The FBI has published its first ever Cyber Strategy, providing guidance on how the agency investigates and disrupts cyber threat actors.
The new document, published on September 9, highlights the need for strategic response to escalating cyber-attacks perpetrated by financially-motivated cybercriminals and state-sponsored actors, who often operate from jurisdictions that put them out of immediate reach of US law enforcement.
The new strategy appears to be part of a broader shift in strategy by the US government towards focusing on proactive disruption activities against cyber threat actors.
“With this strategy as our roadmap, the FBI will impose cost on cyber actors who target the United States through decisive action, rapid victim support, integrated partnerships and continuous investment in tools and capabilities. FBI Cyber will disrupt adversaries before they can act, expose them when they do and hold them accountable wherever they hide,” the FBI wrote.
Commenting on the FBI strategy document, Gabrielle Hempel, security operations strategist at Exabeam, said: “The emphasis on disruption over prosecution is an interesting shift. ‘Success’ in cybercrime enforcement has long been measured often by arrests that happen years later, if at all. Taking infrastructure offline, seizing money, burning access, exposing tradecraft, and forcing adversaries to rebuild can be operational wins. I like that the FBI is broadening what a successful takedown looks like.”
In August, President Trump signed a memorandum authorizing federal law enforcement agencies to collaborate with private firms in conducting offensive cyber strikes on foreign threat actors targeting the US.
A Four-Pronged Strategy
The Cyber Strategy contains the following four pillars:
Investigate, Disrupt, and Impose Cost on Cyber Adversaries
In this pillar, the document sets out how the FBI seeks to disrupt and impose costs on cyber adversaries that target the US.
It described how different cyber threat teams within its cyber workforce work together for this purpose. This starts with identifying threats and alerting victims if their network has been compromised.
The next stage is launching operations to disrupt adversaries, including dismantling adversary infrastructure, seizing stolen cryptocurrency, disrupting nation-state intrusion campaigns and taking down pervasive ransomware variants.
The FBI said it uses a “best athlete” model to ensure it partners with the strongest authority, access or capability leads the relevant phase of an operation.
Support Victims
The FBI detailed a range of methods it uses to help victims respond and recover from cyber-attacks. This includes rapid sharing of threat intelligence with organizations that are being targeted and the agency aims to deploy automated indicator-sharing mechanisms to speed up this process.
The FBI said it aims to quickly engage victims when cyber incidents occur and support their containment and recovery efforts. This is especially important for critical infrastructure, and the agency is expanding its Industrial Control Systems (ICS) Coordinator program to designate dedicated personnel in every field office.
Increase Impact Through Partnerships
The FBI said it is committed to expand and deepen relationships throughout government, international allies and across the private sector to support its objectives. This includes building systems and process to quickly share actionable intelligence with these partners.
The agency added that it will expand engagement with the private sector through three programs – CISO Academy, Cyber Executive Summits and The Leadership in Cyber (LinCY) program.
Enhance FBI’s Cyber Capabilities
This pillar discusses the FBIs efforts to recruit and retain top cyber talent and implement new technical tools and techniques, including AI.
The agency will provide technical and operational training across its cyber workforce through its Cyber Education and Training Unit (CETU).
The FBI has also committed to deploy AI-enabled tools that support activities such as triaging large datasets, accelerate malware analysis, prioritize victim notifications, map adversary infrastructure and support attribution.
Image credit: Poetra.RH / Shutterstock.com