Top National Security Council cybersecurity official on institutions vulnerable to ransomware attacks — "The Takeout"
Hospitals and schools are two kinds of institutions that are most vulnerable to ransomware attacks carried out by mostly Russian cyber criminals, according to Ann Neuberger, deputy national security adviser for cyber and emerging technology.
Now, U.S. officials are racing to raise cyber defenses at hospitals and public school systems, and they're turning to artificial intelligence tools for help. They help speed up the detection of hacking attempts and locate the source of ransomware attacks, Neuberger told CBS chief Washington correspondent Major Garrett on "The Takeout" podcast this week.
"What we see is cyber criminals, 75% of whom are based in Russia, increasingly targeting hospitals, leading to systems being encrypted in order to force the hospitals to pay ransom," said Neuberger. "Similarly, schools — children learn online. There's a lot of class records online. There's a lot of sensitive records about children...And what we've seen again is criminals targeting school systems."
She said hospitals and school systems are "some of the weakest in terms of cybersecurity."
"[Cyber criminals] are often looking for high impact victims, individuals who they think will be willing to pay. And they compromise their systems and then try to put pressure on them to pay a ransom via cryptocurrency."
Neuberger listed some of the actions taken by the Biden administration to combat cyber criminals, beginning with "equipping companies with cyber security practices."
And second, the administration has been dismantling cyber infrastructure used by criminals. The Justice and Defense departments have been conducting cyber operations around the world for this purpose. Neuberger also cited a partnership between the White House and 56 countries and entities like INTERPOL "to really tackle how cryptocurrency moves around the world and gets around money laundering controls."
In general, the administration advises all ransomware victims not to pay to retrieve their stolen data. Neuberger says doing so just incentivizes the next attack.
Neuberger said artificial intelligence is already at work to combat cybercrimes.
"What we really need to do is ensure that defense, we're using an AI-driven defense to stay as much as we can one step ahead of AI-driven offense," Neuberger told Garrett. "And if it's not one step ahead, it's at least very quickly behind, because what matters in cybersecurity is speed...We're always adjusting based on new offensive techniques, and then adjusting the defenses to ensure that the castle walls are high enough. We have some of the most exquisite capabilities in the world."
Her comments came as Washington was briefly consumed by news of a non-specific "serious national security threat" outlined by the House Intelligence Committee and later confirmed by the White House. A U.S. official told CBS the threat intelligence dealt with Russian capabilities in space. Neuberger was interviewed before the security threat was publicly referenced by GOP Rep. Michael Turner, chairman of the House Intelligence Committee, but she spoke broadly about Russian cyber and satellite capabilities and the threats they pose.
She said U.S. intelligence agencies have traced the origins of cybercrimes to Russia through IP (internet protocol) addresses and other forensic tracing methods. Russia's government has a general knowledge of criminal cyber activities originating within its borders.
"It varies generally, but Russian cybercrime is at done least with a winking knowledge of Russian intelligence services," Neuberger said, and referenced the May 2021 Colonial Pipeline cyber attack carried out by a group known as Dark Side that resides in Russia. At the time President Biden said Russia "[has] some responsibility to deal with this."
Executive producer: Arden Farhi
Producers: Jamie Benson, Jacob Rosen, Sara Cook and Eleanor Watson
CBSN Production: Eric Soussanin
Show email: TakeoutPodcast@cbsnews.com
Twitter: @TakeoutPodcast
Instagram: @TakeoutPodcast
Facebook: Facebook.com/TakeoutPodcast