US Department of Homeland Security (DHS) Secretary Alejandro Mayorkas called ransomware a national security threat and a top priority during an RSA Conference webcast on the cybersecurity challenges facing the USA.
“Let me be clear: Ransomware now poses a national security threat,” Mayorkas said in the webcast.
He called ransomware attacks against hospitals, schools, and other critical infrastructures as “horrendous acts” and that those behind the attacks must be held accountable.
During the webcast on Wednesday, Alejandro Mayorkas, the U.S. Secretary of Homeland Security, outlined a security strategy that will focus on the top five areas: detection, information sharing, modernizing federal cybersecurity, federal procurement, and federal incident response.
To address urgent priorities the US government came up with new initiatives it calls 60-day “cyber sprints.” The first sprint will address ransomware.
Ransomware attacks have spiked significantly during the pandemic and started to target some of the most vulnerable sectors, hospitals, and schools. Operators have adopted new tactics as well. They now publish stolen data on public leak sites to make the victim pay a ransom.
“There are actors out there who maliciously use ransomware during an unprecedented and ongoing global pandemic, disrupting hospitals as hundreds of thousands die. This should shock everyone’s conscience,” DHS Secretary Alejandro Mayorkas said while discussing the growing threat of ransomware.
The government plans to step up its efforts fighting ransomware with the first measures starting in the coming weeks. The government plans measures that will minimize the risk of becoming a victim in the first place, an awareness campaign, and engaging with partners in the cyberinsurance space.
In addition, Mayorkas said DHS together with law enforcement will strengthen their operations against dark web markets that are involved in the ransomware schemes.
“With respect to responding to ransomware attacks, we will strengthen our capabilities to disrupt those who launch them and the marketplaces that enable them,” he said.
In relation to last year’s SolarWinds attacks, Mayorkas said supply chain attacks pose a different type of risks that require different measures.
“Following last year’s supply chain compromise targeting the federal government, we must build back better,” he said.
Mayorkas added progress has been made in response efforts to attacks, but it will take a long time to future-proof from such attacks.
“In the first two months, the administration has made significant strides in mitigating the SolarWinds and Microsoft Exchange incident… [New security program] will take months or years to implement. Exploitation of SolarWinds highlighted that we need to think of supply chain risks holistically. We need a risk-based approach to assess all supply chain risks.”
Mayorkas said the attack on SolarWinds underscored the urgent need for the federal government to modernize cybersecurity and new principles should be adopted. Those include immediate innovations, widescale investments, and raising cyber hygiene.
To that end, the government would implement a dozen actions in an upcoming executive order to be released soon, Mayorkas said.
