New Laws Are ‘Probably Needed’ to Force US Firms to Patch Known Cyber Vulnerabilities, NSA Official Says

The vast majority of cyber attacks exploit known vulnerabilities that could be fixed by patching older software and replacing older computing gear. But that costs money, and legislation will likely be needed to force companies to make these fixes soon — before the kind of AI-powered tools used by Russia and China become commonplace among smaller-scale hackers, said Rob Joyce, who leads the National Security Agency’s Cybersecurity Directorate. 

“The biggest problem is historical tech debt,” said Joyce, meaning old computers and software that aren’t up-to-date on the most recent patches against attackers. “That means we have to be investing in refresh. We have to be investing in the defensive teams. We have to be investing in organizations that will track, follow and upgrade to close out those vulnerabilities and from where I sit, there's probably going to have to be some regulation over time.” Joyce made his remarks during a pre-taped session that aired on Friday during the sixth annual Defense One Tech Summit. 

In May, the White House issued an executive order requiring government entities and contractors to take steps to protect themselves from known attack tools. But the executive order doesn’t extend to all businesses. 

Joyce said that while it’s not his role to write specific legislation, it is his job to understand critical gaps in cyber defenses across the public and private sector. He said that new standards to establish a “bare minimum” would go a long way toward preventing the sort of attacks like the one that hit Colonial Pipeline  in May by raising the costs and difficulties for attackers to perpetrate such attacks.

“I look at the automobile industry and we wouldn't have gotten seatbelts and airbags and emission standards and fuel mileage as a priority without some amount of the government saying, ‘This is the bare minimum. This is what we need to do.’ We're all a little better for it, right? So that's...in the lane of the policymakers and the legislatures to look at it...All the organizations that have to step up, but I can't see us moving beyond this without some of that effort.”

Emerging technologies like artificial intelligence will only exacerbate the problem, said Joyce. While there’s little evidence so far that AI will help attackers launch difficult campaigns against well-defended targets, the use of AI to scroll through databases of known attacks, and possible victims, is already established tradecraft. He expects the use of AI by low-level criminal groups mounting unsophisticated attacks to grow. 

“I think [artificial intelligence] is going to be more of an enabler in the crime area where people have that backdoor unlocked, because it'll make it so much faster [for criminal groups] to recognize and realize vulnerabilities. And we're already seeing that, you know, with these big internet-scale scanners that look across the totality of the internet, multiple times a day, and provide databases where you can search for a particular feature. So when a new class of vulnerability or exploit is out there people can immediately identify the machines that are vulnerable much faster than the teams can get there to patch. So that's where I see the near and midterm problem from the offensive application of AI and [machine learning]” he said. 

Of course, criminal groups often work directly with state intelligence agencies such as Russia. In fact they often operate with impunity from inside Russia or nearby states like Belarus, where they work under the tacit allowance of the Russian government, a phenomenon sometimes called “safe harbor.”  During his recent summit with Russian leader Vladimir Putin, President Joe Biden brought up Russia’s relationship with ransomware attackers as a key barrier to better relations between the two countries. There is also legislation on Capitol Hill to bring in allies to better coordinate efforts to punish Russian-backed cyber criminals. 

Said Joyce said the government’s recent attention on the issue bodes well for actually curbing these attacks.

“There's a lot of great discussions going on right now about what safe harbor looks like” and whether the United States is doing enough, Joyce said. “The one great thing about the current administration is that cyber is a priority...And we're seeing that on the Hill as well. There's a huge focus and desire to do this better. And I think that's a recipe for us advancing and succeeding.”