Threat Actors Research Articles

Adaptive Ransomware Detection Using Similarity-Preserving Hashing

Crypto-ransomware is a type of ransomware that encrypts the victim’s files and demands a ransom to return the files. This type of attack has been on the rise in recent years, as it offers a lucrative business model for threat actors. Research into developing solutions for detecting and halting the spread of ransomware is vast, and it uses different approaches. Some approaches rely on analyzing system calls made via processes to detect malicious behavior, while other methods focus on the affected files by creating a file integrity monitor to detect rapid and abnormal changes in file hashes. In this paper, we present a novel approach that utilizes hashing and can accommodate large files and dynamically take into account the amount of change within each file. Mainly, our approach relies on dividing each file into partitions and then performing selective hashing on those partitions to rapidly detect encrypted partitions due to ransomware. Our new approach addresses the main weakness of a previous implementation that relies on hashing files, not file partitions. This new implementation strikes a balance between the detection time and false positives based on the partition size and the threshold of partition changes before issuing an alert.

Enhancing Cybersecurity through AI-Powered Security Mechanisms

In the rapidly evolving landscape of digital technology, the proliferation of interconnected systems has brought unprecedented opportunities and challenges. Among these challenges, the escalating frequency and sophistication of cyberattacks pose significant threats to individuals, organizations, and nations. In response, the fusion of Cybersecurity and Artificial Intelligence (AI) has emerged as a pivotal paradigm, offering proactive, intelligent, and adaptable defense mechanisms. This research explores the transformative impacts of AI-powered security on cybersecurity, demonstrating how AI techniques, including machine learning, natural language processing, and anomaly detection, fortify digital infrastructures. By analyzing vast volumes of data at speeds beyond human capacity, AI-driven cybersecurity systems can identify subtle patterns indicative of potential threats, allowing for early detection and prevention. The exploration consolidates existing studies, highlighting the trends and gaps that this research addresses. Expanded results and discussions provide a detailed analysis of the practical benefits and challenges of AI applications in cybersecurity, including case studies that offer concrete evidence of AI's impact. Novel contributions are emphasized through comparisons with other studies, showcasing improvements in accuracy, precision, recall, and F-score metrics, which demonstrate the effectiveness of AI in enhancing cybersecurity measures. The synergy between AI and human expertise is explored, highlighting how AI-driven tools augment human analysts' capabilities. Ethical considerations and the "black box" nature of AI algorithms are addressed, advocating for transparent and interpretable AI models to foster trust and collaboration between man and machine. The challenges posed by adversarial AI, where threat actors exploit AI system vulnerabilities, are examined. Strategies for building robust AI security mechanisms, including adversarial training, model diversification, and advanced threat modeling, are discussed. The research also emphasizes a holistic approach that combines AI-driven automation with human intuition and domain knowledge. As AI continues to rapidly evolve, a proactive and dynamic cybersecurity posture can be established, bolstering defenses, mitigating risks, and ensuring the integrity of our increasingly interconnected digital world.

Planning and Preparation of Cybersecurity

In today's digital environment characterized by fast-evolving adversaries, expanded attack surfaces, and complex IT environments, having a formidable plan and being prepared could create a world of difference when faced with a potential cyber-attack. Cyber threats are growing risks to everyone and any institution. Cybercriminals target individuals and companies of all sizes. Today's attacks are agile and sophisticated. Ransom demands are elevating and advancing rapidly while attackers drill down their focus to specific victims like critical infrastructure businesses, which can spend millions of dollars in losses from cyber disasters since such companies have less tolerance for downtime. The evolution of artificial intelligence technology, which is more interesting and scarier at the same time, is impacting the field of cybersecurity. The negative side of AI is that it has enabled threat actors to blend new data theft-based extortion techniques into ransomware. Attackers can steal companies' sensitive data or even encrypt the data and demand ransom for the decryption key failure, to which they threaten the company to expose the data to the public or even trade in the dark web. The intelligent techniques and tactics utilized by threat actors are a clarion call for organizations to proactively plan and prepare adequately by developing a cybersecurity strategy as a countermeasure. A cybersecurity strategy is a comprehensive plan that stipulates an organizational approach to secure its IT infrastructure against cyber threats. The common cybersecurity strategy various organizations use to plan and prepare for inevitable attacks is the incidence response plan. Incidence response is the processes and technologies organizations use to detect and respond to cyber threats, security breaches, or cyberattacks within an organization. Developing and implementing a formal incident response plan allows organizations to minimize and prevent damage. This research paper focuses on the primary goal of the incident response of preventing cyberattacks prior to occurring and reducing the cost and business disruption emanating from cyberattacks that happen. Keywords – incident response, threats, Artificial intelligence, cybersecurity, threat attacks, plan, preparation.

The Future of Cyber Threat Intelligence: Anticipating and Preparing for Evolving Threats

Modern cybersecurity protocols face unprecedented hurdles from the dynamic cyber threat ecology. In this context, the value of cyber threat intelligence as a prophylactic protective strategy increase (Abu, Selamat, Ariffin , & Yusof, 2018). This study provides a futuristic analysis of cyber threat intelligence, emphasizing the vital role that it will play in anticipating and becoming ready for evolving threats. This article also looks at threat actor methods, attack paths, and emerging technologies in an attempt to illustrate the dynamic nature of cyber threats and the need for adaptive intelligence solutions (Abu, Selamat, Ariffin , & Yusof, 2018). Ethical and legal considerations are also explored to highlight the necessity for a thorough and responsible approach to the gathering and implementation of cyber threat intelligence (Wagner, 2019). Through this thorough examination, readers will get a substantial comprehension of the technical developments and strategic requirements that will impact how cyber threat intelligence is developed (Abu, Selamat, Ariffin , & Yusof, 2018) (Wagner, 2019). This will provide enterprises with the agility and resilience to predict, mitigate, and respond to future cyber-attacks.

Emerging Challenges and New Responses, Building Capabilities to Counter Threats in Cyberspace

Cyberspace phenomena are changing rapidly at international and national levels. Growing threats, new vulnerabilities and protection against them require continuous action at the level of the EU, NATO and national competent authorities and organisations. Adequate protection of critical infrastructure and cyberspace is a vital strategic, operational and technical challenge for the EU, NATO and therefore nations. Cross-border impacts, threat actors and malicious actions require coordination of international and national procedures, mechanisms and cooperation. This article presents the most important phenomena and trends experienced today, as well as EU and NATO initiatives and requirements at the strategic level, illustrating what changes can be expected in cybersecurity.

Comprehensive review of smart city cybersecurity strategies

With cities rapidly advancing technologically, the rise of smart cities brings innovative solutions to urban challenges. However, this integration of technologies within urban infrastructures introduces new cybersecurity risks. This review explores the cybersecurity issues that smart cities face and discusses strategies to address these threats. Smart cities rely on interconnected networks of devices and systems to enhance efficiency, sustainability, and citizen services. Yet, this connectivity also creates a complex environment that is vulnerable to cyberattacks. A key concern is the wide array of IoT devices deployed across smart city infrastructures, which often lack robust security mechanisms, making them susceptible to exploitation by cybercriminals. The interconnected nature of these systems heightens the potential impact of cyberattacks, posing significant risks to critical infrastructure, public safety, and privacy. Threat actors can exploit vulnerabilities in interconnected systems, disrupting essential services, manipulating data, or even causing physical harm. Since smart cities heavily depend on data-driven decision-making, ensuring data integrity and confidentiality is a top priority. To mitigate these risks, various cybersecurity strategies have been proposed and implemented. These include technical solutions, regulatory frameworks, and collaboration among stakeholders. Technical measures like encryption, authentication mechanisms, intrusion detection systems, and secure software development practices are essential. Additionally, strong access controls and network segmentation can limit the scope of potential attacks. Regulatory initiatives also play a crucial role in improving cybersecurity standards and ensuring compliance among stakeholders. Establishing clear guidelines for data protection, privacy rights, and incident response protocols is vital for safeguarding citizens' interests. Collaborative efforts between government agencies, the private sector, academia, and cybersecurity experts are crucial in sharing information and collectively defending against emerging threats. Securing smart cities requires a comprehensive approach that integrates technical measures, regulatory frameworks, and collaborative efforts to create a resilient and secure urban environment for all citizens. Keywords: Cybersecurity, Smart City, AI, Technology, Security.

Redefining cyber resilience : Through the risk register lens

Resilience is deeper than maintaining a company’s operations and services in the face of significant disruptions. It is the ability of a business to withstand, pivot and continue to grow in the face of a significant threat. To achieve resilience, companies must have an integrated, end-to-end understanding of how a specific threat magnifies the risks identified on their risk register, and what measures are needed across the enterprise to address the amplification of those risks. This paper details how the need for a holistic approach is especially important for cyber crises, compared with other types of crises, because they tend to have more broad-ranging impacts and complexities, such as: unclear timelines, lack of public empathy, unpredictable human threat actor(s), as well as a broader set of internal and external stakeholders that need to be engaged. Unlike other crises, cyber crises have the potential to magnify most — if not all — of the risks on the risk register. As such, cyber resilience requires ensuring that key stakeholders, whether shareholders, customers, regulators, business partners, employees, etc, stay resolute in their faith in a company and its leadership’s ability to navigate the increasingly complex issues related to cyber risks and how these issues are addressed enterprise-wide, not purely seen through the lens of technical or operational resilience. To achieve cyber resilience, organisations must develop and implement programmes that integrate both the technical and the broader business measures needed to limit fallout, demonstrate leadership through cyber crises, and deepen trust regardless of the potential severity of the impact.

Risks to cybersecurity from data localization, organized by techniques, tactics and procedures

ABSTRACT The risks of data localization to cybersecurity – organizational effects”, we provided a framework for the risks of data localization to cybersecurity, finding that 13 of 14 ISO 27002 controls would be negatively affected by the localization of personal data. This paper complements that analysis, focusing on the techniques, tactics and procedures (TTPs) of threat actors and defenders. Using the ENISA Guidelines and the MITRE ATT&CK Framework as authoritative approaches for cataloguing relevant TTPs, we highlight three important tactics that defenders use for cybersecurity purposes – threat hunting; privilege-escalation attack; and red teaming/pen testing. These three categories, considered essential to a mature cybersecurity programme, would routinely require cybersecurity defenders to access personal data that would be restricted by current data localization laws and proposals. The paper then provides a quantitative model illustrating the effects of data localization, finding that halving the number of IP addresses available to a defender would more than double the likely time until a new attack was detected. The paper concludes by noting that until and unless the proponents of localization address the unintended effects of data localization, scholars, policymakers and practitioners have strong reason to expect significant cybersecurity harms from hard localization requirements.

Health Data Re-Identification: Assessing Adversaries and Potential Harms.

Sharing biomedical data for research can help to improve disease understanding and support the development of preventive, diagnostic, and therapeutic methods. However, it is vital to balance the amount of data shared and the sharing mechanism chosen with the privacy protection provided. This requires a detailed understanding of potential adversaries who might attempt to re-identify data and the consequences of their actions. The aim of this paper is to present a comprehensive list of potential types of adversaries, motivations, and harms to targeted individuals. A group of 13 researchers performed a three-step process in a one-day workshop, involving the identification of adversaries, the categorization by motivation, and the deduction of potential harms. The group collected 28 suggestions and categorized them into six types, each associated with several of six distinct harms. The findings align with previous efforts in structuring threat actors and outcomes and we believe that they provide a robust foundation for evaluating re-identification risks and developing protection measures in health data sharing scenarios.

Data Exfiltration Anomaly Detection on Enterprise Networks using Deep Packet Inspection

Advanced persistent threats (APT) are threat actors with the advanced Technique, Tactic and Procedure (TTP) to gain covert control of the computer network for a long period of time. These threat actors are the highest cyber attack risk factor for enterprise companies and governments. A successful attack by the APT threat Actors has the capabilities to do physical damage. APT groups are typically state-sponsored and are considered the most effective and skilled cyber attackers. The final goal for the APT Attack is to exfiltrate victims data or sabotage system. This aim of this research is to exercise multiple Machine Learning Approach such as k-Nearest Neighbors and H20 Deep Learning Model and also employ Deep Packet Inspection on enterprise network traffic dataset in order to identify suitable approaches to detect data exfiltration by APT threat Actors. This study shows that combining machine learning techniques with Deep Packet Inspection significantly improves the detection of data exfiltration attempts by Advanced Persistent Threat (APT) actors. The findings suggest that this approach can enhance anomaly detection systems, bolstering the cybersecurity defenses of enterprises. Consequently, the research implications could lead to developing more robust strategies against sophisticated and covert cyber threats posed by APTs.

APT-scope: A novel framework to predict advanced persistent threat groups from enriched heterogeneous information network of cyber threat intelligence

Addressing the expanding Advanced Persistent Threat (APT) landscape is crucial for governments, enterprises and threat intelligence research groups. While defenders often rely on tabular formats for assets like logs, alerts, firewall rules; attackers leverage a graph-based mindset. In this work, we propose a novel multistage framework named APT-Scope which employs a comprehensive approach to Cyber Threat Intelligence (CTI) analysis on qualified real-world data. APT-Scope workflow consists of data gathering, enrichment, and analysis stages, where relationships between entities are used to construct a Heterogeneous Information Network (HIN). We applied CTI enrichment using additional active data collection techniques like DNS and Whois lookups, port scans, SSL footprinting, named entity recognition via SpaCy, and constructed a machine learning pipeline to predict relationships between entities using FastRP and Logistic Regression. By analyzing the resulting HIN, we discovered aliases for APT groups and predicted threat actors of APT attacks with unknown perpetrators. We observed AUCPR metrics as train score = 96.57% and test score = 92.36%. Our work is beneficial to oversee the entire APT landscape, steer ongoing and future CTI operations and make strategic decisions.

Charting new waters with CRAMMTS: A survey-driven cybersecurity risk analysis method for maritime stakeholders

This article presents a novel survey-based cybersecurity risk assessment model, CRAMMTS (Cyber Risk Analysis Method for Maritime Transportation Systems), specifically designed for the maritime sector, addressing a critical gap in the literature. Our study contributes significantly in three ways: firstly, through a comprehensive critical literature review of 31 maritime guidelines and 95 scholarly articles, identifying the need for a new cybersecurity risk assessment method; secondly, by developing CRAMMTS, an adaptation of the ISRAM risk analysis method, incorporating the International Maritime Organization's criteria and enabling participation from maritime professionals, especially policymakers and leaders. The third contribution is a case study, the practical application of CRAMMTS in surveying 80 maritime professionals, assessing their perception of cybersecurity risks, and identifying varying risk levels, with the highest associated with cyber threat actors. This approach proved effective in assessing risks at both tactical and strategic levels and providing a clear, quantitative risk metric for decision-making. Our research underscores the maritime sector's need for a holistic, easily implementable cybersecurity risk analysis method that engages leaders and adapts to various Maritime Transportation System scopes, thereby enhancing cybersecurity risk assessment in this crucial domain.

Integrated model to optimize supplier selection and investments for cyber resilience in digital supply chains

Digitalization has revolutionized the supply chain networks but also introduces vulnerabilities to the cyber threats. Notably, in past two years, the cyber-attacks on different organizations worldwide have increased at an alarming rate resulting in significant financial loss to supply chains, intellectual property breaches and supply disruptions. As a result, companies are making significant investments in their cybersecurity. However, many incidents were reported where threat actors attacked a company using the shared digital systems with its suppliers. Therefore, it is important that suppliers are selected based on their cyber resilience. This paper identifies the cyber resilience criteria and proposed a multi criteria decision making based framework to evaluate the cyber resilience of a supply chain partner. It has been also realized that investment in organizational cybersecurity alone is not sufficient to protect supply chains. Companies are now investing in increasing their supply chain cyber capabilities. In this direction, paper also proposes a mixed integer linear program (MILP) to jointly optimize supplier selection and cyber investment decisions in a supply chain based on the supplier's current cyber resilience and potential return on the cyber investments made in selected suppliers. Computational experiments are conducted to study the tradeoffs and impact of sourcing strategy, supplier capacity, cyber security investment decisions on supply chain cyber resilience. The findings underscore that an integrated decision making of supplier selection and cyber investments maximizes the supply chain cyber resilience.

Survey-based analysis of cybersecurity awareness of Turkish seafarers

In recent years, vessels have become increasingly digitized, reflecting broader societal trends. As a result, maritime operations have become an attractive target for cyber threat actors. Despite the limited cybersecurity training seafarers receive, they are expected to operate within technologically advanced environments. The importance of cybersecurity awareness is evident, but the extent of seafarers’ knowledge in this area remains uncertain. This article investigates three primary aspects: (1) the current state of cybersecurity onboard cargo vessels, (2) seafarers’ cybersecurity awareness, and (3) potential improvements in seafarers’ cybersecurity awareness. To accomplish this, a literature review is conducted to collect and analyze current research, supplemented by a questionnaire survey targeting Turkish seafarers. Our findings support increased investment in awareness and training programs, including organizational-wide cybersecurity awareness efforts, more frequent training, mandatory training for all seafarers through the Standards of Training Certification and Watchkeeping (STCW), and the appointment of a cybersecurity Officer (CySO) to ensure satisfactory cybersecurity levels onboard. Since this article focuses on high-level topics by assessing the general state of maritime cybersecurity and seafarers’ cybersecurity awareness, it does not delve into detailed considerations of awareness and training programs. Nevertheless, it lays the foundation for future research in this area.

Unveiling Cyber Threat Actors: A Hybrid Deep Learning Approach for Behavior-based Attribution

In this paper, we leverage natural language processing and machine learning algorithms to profile threat actors based on their behavioral signatures to establish identification for soft attribution. Our unique dataset comprises various actors and the commands they have executed, with a significant proportion using the Cobalt Strike framework in August 2020-October 2022. We implemented a hybrid deep learning structure combining transformers and convolutional neural networks to benefit global and local contextual information within the sequence of commands, which provides a detailed view of the behavioral patterns of threat actors. We evaluated our hybrid architecture against pre-trained transformer-based models such as BERT, RoBERTa, SecureBERT, and DarkBERT with our high-count, medium-count, and low-count datasets. Hybrid architecture has achieved F1-score of 95.11% and an accuracy score of 95.13% on the high-count dataset, F1-score of 93.60% and accuracy score of 93.77% on the medium-count dataset, and F1-score of 88.95% and accuracy score of 89.25% on the low-count dataset. Our approach has the potential to substantially reduce the workload of incident response experts who are processing the collected cybersecurity data to identify patterns.

Exploring Cyber Fraud within the South African Cybersecurity Legal Framework

All countries are globally struggling with the challenges cybercrime presents to the cybersecurity legal framework. Fraud is not a new crime and existed long before the internet. The internet provides a threat actor access to a lot of potential victims and the use of various threat vectors to gain access to personal information by means of social engineering. It is therefore not surprising that cyber fraud has become a serious threat which continues to escalate globally. In 2021, around $100 million was lost in Canada due to online fraud. The United Kingdom (UK) Finance indicated that cyber fraud costs consumers more than £1.2 billion in 2022. The South African (SA) Fraud Prevention Services noted a 356% surge in identity fraud between April 2022 and April 2023. The cybersecurity threat landscape is ever-evolving with the UK Finance warning that the number of cyber frauds could surge out of control as threat actors begin to incorporate the use of Artificial intelligence (AI) to make their operations far more sophisticated and not as easily detected. In 2023 the United States (US) also warned that the irresponsible use of AI could exacerbate societal harms such as fraud. Cyber fraud, also referred to as a “white collar” or commercial crime, is an umbrella term to describe the commission of different types of cyber fraud by means of the use of various threat vectors. The threat vector used to commit the different type of fraud is continuously evolving, such as the use of sophisticated phishing to quishing and deep fakes which are aimed at deceiving the recipient in sharing information. The information obtained from a data breach may be used to commit cyber fraud. Irrespective of the threat vector used to commit fraud, all types of fraud present with the same elements, namely a threat actor who unlawfully and intentionally deceives a victim to benefit and cause harm. The discussion focuses on cyber fraud in general and not a specific type of cyber fraud. The purpose of the discussion is to provide an overview of the challenges cyber fraud present to the South African cybersecurity legal landscape.

Strategies for Combating Adversarial Information Operations: Theory and Practical Applications

In the contemporary information landscape, the proliferation of disinformation and propaganda poses a significant challenge to societal discourse and democratic processes. This paper proposes a multi-disciplinary approach to combatting adversarial information operations, drawing upon theoretical frameworks and practical applications. Theoretical foundations are established through an examination of the Persuasive System Design (PSD) model (Oinas-Kukkonen, 2013) and its parallels with propaganda tactics. By analyzing the shared flaws and vulnerabilities, insights emerge into the manipulation techniques employed by threat actors in online information spaces. Building upon this theoretical framework, the paper presents a proactive strategy for countering disinformation: the development of Early Warning and Control Systems (EWACS). These systems leverage AI-assisted narrative discovery to monitor the digital information landscape continuously. By identifying emerging threats and inauthentic activity, strategic communicators gain valuable insights for crafting counter-narratives and pre-emptive communication strategies. Key components of the proposed approach include deterrence by denial and resilience-building measures. By shifting the cost-gain calculation of adversaries and enhancing societal resilience, the aim is to create an environment where propagandists face increased challenges in achieving their objectives. This paper emphasizes the importance of collaboration between diverse stakeholders, including governmental organizations, academia, NGOs, and journalists. By harnessing the collective expertise from multiple fields, more effective strategies can be developed to safeguard information integrity and restore public trust. In conclusion, this paper advocates for a convergence of theory and practice in addressing the complex challenges posed by adversarial information operations. By integrating theoretical insights with practical applications, the proposed approach offers a holistic framework for countering disinformation and propaganda in contemporary information environments.

Eight Principles for Intelligence Sharing: A Holistic and Strategic Approach

This paper reviews the strategic use of warning intelligence to pre-emptively address threats in complex geopolitical scenarios through rapid intelligence sharing. Specifically, the paper reviews the question How, based on research and experience, can a set of principles be applied by states to enhance situational awareness and tackle threat actors through a holistic and collaborative approach to intelligence sharing? The paper examines historical and contemporary alliances like the Five Eyes and reviews a Signals Intelligence Alliance as a case in point, highlighting the importance of collaborative approaches to enhance situational awareness and tackle threat actors. The study, grounded in the philosophical paradigm of interpretivism, adheres to the principles for transparent science when researchers use tools such as large-language-models as grammar editors or research assistants. The paper also acknowledges limitations such as the generalisability of the SIGINT model and the need for continuous adaptation of intelligence sharing practices. The results discuss policy, process, and people challenges to intelligence sharing. The paper concludes that successful intelligence sharing should follow eight general principles. Future research directions include exploring the impact of emerging technologies, human aspects of intelligence sharing, and context-based intelligence sharing alliances.

Psychological Effects of Continuity Threatening Cyber Incidents

Working in the field of cybersecurity has been compared to working in a warlike environment. Understanding what types of psychological strain cyber attacks cause to the defending organisations’ workforce can aid in developing methods and processes for mitigating those stressors. This paper discusses the first-hand psychological effects of experiencing an operational continuity threatening cyber incident caused by a real threat actor. The results are based on 19 interviews from IR professionals and IT security practitioners to decision makers, CISO’s and other top executives. These individuals were working in multi-national corporations, hospitals, central government, financial sector, local government or educational institutions at the time of the incident. The interviews followed critical incident paradigm to focus on significant events during the cyber incidents, while also being semi-structured to compensate for the diversity of the incidents. Most of the interviewees raise up feelings of disbelief and despair as their first emotional response to the realization of being hit by ransomware, data theft or another severe cyber incident that could threaten operational or business continuity. Feelings of guilt and self-doubt were present, especially in those considered to be responsible for securing the network. However, at the same time, feelings of purpose and self-efficacy were also reported by some. Having scalable resources available in the time of need, with well-defined roles and responsibilities for the core incident response teams and protecting them from unnecessary inquiries seemed to alleviate the stressors and anxiety of the Incident Response (IR) team during the event. Good leadership and internal communication were seen as important to maintain the necessary situational awareness and focus during the active incident mitigation and resolve phase. Long-term negative effects of the cyber incident were increased cynicism, fear of the situation recurring, and thoughts of changing career. These negative outcomes were mitigated by increased trust in colleagues, processes and systems with experience of self-efficacy. This paper discusses what types of mental strain cyber incidents introduce to cybersecurity professionals and top executives. It deepens understanding on what factors need to be considered in developing and enhancing the overall resilience of organisations against cyber attacks.

The U.S. National Cybersecurity Strategy: A Vehicle with an International Journey

The U.S. National Cybersecurity Strategy is focused on the five pillars of defending critical infrastructure: detect, disrupt, and dismantle threat actors; improve market resilience and security; invest in future resilience; and create international partnerships with shared goals. The National Cybersecurity Strategy Implementation Plan is focused on critical infrastructure supporting energy, financial, healthcare, information technology, and manufacturing sectors. In the U.S. alone, the SolarWinds supply chain attack affected nine federal agencies and about 100 companies. Ransomware attacks such as the Colonial Pipelines, the largest U.S. oil pipeline, disrupted supplies of gasoline and fuel to the U.S. East Coast and the JBS USA as the largest meat processor ransomware attack affecting one-fifth of the nation’s meat supply. The U.S. National Cybersecurity Strategy as a response to the U.S.’s critical infrastructure concerns led to the creation of two core cybersecurity documents which were crafted jointly with several other allies. Cybersecurity and Infrastructure Security Agency (CISA) crafted the Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software with joint agreement with National Security Agency (NSA), the Federal Bureau of Investigation (FBI), and 15 international government agencies to give international vendors a roadmap of the expected cybersecurity hygiene required from their products. (CISA, 2023a; Car & De Luca, 2022) Building on the Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software, CISA, FBI and NSA met with cybersecurity organizations from Australia, Canada, New Zealand, and United Kingdom and jointly created The Case for Memory Safe Roadmaps: Why Both C-Suite Executives and Technical Experts Need to Take Memory Safe Coding Seriously as a core issue identified in the earlier guidance. (CISA, 2023c). These led by the U.S. helped initiate an international cybersecurity norm insisting international software manufacturers demonstrate product security and transparency. They showed how a global community can rally to solve cybersecurity challenges that have existed for decades. This led to twenty of the largest international software vendors creating the Minimum Viable Secure Product (MSVP) Working Group to address the requirements levied by these documents; CISA has joined this working group to help shape procurement, contractual controls, self-assessment, and system development lifecycle (SDLC) with these vendors. (CISA, 2024d; MSVP, n.d.) This research argues that the U.S. National Security Council (NSC) should leverage the talent pool of CISA, National Institute of Standards and Technology (NIST), Department of Defense (DoD), FBI, and NSA to improve detection, information sharing, security standards, and implementation for not only the U.S.’s government and commercial sectors, but also helps our allies and partners. The DoD and Office of the Director of National Intelligence (ODNI) have made great strides in improving security by integrating improvements with Zero Trust Architecture (ZTA), Supply Chain Risk Management (SCRM), Software Supply Chain Security, Cybersecurity Safety Review Board (CSRB), Cybersecurity Incident & Vulnerability Response Playbooks, and DoD National Security Systems (NSS) standards. The NSC should coordinate through CISA to develop a collaborative effort to not only benefit the U.S. critical infrastructure but also help our allies and partners.