What might go down as the most consequential story of the year for the cybersecurity community only surfaced in December. And yet, experts predict years of clean up, both physical and political, and potential shifts in how the nation secures the supply chain.
Of particular concern among some cybersecurity experts is the fact that the company took several months to report to the incidents, which stemmed from unauthorized access to servers from overseas offices.
Research from ESET of a supply chain attack in Vietnam in which digital certificates were compromised set off continued discussions in the industry about the nature of recent supply chain attacks, and how security teams can most effectively prepare and respond.
The department formally confirmed the hackers' tentacles had reached into the agency, but that the malware injected had been isolated to its business networks. Some security experts argue, however, that visibility into the IT network may give hackers a path to the OT network.
Manufacturers affected by the 33 vulnerabilities in open-source TCP/IP stacks often buried deep in the supply chain may not immediately know their devices are at risk.
The provision, included in the National Defense Authorization Act, will allow CISA to obtain subscriber information for vulnerable IT assets related to critical infrastructure.
