news

Cybersecurity Experts Conclude This Week Was Worse Than Last Week, but Probably Better Than Next Week

Cybersecurity Experts Conclude This Week Was Worse Than Last Week, but Probably Better Than Next Week

WASHINGTON, D.C. — A panel of four leading cybersecurity experts testified Tuesday that this week was worse than last week, but declined to rule out that it would be remembered as one of the better weeks of the year once next week happens.

The hearing, convened to "establish a clear picture of the current threat landscape," lasted six hours and produced one whiteboard. Witnesses spent the morning agreeing that last week was bad, the early afternoon establishing that this week was worse, and the remaining three hours declining to say anything about next week beyond a question mark, which a committee aide underlined twice in red at the panel's request.

"I want to be very precise for the record," said Dr. Ellen Varga, a former federal incident response lead now at a policy institute. "Last week we had a zero-day in a VPN appliance, a ransomware attack on a hospital network and a password manager that leaked its own passwords. This week we had all three again, plus the VPN appliance's patch, which was also a zero-day."

Asked by the committee chair whether the trend was improving, Varga said it was "stable," in the sense that it had been getting worse at a consistent rate since roughly 1988.

Fellow witness Dr. Martin Hollis, who spent most of the testimony with a hand over his eyes, told the committee he had prepared written remarks on this week's incidents but that they were out of date by the time he reached the building. "I submitted them Monday," he said. "By Tuesday morning two of the vendors in my footnotes had been breached, and one of them was the vendor I'd recommended as the fix."

The panel was briefly optimistic around 2:15 p.m., when a staffer noted that no major incident had been disclosed in nearly forty minutes. The mood ended at 2:19, when the staffer's own agency disclosed one.

Committee members pressed the witnesses for actionable recommendations. The panel unanimously recommended patching, multi-factor authentication and "not clicking the link," the same three recommendations offered at the previous hearing, the hearing before that, and every hearing since the committee was founded. Witness Raymond Kell said his team had trained a model on twenty years of incident data to forecast next week, and that it had returned "worse" with 97% confidence shortly before being compromised itself.

Industry groups welcomed the testimony. A trade association representing more than 400 security vendors called the findings "deeply concerning" and noted that each of its members already offers a platform that addresses whatever happens next week, "including the parts that haven't been invented yet."

The committee voted 11–2 to schedule a follow-up hearing next week to determine how bad next week was. The two dissenting members said they would rather not know.

At press time, the whiteboard had been entered into the record as the most accurate threat intelligence report of the year.

About the Author

The Exploit Staff

The Exploit Staff

Staff Writer

The editorial team at The Exploit - bringing you the most absurd cybersecurity news before it's patched.

Subscribe before we're patched

Like a vitamin you ingest with your eyes. The best cybersecurity parody, delivered.

By subscribing you agree to our Terms and Privacy Policy. Unsubscribe at any time.