Happy Juneteenth. Cyberscoop reports that

The Senate on Thursday confirmed Chris Inglis as the new White House cyber czar, a role it enacted into law late last year.

The new role will play a key part in coordinating the government response to major hacks and other cybersecurity threats. Inglis takes on the position as the U.S. has dealt with an onslaught of cybersecurity incidents, including ransomware attacks on Colonial Pipeline and meat supplier JBS. The national cyber director will also lead the implementation of cyber policy and strategy, including efforts mandated by the Biden administration to improve federal cybersecurity.

The Wall Street Journal informs us

The private sector in the U.S. must do more to defend against cyberattacks, lawmakers from both major parties stressed Thursday as several senators introduced legislation designed to target hackers. The ransomware incident that brought operations at Colonial Pipeline Co. to a standstill for six days starting May 7, and resulted in fuel shortages across Southeastern states, shows that cybersecurity efforts must improve, said Sen. Sheldon Whitehouse (D., R.I.). “Partly, it’s the national cybersecurity establishment that needs to step up its game. And partly, it’s the corporate community that has been caught with its figurative trousers down,” Mr. Whitehouse said, speaking at a press conference Thursday with Sens. Lindsey Graham (R., S.C.) and Richard Blumenthal (D., Conn.)

* * *

Christopher Roberti, senior vice president for cyber, intelligence and supply chain security policy at the U.S. Chamber of Commerce, which says it is the world’s largest business association, said companies don’t stand a chance against determined nation-state attacks regardless of cybersecurity investments. Partnerships between the government and the private sector are essential, he said. “Businesses must take necessary steps to ensure their cyber defenses are robust and up to date, and the U.S. government must act decisively against cyber criminals to deter future attacks. Each has a role to play and both need to work closely to do more,” Mr. Roberti said.

Federal News Network offers an interesting interview with Chris Golden, director of Information Security at Horizon Blue Cross Blue Shield of New Jersey and a founding member of the Defense Department’s Cybersecurity Maturity Model Certification accreditation program. Of note

Tom Temin [FNN]: And then there’s also hints that the CMMC program could spread to the civilian agencies, and therefore some unknown number of additional or marginal numbers of companies added into the mix. So then you’ve got more scaling issues.

Chris Golden: You’ve already seen Department of Homeland Security and the General Services Administration (GSA) put in what I would call contingency CMMC clauses in their contracts, they basically say, “Hey, we may change this contract to include a CMMC requirement. We’ll let you know after you sign” – it kind of thing. So these other government agencies are leaning in that direction, I think it’s probably going to be pretty obvious that most of them will go there. And eventually, it’ll be a whole of government approach. And then I think you’ll start seeing it go to people that don’t do any contracting with the government, right? Once the regulators start looking at and going, hey, in healthcare let’s say – that’s the area I work in – maybe a regulator says, “Well, maybe I’ll take a SOC 2 type 2 audit this year, but next year, maybe the CMMC thing is what I really need? Maybe that’s a better approach to managing risk?” And so once you see that happen, you’ll see sort of grow and balloon, and then we haven’t even talked internationally as our international partners, who do participate in the supply chain and will have to be CMMC-assessed but how do they fit into this sort of big puzzle as it sort of goes global? So yeah, there’s a potential here for a huge ballooning of this thing.

It would not be a true Cybersecurity Saturday post without a link to Bleeping Computers “This Week in Ransomware” post:

Compared to the last few weeks, it has been a relatively quiet week with no ransomware attacks causing widespread disruption.

It was a good week for law enforcement, with Ukrainian police arresting members of the Clop ransomware gang and the South Korean police arresting computer repairment installing ransomware.

We also saw some interesting research released on LockBit and the Hades ransomware, as well as an updated Avaddon Ransomware decryptor that can decrypt more victims’ files.

Finally, President Biden met with Russian President Putin to discuss the recent cyberattacks. Whether something changes from that meeting is too soon to tell.

Also here’s a link to a nifty article with cybersecurity tips. Tech Republic informs us about a “new IBM global report examining consumer behaviors finds an average of 15 new online accounts were created and 82% are reusing the same credentials some of the time.”