Skip to content
All about technology. — Sports

National Lab's Threat-Hunting Operations Halted Due to Expired CISA Contract

CyberSentry program remains active, as reported by CISA, with analysts working off-site examining sensor data.

,   and  Administrator
2 min read
National lab's threat-detection activities stalled due to expired CISA contract
National lab's threat-detection activities stalled due to expired CISA contract

National Lab's Threat-Hunting Operations Halted Due to Expired CISA Contract

The renewal of a contract between the Lawrence Livermore National Laboratory (LLNL) and the Cybersecurity and Infrastructure Security Agency (CISA) for the analysis of data collected by CISA's CyberSentry sensors has been delayed, causing a pause in LLNL's threat-hunting and data analysis operations.

The delay is due to new federal policies from the Trump administration that require more senior-level approvals, including signoffs from Cabinet secretaries. As a result, the contract renewal between the Department of Homeland Security (DHS), which oversees CISA, and the Department of Energy (DOE), which sponsors LLNL, has not yet been signed.

The CyberSentry program itself remains operational, with analysts outside LLNL continuing to review sensor data. However, LLNL's specialized threat-hunting capabilities and AI-powered analysis using its mega-computing resources are currently on pause because the lab cannot analyze incoming sensor data without funding.

The sensors continue to collect network traffic data, but analysis of that data at LLNL has stopped. Nate Gleason, the head of LLNL's Cyber and Infrastructure Resilience program, stated that their threat hunters stopped monitoring networks on Sunday.

The delay in renewing the contract is resulting in reduced scrutiny of CyberSentry data, which includes evidence of attempted and successful attacks on critical infrastructure sites like power plants, hospitals, and water treatment facilities. The sensors are voluntary tools available to critical infrastructure organizations.

The House Homeland Security cyber subcommittee held a hearing on Tuesday to discuss the impact of the contract lapse on national security. Both DHS and DOE have not publicly provided further updates or timelines for when the contract will be renewed, but CISA emphasizes its commitment to continuing the partnership once approvals are complete.

In summary, the contract lapse has caused a significant loss of visibility into threats on critical infrastructure networks monitored by CyberSentry, impacting efforts to detect sophisticated cyber intrusions such as those attributed to foreign adversaries. The delay in the contract renewal is awaiting official approval and signatures from DHS and DOE.

References:

  1. Federal News Network
  2. Nextgov
  3. The Record by Recorded Future
  4. CyberScoop
  5. The Hill

Read also:

Related

Latest