Funding for program to stop next Stuxnet from hitting US expired Sunday

HELLFIRE

https://www.theregister.com/2025/07/22/lapsed_cisa_funding_cybersentry/

Government funding for a program that hunts for threats on America’s critical infrastructure networks expired on Sunday, preventing Lawrence Livermore National Laboratory from analyzing activity that could indicate a cyberattack, the program director told Congress on Tuesday. … It’s a public-private partnership, managed by CISA, that looks for malicious activity on IT and operational technology (OT) networks in America’s energy, water, healthcare, and other critical facilities. …

Regards

egeezer

HELLFIRE

Not a bit surprising, and is consistent with other cyber security actions.

urbanriot

HELLFIRE This seems like an important quote from the article:

“Funding agreements … are still making their way through DHS processes and our work with CISA expired last Sunday,” Gleason testified. “National labs are not legally able to operate without funding from a government agency, so our threat hunters stopped monitoring networks on Sunday.”

The sensors are still deployed, and still collecting information about traffic on these networks, “we just aren’t gathering the data that is coming in,” Gleason said.

Neither DHS nor CISA immediately responded to The Register’s inquiries about the funding, and if it would be renewed. We will update this story when we receive any responses.

I’d be interested to see what their funding requirements are and how many people are assigned to this task but that wasn’t listed in the article.

egeezer

urbanriot I’d be interested to see what their funding requirements are and how many people are assigned to this task but that wasn’t listed in the article.

I would expect the best cybersecurity experts would know what resources are needed for national security and critical infrastructure protection are needed, and would have issued a detailed report prior to ending funding.

However I haven’t been able to find such a report.

urbanriot

egeezer I would expect the best cybersecurity experts would know what resources are needed for national security and critical infrastructure protection are needed

Right but this is a government funded group that falls under the purview of an arm of the government so you would never have a realistic assessment of what’s needed, one side of the situation will max out their budget every year to ensure they always receive the same or more while the other side will one to prune the budget or at best maintain it.

A small handful of extremely capable people could easily do the job but it’s not easy finding extremely capable people in the world of cyber security, most people in IT security are faking it until they make it (or are found out).

TheRogueWolf

egeezer “Why spend money to stop Bad Thing when Bad Thing has never happened?”

egeezer

urbanriot Right but this is a government funded group that falls under the purview of an arm of the government

It is indeed, so the prudent thing to do would be for those on control of funding to do their homework first, then make cuts (or reallocations or additions if needed) based on independent analysis.

urbanriot

egeezer independent analysis.

That wouldn’t be necessary, the government can do a cost-benefit analysis and for all we know they did do their homework.

egeezer

urbanriot for all we know

Ah, that’s very comforting… 😉

Can’t wait to see the report.

urbanriot

well that’s the thing, we don’t know which is why I wrote above “I’d be interested to see” but that information wasn’t provided in the article for whatever reason.

I tried to google what this component of the “laboratory” funding was but no one has provided that information.

I did find that as a whole the entirety of the Lawrence Libermore National Laboratory’s budget is $2.8 billion dollars but it’s unclear what amount of that goes to this thread’s topic. However they also have private sector services they’ve profited from which makes this more complicated to discover.

egeezer

urbanriot
When doing cost benefit analysis for the service, a comprehensive risk analysis covering the military, critical infrastructure and national security apparatus that’s being served is necessary. Bean counters and those with no meaningful expertise in cybersecurity and risk management cutting (or increasing) budgets would not lead to good outcomes.

InternetJeff

When I had to submit budget inputs for programs I worked on in the Air Force, I had to provide detailed explanations to support, justify, and defend my budget needs.

In the DoD we use Zero Based Budgeting. Every POM cycle you have to build up your budget requirements from zero and literally justify your (program’s) existence. There is no skating by. It is incumbent on those with a budget requirement to illuminate and explain the need beyond question.

Outside of the DoD most budgeting is not Zero Based, but rather Baseline Budgeting, where you typically just take your last year’s/cycle’s budget and add some inflation.

IMO, almost all spending requirements should follow the Zero Based budget model. If your requirements are important, stand and deliver.

Somewhat-Reticent

Perhaps funding will be restored as soon as our Stuxnet attacks finish?

urbanriot

egeezer When doing cost benefit analysis for the service, a comprehensive risk analysis covering the military, critical infrastructure and national security apparatus that’s being served is necessary. Bean counters and those with no meaningful expertise in cybersecurity and risk management cutting (or increasing) budgets would not lead to good outcomes.

As someone with years of experience in cyber-security I wholeheartedly agree with you. But also with someone with years of experience in cyber-security, I can appraise the industry as being rife with people who are entirely useless to the cause and its typically one person out of a hundred who can actually deliver.

egeezer

urbanriot
In that case an independent analysis would provide the evidence to support such a claim.

You must have worked for some really bad employers. In my decades working with private and public sector IT security teams I only experienced that once, when I led a team to consolidate data centers that were being operated by the former Arthur Anderson consulting firm.

Objective analysis, not knee jerk reactions or “gut feelings” is the way to balance resources and manage risk.