10/08/2025 — Tech & Cybersecurity Updates

1. U.S. Air Force probes major data breach tied to Microsoft SharePoint

• What happened:
    • In early October, the U.S. Air Force publicly disclosed an investigation into a data breach caused by misconfigured SharePoint permissions. 
    • All SharePoint access across the Air Force has been suspended while the scope is assessed. 
    • Reports suggest that because Microsoft Teams and Power BI depend in part on SharePoint infrastructure, they may also be affected (though that is not yet confirmed). 

• Why it matters (for seniors / non‑tech folks):
    • The Air Force handles some of the most sensitive data in the U.S.—personnel, health, operations. A breach there risks exposure of very personal or even national‑security information.
    • It underscores that even strong institutions are not immune—if the Air Force can be hit, so can smaller organizations, hospitals, or local governments.
    • If integration between systems (Teams, Power BI) is weak, the ripple effect can mean more systems than you think may be at risk.

• What’s next:
    • Full forensic analysis to determine exactly what was accessed (names, health data, etc.) and who is responsible.
    • Microsoft and U.S. government agencies will coordinate on patching, compensations, and policy updates.
    • Expect hearings or oversight pressure from Congress and demands for stricter controls on configuration, especially in federal systems.

---

2. Key U.S. cyber‑sharing law (CISA 2015) officially expires in shutdown

• What happened:
    • On October 1, 2025, the Cybersecurity Information Sharing Act (CISA) of 2015 formally lapsed as Congress failed to renew it amid a government shutdown.  
    • The law had shielded private firms from certain liabilities when they shared cyber threat information with each other or the federal government. 
    • Meanwhile, staffing cuts from the shutdown hit the Cybersecurity & Infrastructure Security Agency (CISA) hard—with only about 35 % of its workforce retained. 

• Why it matters:
    • Without liability protections, companies may now hesitate to share vital threat data (who is being attacked, how) for fear of lawsuits or regulatory exposure.
    • The lapse comes at a dangerous time—cyberattacks are rising. Less coordinated defense makes everyone more vulnerable.
    • Seniors and average users depend on banks, healthcare providers, utilities, local governments—if those organizations slow down in cyber defense, it may translate into slower breach detection, more outages, or data exposure.

• What’s next:
    • Congress is under pressure to reauthorize or update the law. Proposals may include new language for AI, ransomware, or privacy limits.
    • In the interim, states or private coalitions might set up their own threat‑sharing frameworks to patch the gap.
    • Watch whether some firms decline to share threat intel publicly, or pull back from collaborations with federal agencies.

---

3. Department of Defense shifts to new cyber framework: CSRMC replaces RMF

• What happened:
    • On September 24, 2025, the U.S. Department of Defense (DoD) formally announced the Cybersecurity Risk Management Construct (CSRMC), a new framework to replace the long‑standing Risk Management Framework (RMF). 
    • CSRMC emphasizes automation, continuous monitoring, and reciprocity (i.e., reusing security assessments where possible) over static checklist audits. 

• Why it matters:
    • The DoD handles some of the most critical national systems—how it secures them sets standards and expectations for the rest of the government and even private defense contractors.
    • If DoD demands more dynamic, real‑time security, vendors, suppliers, and contractors (many of whom are small organizations) will have to upgrade their practices—if they don’t, they risk losing contracts or worse, being excluded.
    • For non‑tech people, this means more of the “behind the scenes” infrastructure that supports our safety, communications, and defense is likely to adopt stronger safeguards—but also possibly stricter oversight or delay in deploying new services while audits happen.

• What’s next:
    • DoD will issue detailed guidance, timelines, and training for all its systems and contractors to transition.
    • Audits and contract compliance will tighten; contractors unable to meet CSRMC standards may be cut off.
    • Other U.S. agencies or large federal contractors may adopt similar principles, making “continuous monitoring” the new baseline across government systems.

• (AI was used to create this article.)