CISA official says agency has not seen uptick in cyber threats amid Iran war

A top U.S. cybersecurity official said the government has not seen an increase in cyber threats from Iran since the U.S. and Israel started launching strikes across the country late last month.

Cybersecurity and Infrastructure Security (CISA) Acting Director Nick Andersen said the agency has been working closely with industry and sector-based groups on threats from Iran in the past couple of weeks.

“We’re seeing a steady state — we have not seen a rise in threat actor activity, which is fantastic, but again we can't take our eyes off,” Andersen told reporters on the sidelines of the McCrary Cyber Summit in Washington, D.C.

“Other adversaries continue to make maneuvers within this space, cybercriminal groups continue to make moves within this space — it’s not just about one nation state or one particular point of time.”

CISA and its regional personnel continue to work with medical device manufacturer Stryker in the wake of a March 11 cyberattack carried out by the Iran-linked hacking group Handala, Andersen said.

Cyberattacks harnessing artificial intelligence are particularly concerning, Andersen said during an on stage interview, citing what he called the “velocity problem.” CISA is working to shorten the timeline under which Common Vulnerabilities and Exposures (CVEs) have to be addressed, he said.

“It's really reducing that window that we're seeing where perhaps people have a week to two weeks to be able to address and publish CVEs… I just don't think that's the case anymore,” he said.

The agency is studying whether changes are needed, he said, and are focused on “what is the timeline associated with how we can prescribe action.”