CISA issued this year’s first binding operational directive ordering federal civilian agencies to secure misconfigured or Internet-exposed networking equipment within 14 days of discovery.
“The Directive requires federal civilian executive branch agencies to take steps to reduce their attack surface created by insecure or misconfigured management interfaces across certain classes of devices,” CISA said.
CISA says it will conduct scans to identify devices and interfaces falling within the directive’s scope and notify the agencies of its findings.
To facilitate the remediation process, CISA will provide federal agencies with technical expertise when needed or requested to review the status of specific devices and provide guidance on securing devices.
In March, CISA also announced that it would warn critical infrastructure organizations of ransomware-vulnerable devices on their network to help them block ransomware attacks as part of a new Ransomware Vulnerability Warning Pilot program.
CISA orders govt agencies to patch MOVEit bug used for data theft.
