CISA proposes new security requirements for businesses exposed to cyber espionage – Source: www.csoonline.com

The US Cybersecurity Infrastructure Security Agency (CISA) has proposed a set of security requirements to be fulfilled by organizations running sensitive business transactions with states posing national security and foreign policy threats to the US.

The requirements, CISA said in an announcement, are in line with Executive Order 14117, which was signed by President Biden in February, designed to prevent adversarial access to sensitive US government and civilian data.

“The security requirements are designed to mitigate the risk of sharing bulk US sensitive personal data or US government-related data with countries of concern and covered persons through restricted transactions,” CISA said without specifying the “countries of concern.”

CISA uses “covered” in the announcement to refer to data, resources, or personnel that are part of a restricted transaction that involves handling sensitive data. The requirements impose “conditions specifically on the covered data that may be shared as part of a restricted transaction; on the covered systems; and on the organization as a whole.”

Organizations must prioritize patching

The requirements are specified on the data and the system/organization level. For organizations (referring to the covered organizations) CISA has proposed mandating a regular inventory of assets, including their IP and Mac addresses.

In line with this requirement, organizations must now remediate known exploited vulnerabilities (KEVs) within 14 days, critical vulnerabilities with no exploit within 15 days, and high-severity vulnerabilities with no exploits within 30 days.

“Should patching not be feasible, alternative compensating requirements must be implemented,” CISA added. “US persons engaging in restricted transactions must document all mitigation measures that are implemented.”

Additionally, organizations are required to appoint an organizational-level individual (eg. CISO) responsible for cybersecurity and governance, risk, and compliance (GRC).

Documenting vendor or supplier agreements, collecting regular logs, and developing incident response plans for “covered” systems were a few other organization-level requirements that were proposed.

Data encryption and minimization required

For any restricted transaction, as per data-level requirements, adopting data minimization and obfuscation techniques has been proposed.

“Apply data minimization and data masking strategies to reduce the need to collect, or sufficiently obfuscate, respectively, covered data to prevent visibility into that data, without precluding the US persons engaging in restricted transactions from conducting operations with the data,” CISA added.

CISA recommended techniques including aggregation, pseudonymization, de-identification, or anonymization for processing data so that the data is not linkable to US person entities while it is accessed by a country of concern.

Encryption was another requirement detailed within data-level restrictions, asking organizations to apply standard (NIST framework) encryption techniques for processing data. Additionally, using only transport layer security (TLS) or higher protocols is required for restricted transactions done over the internet.

Homomorphic encryption and differential privacy techniques are also encouraged when transmitting such data.