SNAP Skimming Bill

For Readers that have been following Brian Kreb’s looks at the problems with skimming supplemental Nutrition Assistance Program (SNAP) cards (see here and here), a bill was introduced in Congress yesterday that would require the Department of Agriculture to “to provide for the reissuance to households supplemental nutrition assistance program benefits to replace benefits stolen by identity theft or typical skimming practices”.

 HR 9319 was introduced by Rep Ruppersberger (D,MD). The text of the bill is not yet available. Ruppersberger is not a member of the House Agriculture Committee to which this bill was assigned for consideration. This means that it is unlikely (even ignoring session time constraints) that the bill would be considered in Committee.

 I will not be following this bill on this blog, but I did think that it was worth mentioning.

Short Takes – 11-16-22

Deadly Russian strike in Poland risks dangerous escalation. TheHill.com article. Sounds like an accident, but it is a problem. Pull quote: ““Whether it’s an Article 5, whether it was a deliberate attack, we can’t say. But it’s certainly an Article 4 contingency, and there should be discussions about this,” Fried told The Hill.”

After a night of uncertainty, NASA's Artemis moon rocket takes to the skies. NPR.org article. It was an awesome sight. Pull quote: “This white, bell-shaped capsule, called Orion, has now embarked on a 25-day test flight that will take it around the moon and back. The approximately 1.2-million-mile trip will bring NASA one step closer to achieving its goal of returning humans to the lunar surface.”

NASA took its next giant leap to the moon — what comes next?  TheHill.com article. Overview of planned Moon exploration program.  Pull Quote: “Artemis II is slated to launch in 2024, with Artemis III on its heels in 2025 — if the current schedule holds. The Artemis IV mission, currently slated for 2027, will be the first to inhabit the planned lunar outpost NASA calls Gateway.”

Path to 218: Tracking the Remaining House Races. NYTimes.com table. The count now stands at 218 Republicans and 211 Democrats; Republicans “control” the House – 6 races undecided; 4 leaning Republican and 2 leaning Democrat.

Review - HR 9262 Introduced – DOD Cybersecurity Acquisition

Earlier this month, Rep Bice (R,OK) introduced HR 9262, a bill to make improvements to cybersecurity acquisition policies of the Department of Defense, and for other purposes. The bill would require the Defense Acquisition University to develop a “training curricula related to software acquisitions and cybersecurity software or hardware acquisitions and offer such curricula to covered individuals to increase digital literacy related to such acquisitions”. DOD would also be required to prepare a plan to streamline the software acquisition process. No funds are authorized by the legislation.

Moving Forward

Bice, and her sole cosponsor {Rep Larson (D,WA)} are both members of the House Armed Services Committee to which this bill was assigned for consideration. This means that there should be sufficient influence to see the bill considered in Committee, if there is time available. The Armed Services Committee staff is concentrating on their negotiations with their Senate counterparts, which makes it unlikely that this bill will be considered.

I do not see anything in the bill that would engender organized opposition to the legislation. I suspect that it would receive bipartisan support, both in Committee and on the floor of the House, if it were considered.

Commentary

Since this bill does not specifically amend any existing statute, it cannot depend on existing definitions of terms. This makes the absence of any mention of operational technology, SCADA or industrial control systems in the bill a problem. As written, there is no requirement to provide acquisition personnel with any information about the inherent differences between OT and IT cybersecurity needs. This could adversely impact cybersecurity of weapons systems, building control systems and security systems. This could be rectified by modifying §1(b)(1):

“(1) cybersecurity, information technology systems, operations technology systems (including SCADA systems, distributed control systems and other industrial control systems), computer networks, cloud computing, artificial intelligence, machine learning, and quantum technologies;”

For more details about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-9262-introduced - subscription required.

Short Takes – 11-15-22

Coming Soon for Homeowners: Solar Panels That Actually Look Attractive. WSJ.com article. Aesthetics have some draw backs. Pull quote: “Now researchers and private companies are working on new designs that could change the look of residential solar—and lure more people into trying the technology. They are testing everything from solar cells so thin they can be spread like paint, to panels integrated into fabric to be used as awnings or tents, to ones that come in different and more pleasing colors.” 

Here’s how a Twitter engineer says it will break in the coming weeks. TechnologyReview.com article. Software reliability engineers are important. Pull quote: “Twitter’s remaining engineers have largely been tasked with keeping the site stable over the last few days, since the new CEO decided to get rid of a significant chunk of the staff maintaining its code base. As the company tries to return to some semblance of normalcy, more of their time will be spent addressing Musk’s (often taxing) whims for new products and features, rather than keeping what’s already there running.”

Twitter’s potential collapse could wipe out vast records of recent human history. TechnologyReview.com article. Social media as primary history source. “Musk himself acknowledges that Twitter is a public forum, and it’s this fact that makes the potential loss of the platform so significant. Twitter has become integral to civilization today. It’s a place where people document war crimes, discuss key issues, and break and report on news.”

Review – 1 Advisory Published – 11-15-22

Today, CISA’s NCCIC-ICS published a control system security advisory for products from Mitsubishi. I also take another look at the OT:ICEFALL vulnerabilities and the remediations currently available.

Mitsubishi Advisory - This advisory discusses an OS command injection vulnerability in the Mitsubishi GT SoftGOT2000.

For more details on this advisory, as well as an update on the responses to the OT:ICEFALL vulnerabilities, see my article on CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/1-advisory-published-11-15-22 - subscription required

Short Takes – 11-14-22

How the cyber agenda would shift if the GOP takes over Congress. TheHill.com article. Pull quote: “However, Jaffer warned that if Republicans win majorities in the House or Senate, they will likely push for less government regulation and instead advocate for market incentives designed to encourage the private sector to invest in cybersecurity.

Logistics: The War On Russian Railroads In Ukraine. Partisan operations. Pull quote: “Three months into the war these civilian railroad saboteurs were getting in touch with one another via encrypted Internet apps. Many of these local groups learned what to sabotage by searching the Internet for information, especially about how Ukrainian and Russian partisans sabotaged German rail traffic during World War II. Employees of the Ukrainian railroad were soon on these Internet groups, explaining post-World War II equipment improvements and how to sabotage them.”

Pharma goes to space. CEN.acs.org article. Pull quote: “At the same time, the rising demand for the unique environment of microgravity is encouraging commercial entities to provide relevant services for accessing low-Earth orbit. The ISS is scheduled to retire in less than a decade, but a boom of private space providers is emerging to mark a new era for science in space, one in which companies are betting that even drug manufacturing in space can be scalable and cost effective.”

Chemists create an 'artificial photosynthesis' system ten times more efficient than existing systems. Phys.org article. Not efficient enough for fuel production, but may be useful in lower volume, high value chemical manufacturing. Pull quote: “A Nature Catalysis study [link added] from six chemists at the University of Chicago shows an innovative new system for artificial photosynthesis that is more productive than previous artificial systems by an order of magnitude. Unlike regular photosynthesis, which produces carbohydrates from carbon dioxide and water, artificial photosynthesis could produce ethanol, methane, or other fuels.”

Cybercrime insurance is making the ransomware problem worse. TheConversation.com article. Lots of declarative statements with little support. Pull quote: “Businesses are turning to cyberinsurance companies in desperation to protect themselves from attack. But the growth of the cyberinsurance market is only encouraging criminals to target companies that have extortion insurance.”

New Video Added to CFATS 15th Anniversary Web Site

Today, CISA added a third video to their CFATS 15th Anniversary web site. The new YouTube video is “The Public Private Partnership Model”. We see mostly the same folks from the earlier videos talking about the partnership between the CISA regulatory folks and the industries being regulated. This is all part of the lead-up to Thursday’s virtual celebration.

CISA has two other videos already lined up on their YouTube channel:

“The Global Standard for Chemical Security”, and

“Industry’s Perspective on the Future of CFATS”

We will probably see these added to Anniversary page tomorrow and Wednesday.