, Verizon Threat Research Advisory Center
- Tony Sager, Senior Vice President and Chief Evangelist, Center for Internet Security
- John Sherman, Chief Information Officer, Department of Defense
- Kemba Walden, Assistant General Counsel, Digital Crimes Unit, Microsoft
- Wendi Whitmore, Senior Vice President, Unit 42, Palo Alto Networks
References
edit- ^ Sanger, David E.; Perlroth, Nicole; Barnes, Julian E. (2021-05-10). "Biden Plans an Order to Strengthen Cyberdefenses. Will It Be Enough?". The New York Times. ISSN 0362-4331. Archived from the original on 2021-10-16. Retrieved 2021-05-13.
- ^ "Biden Signs Cybersecurity Executive Order Following Colonial Pipeline Hack". NPR.org. Archived from the original on 2021-06-24. Retrieved 2021-05-13.
- ^ a b "Cyber Safety Review Board website". Archived from the original on 2022-07-21. Retrieved 2022-08-10.
- ^ "DHS Launches First-Ever Cyber Safety Review Board | Homeland Security". www.dhs.gov. Archived from the original on 2024-05-31. Retrieved 2024-06-01.
- ^ "The New Cyber Executive Order is a Good Start, But Needs a Supercharge from Congress". Just Security. 2021-05-13. Archived from the original on 2021-09-26. Retrieved 2021-05-14.
- ^ Katz, Justin (May 13, 2021). "Cyber EO lays a foundation for securing government". GCN. Archived from the original on 2021-05-14. Retrieved 2021-05-14.
- ^ "Executive Order on Improving the Nation's Cybersecurity". The White House. 2021-05-12. Archived from the original on 2021-05-15. Retrieved 2021-05-13.
- ^ Macias, Kevin Breuninger,Amanda (2021-05-12). "Biden signs executive order to strengthen U.S. cybersecurity defenses after Colonial Pipeline hack". CNBC. Archived from the original on 2021-10-19. Retrieved 2021-05-13.
{{cite web}}: CS1 maint: multiple names: authors list (link) - ^ a b c "Cyber Safety Review Board Charter | CISA". www.cisa.gov. 2023-09-21. Archived from the original on 2024-06-14. Retrieved 2024-06-01.
- ^ "Is the Cyber Safety Review Board working? Lawmakers consider tweaks to CSRB". federalnewsnetwork.com. 2024-01-18. Archived from the original on 2024-06-14. Retrieved 2024-06-01.
- ^ Cyber Safety Review Board (11 July 2022), Review of the December 2021 Log4j Event (PDF), Cybersecurity and Infrastructure Security Agency, Wikidata Q113274848
- ^ "Review Of The Attacks Associated with Lapsus$ And Related Threat Groups Report | CISA". www.cisa.gov. 2023-08-10. Archived from the original on 2024-06-01. Retrieved 2024-06-01.
- ^ a b c "Summer 2023 Review of the Microsoft Exchange Online Intrusion | CISA". www.cisa.gov. 2024-05-24. Archived from the original on 2024-05-31. Retrieved 2024-06-01.
- ^ Nakashima, Ellen; Menn, Joseph (2024-04-02). "Microsoft faulted for 'cascade' of failures in Chinese hack". Washington Post. ISSN 0190-8286. Archived from the original on 2024-05-18. Retrieved 2024-06-01.
- ^ eliasgroll (2024-04-03). "Cyber review board blames cascading Microsoft failures for Chinese hack". CyberScoop. Archived from the original on 2024-06-01. Retrieved 2024-06-01.
- ^ Hendery, Simon (2024-04-03). "Review board slams Microsoft's lax security practices and culture". SC Media. Archived from the original on 2024-06-01. Retrieved 2024-06-01.
- ^ "U.S. Cyber Safety Review Board blames Microsoft for Chinese hack". CNBC. 2024-04-03. Archived from the original on 2024-06-01. Retrieved 2024-06-01.
- ^ Blogs, Microsoft Corporate (2024-05-03). "Prioritizing security above all else". The Official Microsoft Blog. Archived from the original on 2024-06-01. Retrieved 2024-06-01.
- ^ "DHS, CISA Announce Membership Changes to the Cyber Safety Review Board | CISA". www.cisa.gov. 2024-05-06. Archived from the original on 2024-06-01. Retrieved 2024-06-01.
.svg){kind=small} | This United States government–related article is a stub. You can help Wikipedia by expanding it. |