We’re Tracking the Future of Security

Tag: critical infrastructure

  • TSA Audit Finds Access-Control Gaps Across Sensitive IT Systems

    TSA Audit Finds Access-Control Gaps Across Sensitive IT Systems

    The Transportation Security Administration needs stronger controls over who can access sensitive information technology systems, according to a Department of Homeland Security Office of Inspector General report dated September 29. The audit examined account governance, privileged access and the removal of access when personnel leave the agency.

    The inspector general reported weaknesses in approval documentation for privileged accounts, annual access reviews and timely deprovisioning for separated personnel. These are administrative controls, but they directly affect whether technical safeguards can reliably enforce the agency’s intended access policy.

    Five Recommendations Issued

    The report made five recommendations intended to strengthen account authorization, recurring reviews, evidence retention and offboarding. TSA concurred with all five, according to the audit. The agency also described corrective work, including a ServiceNow-based process introduced in July 2026 to improve account management and review workflows.

    Because parts of the report are redacted, the public document does not expose detailed system configurations. It nevertheless provides a clear governance lesson: access-control effectiveness depends on current identity records, documented approvals and prompt revocation, not only on authentication technology.

    Why the Findings Matter Beyond TSA

    Transportation organizations increasingly connect operational, administrative and physical-security systems. A stale or over-privileged account can therefore become a pathway to sensitive data or systems that support real-world operations. Mature programs link human-resources events, identity governance and technical enforcement so that role changes and departures trigger predictable access updates.

    Security teams can apply the same principles by inventorying privileged accounts, assigning accountable owners, retaining approval evidence and testing offboarding with measurable service targets. Independent review should verify that the documented procedure produces the expected result in live systems. Exceptions should have named owners, expiry dates and documented compensating controls.

    The findings also reinforce the connection between cyber and physical risk discussed in SectechMedia’s cyber-physical security convergence guide.

    Sources

  • Hegseth Orders Pentagon to Treat Counter-Drone Approval Delays as “Operational Risk”

    Hegseth Orders Pentagon to Treat Counter-Drone Approval Delays as “Operational Risk”

    Defense Secretary Pete Hegseth has signed a memorandum ordering the Pentagon to treat bureaucratic delays in fielding counter-drone technology as an operational risk, aiming to clear procedural bottlenecks that have slowed deployment of systems meant to protect U.S. military bases, critical infrastructure and other domestic assets from unmanned aircraft threats, DefenseScoop reported on October 2.

    The five-page directive, dated September 28 and titled “Project Agincourt: Pathway to the Autonomous Warfare Command,” was publicly released the following Friday. “The Department will take down barriers so our warfighters can take down drones,” Hegseth wrote in the memo.

    What the Directive Changes

    The memo targets specific administrative chokepoints that have historically slowed counter-drone hardware and software adoption, including radio spectrum and frequency authorization delays and lengthy safety review processes. Review and approval authorities are now required to treat any delay in processing counter-drone requests as an operational risk rather than routine paperwork.

    Hegseth directed the Pentagon’s chief information officer to review, within 30 days, how DoD components submit counter-UAS spectrum requests to interdepartmental spectrum authorities and to recommend ways to speed approval — work that will feed into the Defense Innovation Unit’s “Project Spectrum Strike” effort. Separately, the department’s chief digital and AI officer was told to coordinate with the CIO, the Office of General Counsel, the Defense Information Systems Agency, U.S. Cyber Command, and the military services to build a single, department-wide approval process that cuts authority-to-operate timelines for tested, validated counter-drone systems from months down to days or weeks.

    JIATF-401 as the Enforcement Backbone

    The directive functions as an enforcement mechanism for Joint Interagency Task Force 401, the Pentagon’s lead counter-drone coordination body, which Hegseth designated as the department’s “synchronization point” for counter-UAS employment across the military services, combatant commands and interagency partners. Under the memo, JIATF-401 becomes the repository for technical data, common hazard assessments, approved mitigation measures and threat intelligence used in all counter-UAS weapon safety reviews.

    Army Lt. Col. Adam Scher, a JIATF-401 spokesperson, told DefenseScoop that the task force “is taking aggressive action to streamline bureaucratic approvals and remove barriers that delay lawful, safe, and effective counter-drone operations,” adding that “JIATF-401 will not accept a slow-moving bureaucracy when faced with a fast-moving threat.”

    Why It Matters

    The directive arrives amid mounting drone incursions over U.S. installations and escalating cartel-linked drone activity along the southern border, pressures that have already driven JIATF-401’s Falcon Peak test series — including its most recent iteration at Yuma Proving Ground — and a pending move toward urban-environment counter-drone demonstrations. By explicitly reframing spectrum and authorization delays as risk rather than process, the memo signals that acquisition speed, not just new hardware, is now a formal Pentagon priority for close-in drone defense.

    • Memo: “Project Agincourt,” signed September 28, 2026, released October 2
    • Key fixes: Spectrum/frequency authorization review (30-day CIO review); single department-wide ATO process targeting days-to-weeks timelines
    • Lead body: Joint Interagency Task Force 401 (JIATF-401), designated as the department’s synchronization point

    Source: DefenseScoop, “Hegseth issues new directive to hasten U.S. military’s counter-drone pursuits,” October 2, 2026. Confidence: DIRECT.

    Sources and Further Reading

  • U.S. Army Awards Up to $7 Billion in Counter-Drone Contracts to 10 Companies Under Domestic Shield

    U.S. Army Awards Up to $7 Billion in Counter-Drone Contracts to 10 Companies Under Domestic Shield

    The U.S. Army has awarded 10 companies a combined contract ceiling of up to $7 billion for counter-drone technologies, Joint Interagency Task Force 401 (JIATF-401) announced September 29, expanding a multi-vendor acquisition strategy intended to field layered defenses against small unmanned aircraft systems (sUAS) across military installations and other priority facilities in the United States.

    The awards were made as multiple-award indefinite-delivery/indefinite-quantity (IDIQ) contracts supporting Domestic Shield, a Department of War initiative to improve counter-UAS (C-UAS) protection for risk-prioritized facilities and assets, according to the Army’s public affairs office. The contracts also feed JIATF-401’s broader C-UAS Marketplace, an online catalog that lets military and other government customers compare vendor performance data before procurement.

    Ten Vendors, a Range of Capabilities

    According to the Army, confirmed by Breaking Defense, the base contract ceilings awarded are: Allen Control Systems Inc. ($500M), Digital Force Technologies LLC ($500M), DroneShield LLC ($500M), Echodyne Corp. ($250M), Napatree Technology LLC ($500M), PVP Advanced EO Systems Inc. ($250M), RADA Technologies LLC ($500M), SmartShooter Inc. ($150M), SRC Inc. ($500M), and L3Harris WESCAM ($500M).

    The Army said the contracts cover the full detect-track-identify-defeat kill chain, spanning compact radar systems, long-range tracking cameras, electronic countermeasures, automated robotic weapon stations, and smart optical scopes that let individual soldiers engage drones with standard rifles. The service did not specify which technologies each vendor will supply under the vehicle, leaving that to be determined through individual task orders as requirements emerge.

    Avoiding Vendor Lock-In

    Brent G. Ingraham, assistant secretary of the Army for acquisition, logistics and technology, framed the multi-vendor structure as a deliberate rejection of single-source dependency. “This multi-vendor marketplace enforces strict open architecture standards, breaking proprietary vendor lock and ensuring new technologies can immediately integrate into our existing defense networks,” Ingraham said. “By driving continuous competition among both prime vendors and non-traditional commercial innovators, we are securing the best value for the American taxpayer and ensuring our warfighters remain ahead of our adversaries.”

    Brig. Gen. Matt Ross, director of JIATF-401, said the approach is designed for speed as much as choice. “JIATF-401 is continuously working with the military services to provide the counter-UAS capabilities needed to protect warfighters and installations,” Ross said. “Our approach allows us to identify the right capabilities for specific operational requirements and rapidly deliver those capabilities to the warfighter.”

    Part of a Bigger Build-Out

    The awards are the latest in a steady cadence of Domestic Shield contracting actions this year, following prior task orders to vendors including AeroVironment, which separately received a three-year, $500 million IDIQ to supply C-UAS capabilities under the same program. JIATF-401, established roughly 18 months ago, has said it has compiled a “global priorities list” of installations requiring upgraded drone defenses, running into the hundreds. The flow of IDIQ awards signals the Pentagon is moving counter-UAS procurement from pilot-scale testing toward enterprise-scale, multi-vendor fielding — a shift that domestic security integrators, airports, and critical-infrastructure operators watching the counter-drone market closely will likely see mirrored in adjacent civilian procurement in the coming budget cycle.

    Source: U.S. Army press release, September 29, 2026, corroborated by Breaking Defense. Confidence: DIRECT.

    Sources and Further Reading

  • FSRI Report Examines Systems Behind 2025 Southern California Fire Losses

    FSRI Report Examines Systems Behind 2025 Southern California Fire Losses

    The Fire Safety Research Institute (FSRI) has released a systems-level analysis of the January 2025 Palisades and Eaton fires in Southern California. Commissioned after the disaster, the report examines how preparedness, infrastructure, evacuation, emergency operations and the built environment interacted during fast-moving community conflagrations.

    Analysis identifies interconnected pressures

    FSRI’s report contains 175 findings and 266 recommendations. Its evidence base includes technical discussions with responders and subject-matter experts, resident interviews and surveys, site assessments, geospatial analysis, radio communications, dispatch records and vehicle-location data.

    The institute says the outcomes were shaped by the combined performance of multiple systems rather than one point of failure. Areas examined include emergency management, water and electric utilities, weather and vegetation, evacuation warnings, transportation, fire and law-enforcement operations, fatalities and building conditions.

    Recommendations extend beyond one incident

    The recommendations address community-scale wildfire mitigation, readiness for wind-driven conflagrations, situational awareness, infrastructure resilience, evacuation coordination, interoperable communications, wildfire-resistant construction, suppression strategy and post-suppression monitoring. That systems approach matters because extreme fire conditions can exceed assumptions built into otherwise well-established preparedness programs.

    For public-safety and critical-infrastructure teams, the report provides a structured basis for reviewing dependencies between warning systems, communications, utilities and field operations. SectechMedia’s fire and safety coverage tracks technologies and operational practices used to improve detection, response and resilience.

    Sources

  • Alleged Iranian State-Linked Hacker Extradited to US Over University Breaches

    Alleged Iranian State-Linked Hacker Extradited to US Over University Breaches

    Montenegro has extradited Amir Barati, a dual Turkish-Iranian national, to the United States to face charges tied to a long-running campaign of breaches against universities, research institutions and government entities. Montenegrin authorities arrested Barati on June 25 while he was in the coastal town of Kotor, acting on an FBI arrest warrant, and a Montenegrin court approved his extradition under a simplified procedure.

    A campaign prosecutors trace to 2013

    US prosecutors allege Barati is a member of the Mabna Institute, an Iran-based entity accused of running cyberattacks on behalf of Iran’s Islamic Revolutionary Guard Corps. An August indictment named Barati among 17 people charged in a 14-count case connected to breaches at more than 150 US universities and other research institutions, with authorities estimating stolen academic data, intellectual property and related losses at roughly $3.4 billion.

    A rare extradition for an alleged state-linked operator

    Extraditions of individuals accused of acting on behalf of Iranian state interests remain uncommon, making Barati’s case notable regardless of the eventual trial outcome. For research institutions, the case underscores that nation-state-linked actors continue to treat university networks as a long-term espionage target rather than a one-time opportunity, an assessment that shapes how security intelligence teams prioritize monitoring of research data hosted on campus networks.

    Sources and further reading

  • Osavul Raises $10 Million to Detect Hostile Intent Across Cyber and Physical Domains

    Osavul Raises $10 Million to Detect Hostile Intent Across Cyber and Physical Domains

    Hybrid risk intelligence company Osavul has raised $10 million (€8.5 million) in a Series A round led by 33N Ventures, with participation from Balnord, G+D Ventures and existing investor 42CAP. The round, announced October 1, brings the Luxembourg-based company’s total funding to roughly €12 million.

    Reading hostile intent across three domains

    Osavul’s AI platform analyzes open and privileged data sources to identify hostile intent spanning the information, cyber and physical domains, rather than treating them as separate disciplines handled by separate teams. The company, which counts NATO and other defense and government institutions among its customers, says it maps identified intent against a customer’s own people, facilities and supply chains to show where a strike could land.

    Part of a wider funding trend

    Osavul says it has tracked more than 150 state-linked hybrid incidents across Europe since 2022, combining cyberattacks, sabotage, espionage and information manipulation, and plans to use the new funding to expand from government and defense work into enterprise and critical-infrastructure customers. The raise adds to a run of early-stage funding for platforms that promise a single risk picture spanning categories security teams have traditionally monitored with separate tools.

    Sources and further reading

  • Warlock Ransomware Group Expands SharePoint Attacks on Critical Infrastructure

    Warlock Ransomware Group Expands SharePoint Attacks on Critical Infrastructure

    The China-nexus threat group behind the Warlock ransomware strain is continuing to break into organizations through Microsoft SharePoint vulnerabilities, according to a new Symantec Threat Hunter Team report. Symantec, which tracks the group as Longlegs (also known as Storm-2603), says at least four victims in Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America were compromised over the past two months, including a water utility, a telecommunications provider, a university and a regional government.

    SharePoint remains the preferred entry point

    The campaign builds on the “ToolShell” SharePoint flaws that brought Warlock to prominence in 2025. Symantec’s researchers say the group’s current toolkit also draws on newer SharePoint vulnerabilities, including CVE-2026-32201 and CVE-2026-45659 among others, suggesting the operators are rotating through unpatched flaws rather than relying on a single exploit chain. The first observed activity in the latest wave traces to a webshell planted on a victim’s SharePoint server in July.

    Why critical infrastructure keeps getting hit

    Water utilities and telecommunications providers remain attractive targets for ransomware operators because SharePoint deployments inside these organizations are frequently internet-facing and slow to patch, a pattern Symantec’s data continues to confirm. The campaign is a reminder that cyber-physical security programs covering utilities and regional government networks need continuous SharePoint patch verification, not a one-time response triggered only when a named vulnerability makes headlines.

    Sources and further reading

  • CISA Launches 2026 Cybersecurity Campaign Focused on Critical Infrastructure

    CISA Launches 2026 Cybersecurity Campaign Focused on Critical Infrastructure

    The US Cybersecurity and Infrastructure Security Agency has opened Cybersecurity Awareness Month 2026 with a campaign aimed at turning security awareness into operational resilience. Released on October 1 under the theme Securing the Next 250, the initiative places particular emphasis on organizations that own, operate or support critical infrastructure.

    Guidance moves from basic hygiene to continuity

    CISA’s starting points remain familiar: train employees to recognize phishing, require strong and unique passwords, use multifactor authentication and keep software updated. The agency then extends the checklist to logging, tested backups, encryption, incident reporting and rehearsed response plans.

    The 2026 material adds explicit attention to disruption planning. Organizations are encouraged to identify how mission-essential functions could continue when critical systems or even internet access are unavailable. That turns an awareness campaign into a practical continuity exercise rather than a collection of security slogans.

    Critical-infrastructure teams can use the month as a control review

    CISA frames its infrastructure guidance around three actions: reduce attack surfaces, replace end-of-support devices and recover quickly enough to sustain operations. These are recommendations rather than evidence that any individual organization has met a security standard, so owners should translate them into measurable local work: asset inventories, accountable remediation dates, recovery objectives and exercises involving technical, legal and operational leaders.

    The National Cybersecurity Alliance, which co-leads the wider annual campaign, likewise emphasizes strong authentication, software updates and recognizing suspicious activity. For operators, the useful test is whether those behaviors are embedded in routine maintenance and incident procedures after October ends. Related operational-security coverage is available in SectechMedia’s cyber-physical security channel.

    Sources

  • CISA Details High-Risk Flaws in Malcolm Network Analysis Platform

    CISA Details High-Risk Flaws in Malcolm Network Analysis Platform

    CISA has published advisory ICSA-26-254-01 covering multiple vulnerabilities in Malcolm network analysis platform releases earlier than v26.06.0. The advisory, dated October 1, assigns a maximum CVSS v3 base score of 8.8 and recommends moving to an appropriate September 2026 or later release.

    Broad weakness classes increase review scope

    The reported issues span cross-site scripting and open redirect, command injection, path traversal, server-side request forgery, authentication and authorization flaws, default credentials, improper certificate validation, a vulnerable dependency, and weak password hashing. This breadth means remediation planning should account for more than a single defect or attack path.

    CISA identifies Energy, Information Technology, and Water and Wastewater Systems as affected sectors and describes deployment as worldwide. Because Malcolm supports network analysis, weaknesses in the platform can be relevant to teams overseeing monitoring infrastructure and the larger cyber-physical security domain. The advisory facts do not establish exploitation, and organizations should avoid treating severity alone as evidence of compromise.

    Upgrade and exposure-reduction priorities

    CISA recommends updating to the latest September 2026 or later release. It also advises normal safeguards around network exposure, segmentation, access control, and monitoring. Operators should first identify deployed Malcolm versions and confirm the correct upgrade path for their environment, then review exposure and privileged access while the update is planned. Monitoring before and after remediation can help teams detect anomalous activity and verify that defensive controls continue to operate as intended.

    Sources and further reading

  • DIVD Says Zammad Zero-Days Enabled an AI-Driven Network Breach

    DIVD Says Zammad Zero-Days Enabled an AI-Driven Network Breach

    DIVD disclosed on September 30 that two Zammad zero-days were used in a September 21 breach. Its investigation remains ongoing, so the account should be treated as preliminary. DIVD said an AI agent chained the flaws within seconds, while network segmentation limited further movement inside the affected environment.

    Two vulnerabilities with different roles

    CVE-2026-102489 can allow session hijacking followed by remote code execution as the zammad service user. It affects versions 6.3.0 through 6.5.4. The issue is also present in 7.0.0 through 7.1.3, but the supplied record says it is not exploitable there under the stated environmental conditions. Its reported CVSS score is 9.4.

    CVE-2026-102490 can allow a local zammad user to escalate privileges to root. It affects releases from 1.5.0 to before 7.1.0-alpha, and reporting described all released versions at disclosure as affected. Its reported CVSS score is also 9.4. Together, the issues illustrate why application-layer weaknesses can matter to the wider cyber-physical security landscape.

    Response while guidance develops

    Operators should follow current Zammad and DIVD guidance and apply a fixed release when one becomes available. While the investigation and remediation advice continue to evolve, isolating vulnerable systems can reduce exposure. The reported use of an AI agent is based on DIVD’s preliminary incident account; it should not be generalized into a broader claim about attacker capability or automation. Defenders should focus on the verified vulnerability boundaries, access paths, segmentation, and observable evidence in their own environments.

    Sources and further reading