6 ms·
America's Cyber Defense Agency Is Burning Down and Nobody's Coming to Put It Out
- blakesterz 9mo agoAlex Stamos talked about this a bit on TWiT late last year: "It's getting hard to not be conspiracy minded here. They closed CSRB, destroyed CISA. CISA has no confirmed director. This just adds to kind of a complete surrender at least on the cyber side. We are spectacularly poorly prepared right now for a cyber attack." https://twit.tv/shows/this-week-in-tech/episodes/1056?autostart=false https://twit.tv/shows/this-week-in-tech/episodes/1056?autost...
- JKCalhoun 9mo ago"We are spectacularly poorly prepared right now for a cyber attack." Then we will deserve it. (Sad to say.)
- AnimalMuppet 9mo agoHopefully there's still MAD (mutually assured destruction). That is, the US has (I presume) a rather formidable array of cyber offensive capabilities. Anyone thinking of cyber attacking the US might find that concerning - hopefully concerning enough that they decide that an attack isn't worth it. I mean, I'd far rather that that US had both offensive capability and a solid defense. But the situation is not totally hopeless - or so I hope.
- felineflock 9mo agoAnd a cyberattack would justify another war and extra powers of emergency. Perfect!
- iamtheworstdev 9mo agoEver feel like these things are being burned down not just on purpose, but for the gains of someone else?
- consumer451 9mo agoWell, yes, but that someone else doesn’t need to be a foreign adversary. There is a certain type of mentality that just doesn’t believe that government should do anything, and that private enterprise will always have the solution. Those people appear to be in control of all levers of power in the United States.
- pavlov 9mo agoBut they seem to also believe in heavy-handed government intervention to prop up failing businesses. For example Trump's recent announcement that he'll require the military to buy coal power on long-term contracts: https://arstechnica.com/science/2026/02/trumps-latest-plan-to-revive-coal-power-make-the-military-buy-it/ https://arstechnica.com/science/2026/02/trumps-latest-plan-t... So on the one hand they're saying government shouldn't do anything, but on the other hand they love having the government put its finger on the scales of the market.
- coldpie 9mo agoThe common thread that resolves this apparent conflict is, of course, billionaires. 100% of Republicans and ~60% of Democrats are in office primarily to serve at the whims of billionaires. They will pursue whatever policies will give more power to billionaires, consistency and hypocrisy are irrelevant.
- deleted 9mo ago[deleted]
- deaux 9mo ago> ~60% of Democrats I think you can make that ~80%, but maybe you've done the calculations more diligently than I have.
- felineflock 9mo agoNo, it is more like Reps 75% and Dems 90%, ±5%.
- sailfast 9mo agoHard agree with this and this matches what I’m hearing about the agency. That said, the failures start with Noem, DHS, and its approach to governing. Policies have been actively hostile to those working at the agency, messaging is prioritized over action, policies that make it harder to work overtime or telework or flex to the needs of actual problems, etc and that will likely continue under a new director. We’ve torched cooperation, shown we cannot protect classified information - if one didn’t know better one would think it was on purpose - but in general incompetence typically reigns. They just don’t think the agency should exist after they said elections in 2020 were generally secure.
- myko 9mo ago> shown we cannot protect classified information Extremely embarrassing that the current POTUS should be in prison specifically for his mishandling of classified information
- idiotsecant 9mo ago[flagged]
- deaux 9mo agoIf one didn't know better one would think it's incompetence.
- hnthrow0287345 9mo agoShould've made them do leetcode
- matheusmoreira 9mo ago> CISA's own joint advisory confirmed that Volt Typhoon actors maintained access inside some victim environments for at least five years, using living-off-the-land techniques that make them nearly invisible to traditional security tools. What are these living-off-the-land techniques?
- mr_mitm 9mo agoI don't know about this specific case, but there is a list of well-known techniques: https://lolbas-project.github.io/ https://lolbas-project.github.io/
- bourbonsec 9mo agoAccording to CISA's joint advisory (AA24-038A), here's specifically how they stayed inside for 5 years: Valid credentials and stolen accounts. They repeatedly dumped NTDS.dit (the Active Directory database) from domain controllers to harvest every credential in the environment. In one confirmed case they extracted NTDS.dit from three domain controllers over a four-year period. They kept coming back to re-dump so they always had current, valid passwords. Only operated during normal business hours. They studied the victim's work patterns and only used compromised credentials when legitimate admins would be active, so authentication logs looked normal. Targeted log deletion. They deleted specific logs to cover their tracks. Routed traffic through compromised SOHO routers. Fortinet, Cisco RV320, Netgear, and other end-of-life home/small office routers. Made their traffic appear to originate from legitimate residential IPs, not foreign infrastructure. Zero malware. Literally none. They used only wmic, ntdsutil, netsh, PowerShell, cmd.exe, certutil, ldifde, net, and other native Windows tools. Nothing for an EDR to signature match against. Minimal activity between credential dumps. They got in, dumped creds, did light recon, then went silent. They weren't exfiltrating data. They were pre-positioning for future disruption. That silence is what made them invisible.
- coldpie 9mo agoIt's a term-of-art that means to use the tools that are already available on the target machine. So rather than shipping a custom binary/shellcode/etc which exfiltrates data or whatever, you string together existing powershell/unix/etc commands to do so. It's effective because it's hard to distinguish these from legitimate processes.
- dotdi 9mo ago> And what's happening at CISA right now should terrify every American who depends on running water, electricity, and the ability to vote in free elections. The answer is right at the beginning. Current administration has the explicit goal to not have free elections going forward. It has been stated plainly, on TV. The rest is collateral damage, and an attack on critical infrastructure will be a good excuse to invade the next country, declare state of emergency or outright war and get rid of elections completely.
- andsoitis 9mo ago[flagged]
- perfmode 9mo agohttps://www.google.com/search?q=ice+outside+polling+locations&ie=UTF-8&oe=UTF-8&hl=en-us&client=safari https://www.google.com/search?q=ice+outside+polling+location...
- jacquesm 9mo agoWhat makes no sense is to be able to observe the last 13 months and then to think that this is 'business as usual'.
- andsoitis 9mo agoDid I imply “business as usual”? I don’t think so. At the same time, I actually think that characterization lacks usefulness. For instance, in some cases there’s clearly breaking norms (most poeple would porobably mostly for the worse, and in some limited cases for better). In other cases it is just more overt (or in some cases, more extreme) expression of typical American policy.
- jacquesm 9mo agoYou're smack in the middle of accepting the unacceptable because of normalization of deviance. None of this is 'typical American policy'. It is utter chaos, both internal and external. Your calibration point should not be Trump 1 but the Obama or Clinton administrations which were if not super popular at least competent.
- athrowaway3z 9mo ago> This Isn't About Politics > I'm a veteran. I served under both parties. I don't care which side of the aisle fixes this. The idea that there are things entirely unpartisan or unpolitical is a polite fiction we can work with when things are somewhere around normal - usually even when things are pretty far from normal. I get the army drilled this stance into you, but at some point the price the people pay for corruption includes their security. It is, in fact, about politics.
- bwb 9mo agoIt will have to get a lot of worse in order to get better. Voters have to be in a lot more pain to give the non-crazy party control to actually fix fundamental problems. Note: I'm an independent, but the current administration is incompetent on an embarrassing level.
- Veliladon 9mo agoThe electorate does give control but they get bored after a few years and want to wreck everything all over again. It's goldfish levels of political memory in this country.
- FranklinJabar 9mo agoWe're going to need to, at the very bare minimum, fix campaign finance before we are able to produce a party that will fight for a stable democracy. Tbh, I don't see any way going back to democracy and rule of law is possible without completely rewriting our constitution.
- chii 9mo ago> without completely rewriting our constitution. there is no need to rewrite it, because it's fine. What's not fine is people not observing it, and defending it with their lives, and making sure that violations are actioned with penalties, social stigma and disdain.
- 9mo ago
- roxolotl 9mo agoMy understanding is you could write an article like this for every agency right now. Rebuilding is going to be very expensive assuming we get there.
- idiotsecant 9mo agoWe won't. This is what the end of empire looks like. The US is going to end up a backwards, superstitious, backwater. I would be surprised if the "U" part of USA survives the century.
- coldpie 9mo agoThe one thing that keeps me going through the fall of the US is the knowledge that despite all, there are still lots of happy people in Russia and China. People live their lives under those single-party authoritarian regimes, and many of them are happy. Maybe I can be happy here, too.
- krapp 9mo ago“He gazed up at the enormous face. Forty years it had taken him to learn what kind of smile was hidden beneath the dark moustache. O cruel, needless misunderstanding! O stubborn, self-willed exile from the loving breast! Two gin-scented tears trickled down the sides of his nose. But it was all right, everything was all right, the struggle was finished. He had won the victory over himself. He loved Big Brother.”
- actionfromafar 9mo agoI think that's exactly how Russia operates, sadly. Vodka helps, I guess.
- clawlrbot 9mo ago[dead]
- utopiah 9mo ago"America [...] Is Burning Down and Nobody's Coming to Put It Out [because it decided to do so to itself]" There, fixed the title with some subbtle edits. /s
- anon_IT_fed 9mo agoThis is a good thing. CISA was run by a bunch of BAH consultants that loved to push 8-9 digit cyber security software / license requirements to agencies with no thoughts on how to pay for it. Cyber security in federal is one big circle jerk. Cyber vendors pay into non-profits to write whitepapers why you need X, Y, Z software. This in turn was pushed by IT consultants from the major System Integrators, whom CIO's loved to bend the knee to because that was their near retirement career path. CISA would eventually push these as requirements, with even a bribe of "use our contract, we'll pay for year 1" but no idea how to pay for future years. I work in a cabinet level agency running an $350M IT program. I'm good what I do, including cyber. We're too focused on paperwork compliance and vendor agents that provide little to no value for 8-9 digit annual costs. Anonymous Account because I'd like to keep my job.
- splatter9859 9mo agoAs an American taxpayer who has a twenty-five year decade long career in IT this concerns me. Doesn't surprise me in the least but concerns me. Yet you see this waste and take to HN instead of reporting the waste and abuse via channels such as whistleblowers? I'm glad you're good at what you do, but to me, and this attitude of "I know this is an issue but I'm still gonna waste taxpayer funds as part of my job and perl-clutch on HN" is concerning. Outside of your paycheck contributions and otherwise, that isn't your money friend.
- anon_IT_fed 9mo agoThis is how any large federally funded markets operate in the United States. Businesses pay into trade associations or lobbying groups, and they try to impact public policy to ultimately increase/decrease regulation or get funding in future years. This is just the IT version of that.
- splatter9859 9mo agoI live and work in the DMV. I get it. Doesn't change my point.
- paxys 9mo agoPolitical party in power makes it an explicit goal to dismantle government agencies and privatize all regulations, safety, security, environmental protections. Chaos ensues. Average American - "This isn't about politics. Both sides are to blame. We must work together." Unless people collectively get their heads out of their asses the situation isn't going to magically reverse itself.
- ifyoubuildit 9mo agoI've only really heard of cisa in terms of "fighting disinformation", which seemed more than a little dubious. Can someone speak to what their mission is and how effective they've been at it? Or is this like the DHS where you just get to say that we haven't had any more 9/11s, so clearly the money and complete transformation of how we think about personal liberties was worth it? Theoretically, it makes sense that we would need something like a cyber defense agency. Realistically, this doesn't seem like something the government (even at the best of times) would be capable of doing effectively.
- iamnothere 9mo agoBefore its recent extension into the mis/disinformation (censorship) space, CISA was primarily focused on coordinating public/private response to cyber threats and distributing information about known vulnerabilities. It is the primary US sponsor of the CVE system, for instance. It also provides guidance regarding best practices to industry and government agencies. By getting CISA involved in speech regulation, former directors made CISA into a political football, risking its core mission. (This actually happened during the first Trump admin, under a Trump appointee, but continued into the Biden administration.) There is no reason that an organization established to tackle cyber threats should be involved with regulating speech via third parties in NGOs and industry. None. Not even if that speech takes place “on the internet.”