Arizona House of Representatives Committee on Commerce Meeting Minutes and Presentation - January 11, 2022

Summary

Minutes of the regular meeting of the Arizona House of Representatives Committee on Commerce, Fifty-fifth Legislature, Second Regular Session, held Tuesday, January 11, 2022, with the agenda, request to speak report, attendance record and a presentation handout attached. The agenda lists a cybersecurity presentation by a representative of Palo Alto Networks and public testimony, and the attendance record lists Jeff Weninger as chairman and Joseph Chaplik as vice-chairman. The presentation slides cover ransomware, industrial control system attacks, supply chain attacks and vulnerability exploitation, with examples including the Colonial Pipeline attack of May 2021, the Apache Log4j vulnerability and the SolarWinds software supply chain attack. The final slide lists steps for policymakers, such as incentivizing best practices and mandating reporting of ransomware and other incidents.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

ARIZONA HOUSE OF REPRESENTATIVES
Fifty-fifth Legislature - Second Regular Session

COMMITTEE ON COMMERCE

Report of Regular Meeting
Tuesday, January 11, 2022
House Hearing Room 3 -- 2 P.M. OR UPON ADJOURNMENT OF FLOOR

Convened 2:29 P.M.
MINUTES RECEIVED

R 1
Reconvened OHIBE CLERK'S OFFICE
pape] 2%

Adjourned 2:52 P.M.

Members Present Members Absent

Mr. Carter

Mr. Chavez

Mr. Cook

Mr. Espinoza

Mr. Kaiser

Mrs. Liguori

Mr. Meza

Mr. Wilmeth

Mr. Chaplik, Vice-Chairman
Mr, Weninger, Chairman

Agenda
Original Agenda — Attachment 1

Request to Speak
Report — Attachment 2

Committee Attendance
Report — Attachment 3

Presentations
Name Organization Attachments (Handouts)

Thomas MacLellan Palo Alto Networks 4

«hee ul, iu A. uA L aa

Jacqueline Denlinger, Committee retary
January 14, 2022

(Original attachments on file in the Office of the Chief Clerk; video archives available at http:/Avww.azleg.gov)

COMMITTEE ON COMMERCE
January 11, 2022
conv ened 2:25) e
ad ou thed 2-8ey

ARIZONA HOUSE OF REPRESENTATIVES
Fifty-fifth Legislature - Second Regular Session

REGULAR MEETING AGENDA

COMMITTEE ON COMMERCE

TIME 2 P.M. or Upon Adjournment

DATE Tuesday, January 11, 2022 ROOM HHR3
of Floor

Members of the public may access a livestream of the meeting here:
hitos:/Avww.azleg.gov/videoplayer/?clientID=636 ! 162879&eventID=202201 1006
Members:

Mr, Carter Mr. Kaiser Mr. Wilmeth

Mr. Cook Mrs. Liguori Mr. Chaplik, Vice-Chairman

Mr. Chavez Mr. Meza Mr. Weninger, Chairman

Mr. Espinoza

1. Call to Order
2. Introduction of Members & Staff
3. Presentation:
e Thomas MacLellan, Cybersecurity 10]

4, Public Testimony
5. Adjourn

DF
01/04/2022

People with disabilities may request reasonable accommodations such as interpreters, alternative formats, or
assistance with physical accessibility. If you require accommodations, please contact the Chief Clerk's Office at

(602) 926-3032 or through Arizona Relay Service 7-1-1.

Page 1 of 1
Attachment

Information Registered on the Request to Speak System

House Commerce (1/11/2022)

A, Public Testimony

Attachment 2.

ARIZONA STATE LEGISLATURE
Fifty-fifth Legislature - Second Regular Session

COMMITTEE ATTENDANCE RECORD

COMMITTEE ON COMMERCE
CHAIRMAN: Jeff Weninger VICE-CHAIRMAN: _Joseph Chaplik
DATE 01/11/22 122 /22 /22 [22
CONVENED Zo Pm m m m m
RECESSED
RECONVENED
ADJOURNED Z SQ pn
MEMBERS
Carter wv
Chavez Va
Cook VY
Espinoza va
Kaiser vee
Liguori ve
Meza VA
Wilmeth va
Chaplik, Vice-Chairman vA
Weninger, Chairman VA

V Present -- Absent exc Excused

Attachment 3S
Attachment

ne

Y

Presen t

Thomas MacLellan

Director

Government Affairs & Strategy
Palo Alto Networks

January 11, 2022

¢ 2022 Palo Alto Networks, ine. All nghts reserved, Proprietary and confidential intorrnation.

Current and Emerging Threats

e Ransomware

e Industrial Control System Attacks
e Supply Chain |
e Vulnerability Exploitation

Key Trends: 2021

$2.1M average $461K

ransom demand average ransom | Ransomwa re
in 2021 paid in 2021 - Threat Report
$TIM $70M

highest ransom highest ransom

paid in 2021 demand in 2021

Quadruple Extortion on the Rise

i Exagrid pays $2.6m to Conti
j Samper ekdycom ransomware attackers

June 1, 2021

Th Colonial Pipeline confirms it paid $4:4
Gut Mian ransom to hacker gang after attack
May 20, 2021

Acer reportedly targeted with $50
et million ransomware attack
March 22, 2023

Bose victim of ransomware attack
May 26, 2021

© 2022 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

Ireland's Health Services hit with
BLECPINGCOMPUTER $20 million ransomware demand

May 15, 208t

SS a Sonnets

Meat Supplier JBS Is The Latest
Company Hit With Ransomware
Jun 2, 2021

Reserve Bank of New Zealand
Investigates Data Breach
Jan 7), 2021

Pe Singtel hit by third-party vendor's -
Net security breach
Feb Tl, 2021

Unit 42: The Rise of Quadruple Extortion

| Ransomware operators now commonly use as many as four teckiniques for pressuring

Encryption Data Theft Denial of Service Harassment
Victims pay to regain Hackers threaten to DoS attacks shut down Customers, business
access to encrypted release stolen data if victim's public partners, employees
data _ ransom is unpaid. websites and media.contacted

Colonial Pipeline

MAY 2021
What Happened:

1. Gained access through

compromised VPN credentials

2. Exfiltrated ~1OOGB of data before
encrypting some business systems

3. Company shut down 5500 miles

of pipeline as a precautionary
measure

4. Company paid ~$4.4m ransom

5. DOJ Task Force recovered 8
bitcoin / ~$23m

5% of

1

2

Infect, exfiltrate
& encrypt victim
system

Demand ransom

Industrial Control Systems Attacks

Industrial control systems (ICS) are the physical
systems like pumps that underpin the functions
of critical infrastructure facilities like water,
electricity, even hospitals. Attacks against ICS
can have a kinetic impact in the real world.

ICS Attacks Can Have Real World Impact

= MIER BACKCAAANEL BUSTREGS CULTURE SEAM IDEAT SCIERCE StCURITY

TANF EROLRRGAD SECURITY 82.68.2822 Of-06 FH

A Hacker Tried to Poison a Florida City's Water Supply, Officials Say

The attacker upped sodlum hydroxide levels in the Oldsmar, Florida, water supply to extremely dangerous levels.

he nt rater
bycroxide. FADTOCAAPA: CEOTY JMAGCE

Exploitation of Known or Unknown Vulnerabilities

These are weaknesses in software or hardware
that may not be known to anyone but the
attacker, or a Known vulnerability that an
organization has not patched or mitigated. This

can leave an organization’s network extremely
vulnerable.

v SAR CONTACT STM

CYBERSECURITY &
& INFRASTRUCTURE
SECURITY AGENCY °1]

WEFRASTRUCTURE , EMERGENCY Shy RATIONAL, RISK AnoUT
$F costae GR, cua GES commumicanons CT waxxcount OS asa EG eon

KNOWN EXPLOITED VULNERABILITIES CATALOG

Dawnioad Cav version
Download 450X version
Downlond JSON schema
iy Liplolted Calatog| butletin
ack for export i
Added tw
ot NemdadPrviect  Prestutt Catal Saal Ove Date ome
OK. Gueze Onur tote ‘Deurtnboee
war 98,2021, wenlanerper 29,2021
aired free Winerbaty werder
Instrectons.
Cyt. stone preeron meet neat -_ aor December
ztze lentalter ApoX installer 15,2021 bevordinhenilaley, intnatity, and aweitaladyy, Melee care 28,2021
werd Specs Sa atanal
Wirerebary avuction.,
Cue Feats, ak CUE TK, December VEL CHE b tony Amero,
Sad anjection 10,2021. Jorirreaasona/ttame,or pnevazel enfant, wpdaret per 1007
me Wameentity wonton
wertrurtere,
Oe Apache Sob Apache Sole Oeeenee y nee aor dune 20,
PCN 310, 2008 amples per | 9087
one Cade ijecon vendor
Winery denna.
CH Mama  Deewnbae ny Jone 30,
sOim meres Rerancbe 10,2022 weet the "SELON mettierd. kpeatespar 2927
yore Kode Kaew vencr
snnaroctions,
5 Embetl CoAhood Degemier 26, Apply lune 20,
THY. Rarntte Cede 10,207: Program icctynarmcally bilo. Uptetmnper 2012
rar Fusialen veneer
futons
SvK- Umer aera Urn Keer Drornber Ay dane
rs: Ln proper Privtiene a: vesatmpar 207
aarry Management wonder
Wlewrabitty Aendetionn.,
CM Rand the Cecerner u Aird Hoos wet Appty ae
ame an 2 tern cadn ee: Har Lavaca BP acinar npn per 2027
Gecution ave rapa vedio
eras acorn,
Ok. Seeurype ne Oeowenbar Apoty June,
20h deanrgee apoioty Wansge 10, 2021 wpdatenpar 100,
a Proper Acar vendor
Concirat Vda olBidy iasaratiuren
(vt. Mahala Adrrarte Dect ah Aorty une 1b,
ad Heer Cathe Aa, 703: UKery Win a ood DHCP: wae Apales pee ar

Vulnerability Exploitation: Apache Log4j

Paloalto’ & UNIT A2

Another Apache Log4j Vulnerability Is Actively
Exploited in the Wild (CVE-2021-44228)
(Updated Dec. 28)

=D €> «==

‘This post is also avaitable In: 8753 Uapanese)

Executive Summary

On Dec 9, 2021, a remote code execution (RCE) vulnerability in Apache Log4j 2 was identified being exploited in

the wild. Public proof of concept (PoC) code was rel d and sub i i

ted that explat

was incredibly easy to perform, By submitting a specially crafted request to a vulnerable system, depending on
how the system is configured, an attacker is able to instruct that system to download and subsequently execute a

manficiesie asulasd Drie te tha aicemuane nf thie avalalt hates ca eacant thare ave ot

mon conmare hath ane

Supply Chain Attacks

Supply chain attacks seek to damage an
organization by targeting less-secure
elements in the supply chain. It’s a “low and
slow” way for attackers to gain access to
organizations’ networks under the cover of a
trusted source.

SolarWinds Software Supply Chain Attack - Timeline

2019 2021

8/6 9/12 V4 CS 4.0 10/5 W6 12/8 12/15
Earliest Inject End Code Domain First SSL Removed | CS 4.3 PANW CS 4.2 FireEye Microsoft

Domain | Test Code Testing Infra Cert Available from SW Attempt Report Seizes
9/4 2/20 6/22 7/20 Dornain
Access Sunspot TT Last SSL
SW Deployed Infra Cert

——~’

&x SSL Certs

What Can You As Policymakers Do?

e Incentivize The Adoption of Best Practices and Standards.
@® Support smailer governments and municipalities.

e Mandate Reporting of Ransomware and Other Incidents.
e Understand the Threats.

@ Understand What You’re Spending on Cybersecurity.

e Know What Your Attackers See.

® Ensure that Cybersecurity is a Core Function of Government.



File and source

File

2022-01-11_commerce-minutes.pdf

Size

1,132,265 bytes

SHA-256

c2fb8bdc85d7b5b4db5667c5f018182cb444d521ab73e9fabffc56d6a7ffa033

Our copy

2022-01-11_commerce-minutes.pdf

Original

www.azleg.gov