On September 9, the Federal Bureau of Investigation (FBI) unveiled its inaugural Cyber Strategy, a comprehensive guide aimed at enhancing its approach to investigating and disrupting cyber threats. This groundbreaking document seeks to address the rising tide of cyberattacks perpetrated by financially motivated cybercriminals and state-sponsored actors, whose geographic locations often pose significant challenges for U.S. law enforcement.
The publication of this document is framed within a broader reassessment by the U.S. government regarding the manner in which it tackles cybersecurity threats. Rather than simply responding to incidents after they occur, the FBI aims to adopt a more proactive stance, intervening before adversaries can execute their malicious plans. As articulated in the Cyber Strategy, the agency is committed to imposing costs on those who target the United States, utilizing decisive actions and rapid support for victims while investing in new tools and capabilities.
In a statement reflecting this strategic pivot, the FBI noted, “With this strategy as our roadmap, the FBI will impose cost on cyber actors who target the United States through decisive action, rapid victim support, integrated partnerships, and continuous investment in tools and capabilities. FBI Cyber will disrupt adversaries before they can act, expose them when they do, and hold them accountable wherever they hide.”
Gabrielle Hempel, a security operations strategist at Exabeam, provided insights on the significance of this strategy. She remarked that the emphasis on disruption rather than prosecution signifies a noteworthy shift in priorities. Historically, the success of cybercrime enforcement has often been measured by arrests that could take years to materialize, if they occur at all. Hempel praised the agency’s broadened definition of what constitutes a successful operation—suggesting that actions such as dismantling infrastructure, seizing illicit gains, and compelling adversaries to rebuild their operations could yield substantial operational victories.
This strategic unveiling coincided with a memorandum signed by former President Trump in August, which authorized federal law enforcement agencies to collaborate with private entities to conduct offensive cyber operations against foreign adversaries targeting the United States.
A Four-Pronged Strategy
The Cyber Strategy is anchored in four fundamental pillars:
Investigate, Disrupt, and Impose Costs on Cyber Adversaries
The first pillar outlines the FBI’s commitment to identify and disrupt adversaries targeting U.S. networks. It highlights a collaborative approach among various cyber threat teams within the agency, ensuring that once a potential threat is detected, victims are promptly notified. The document details operational strategies including dismantling adversarial infrastructures, seizing stolen cryptocurrency, and neutralizing ransomware threats. Moreover, the FBI employs a “best athlete” model, allowing the most capable personnel or resources to lead specific phases of these operations.
Support Victims
The second pillar focuses on the range of methods the FBI employs to aid victims in the aftermath of cyberattacks. The agency is dedicated to rapidly sharing threat intelligence with organizations under attack and is working on automated systems for swift information dissemination. When cyber incidents arise, the FBI aims to engage victims immediately, supporting their efforts to contain and recover from these breaches. This is particularly critical for infrastructure systems, prompting the FBI to expand its Industrial Control Systems (ICS) Coordinator program to ensure dedicated personnel are assigned to every field office.
Increase Impact Through Partnerships
Another critical aspect of the strategy is the FBI’s commitment to deepen partnerships with various stakeholders, including government entities, international allies, and the private sector. The agency recognizes the importance of collaborative efforts to amplify its impact against cyber threats. It plans to implement systems designed for swift sharing of actionable intelligence and aims to enhance private sector cooperation through programs like the Chief Information Security Officer (CISO) Academy and Cyber Executive Summits.
Enhance FBI’s Cyber Capabilities
The final pillar focuses on the FBI’s initiatives to attract and retain top cyber talent. The agency is committed to implementing advanced technical tools and techniques, including artificial intelligence, to enhance its operational capabilities. Through its Cyber Education and Training Unit (CETU), the FBI will provide ongoing professional development and training across its cyber workforce. Additionally, the implementation of AI-enabled tools aims to streamline processes such as data analysis, malware investigations, and adversary mapping.
In the evolving landscape of cybersecurity, the FBI’s Cyber Strategy serves as a pivotal step toward a more proactive and collaborative approach to countering cyber threats, fostering resilience among organizations, and strengthening the United States’ defense mechanisms.