What the CISA Reporting Rule Means for Your IT Security Protocol

The new Cyber Incident Reporting for Critical
Infrastructure Act of 2022 (CIRCIA)^[1]
requires CISA to create rules regarding cyber incident reporting by
critical infrastructure organizations. The RFI and hearings precede
a Notice of Proposed Rulemaking (NPRM) that CISA must publish
sooner than 24 months^[2]
from the enactment of CIRCIA, which the President signed into law
in March^[3]. The sessions and NPRM
are steps toward creating the new rule.

CISA is soliciting expert opinion on what to
include^[4] in a report but is
taking steps to implement the change soon. Here’s what that change
means for businesses in the US and what you can do about it
now.

Overview of the CISA reporting rule

Owners and operators of critical infrastructure must file cyber
incident reports with CISA within 72 hours^[5]. They must report ransom
payments for ransomware attacks within 24 hours^[6]. Other businesses can
take part voluntarily.

The CISA Director can subpoena^[7]
organizations in noncompliance to compel them to provide
information necessary to determine whether a cyber incident
happened. The CISA Director can refer the matter to the Attorney
General to bring civil action to enforce the subpoena when
necessary.

CISA will share data from cyber incident reports, including
defensive measures and anonymized cyber
threat indicators^[8], with other
organizations. The data will inform businesses to adjust security
infrastructure, monitor for specific attack PPTs, and block or
remediate attacks.

What CISA’s rule means for critical infrastructure
businesses

CISA’s rule will enforce fast reporting, which will probably
move organizations to speed up investigation and response, so
initial reports are timely while showing mitigating actions. The
rule will likely result in frequent reporting as the broader
list of incidents^[9]
includes scans and attempted incidents, not just successful
intrusions. Unreported incidents and slow reporting can trigger
enforcement action from the CISA Director. Organizations will
require incident investigation and response to yield more results
than in the past.

The rule will force organizations to use every means to tighten
and enforce security protocols to reduce the frequency of cyber
incidents. Organizations will need additional security rules and
policies to reign in attacks; additional steps to enforce those
protocols will follow.

Increasing demand for effective cybersecurity will elevate cyber
industry competition. Cybersecurity vendors must keep pace with
their customers and the new 72-hour timetable as they aid in the
investigation, response, and reporting of incidents the rule
covers. The market for security analysts and related specialists
will grow.

Getting ahead of CISA’s reporting rules now

CISA emphasizes taking action to mitigate cyber incidents.
Response actions^[10] include triggering a
disaster recovery plan and hunting for network intrusions.

Response actions are challenging even without stringent time
constraints. It is common practice for organizations to reset
employee passwords after a cyber incident. Password resets are
expensive and time-consuming^[11].

Organizations need solutions that ease the process. After an
attack, IT can run a free copy of the Specops^[12] Password Auditor to
generate a password age report^[13] to see who changed
their passwords. IT can use this information to force a password reset^[14] as needed for those who
have not manually changed their passwords.

Password security is essential to protecting critical
infrastructure

Securing passwords with policies and resets safeguards accounts
and stops the spread of breaches. For example, unauthorized access
to accounts enables criminal hackers to move laterally across the
network. Lateral movement lets them take control of additional
accounts, including admin accounts, and breach and exfiltrate
customer databases and intellectual property. Check out Specops Password
Policy^[15] if you’re looking to
beef up your Active Directory password security in order to
safeguard against a breach.

Password security is essential to defending critical
infrastructure against ransomware attacks. Cybercriminals infected
Colonial Pipeline with ransomware in 2021 using a single compromised password.^[16]