National Lab's Threat-Hunting Operations Halted Due to Expired CISA Contract
The renewal of a contract between the Lawrence Livermore National Laboratory (LLNL) and the Cybersecurity and Infrastructure Security Agency (CISA) for the analysis of data collected by CISA's CyberSentry sensors has been delayed, causing a pause in LLNL's threat-hunting and data analysis operations.
The delay is due to new federal policies from the Trump administration that require more senior-level approvals, including signoffs from Cabinet secretaries. As a result, the contract renewal between the Department of Homeland Security (DHS), which oversees CISA, and the Department of Energy (DOE), which sponsors LLNL, has not yet been signed.
The CyberSentry program itself remains operational, with analysts outside LLNL continuing to review sensor data. However, LLNL's specialized threat-hunting capabilities and AI-powered analysis using its mega-computing resources are currently on pause because the lab cannot analyze incoming sensor data without funding.
The sensors continue to collect network traffic data, but analysis of that data at LLNL has stopped. Nate Gleason, the head of LLNL's Cyber and Infrastructure Resilience program, stated that their threat hunters stopped monitoring networks on Sunday.
The delay in renewing the contract is resulting in reduced scrutiny of CyberSentry data, which includes evidence of attempted and successful attacks on critical infrastructure sites like power plants, hospitals, and water treatment facilities. The sensors are voluntary tools available to critical infrastructure organizations.
The House Homeland Security cyber subcommittee held a hearing on Tuesday to discuss the impact of the contract lapse on national security. Both DHS and DOE have not publicly provided further updates or timelines for when the contract will be renewed, but CISA emphasizes its commitment to continuing the partnership once approvals are complete.
In summary, the contract lapse has caused a significant loss of visibility into threats on critical infrastructure networks monitored by CyberSentry, impacting efforts to detect sophisticated cyber intrusions such as those attributed to foreign adversaries. The delay in the contract renewal is awaiting official approval and signatures from DHS and DOE.
References:
- Federal News Network
- Nextgov
- The Record by Recorded Future
- CyberScoop
- The Hill
- The delay in the renewal of the contract between the Department of Homeland Security (DHS) and the Department of Energy (DOE) for the analysis of CyberSentry data is raising concerns about privacy and cybersecurity, particularly in relation to the protection of critical infrastructure sites like power plants, hospitals, and water treatment facilities.
- In light of the contract lapse, there is a growing need for alternative measures to ensure the technology used for monitoring and analyzing cyber threats in sports, where privacy and security are equally crucial, is safeguarded from potential vulnerabilities that might arise due to such delays.
