Last Updated on 22/11/2021 by Sunaina
According to The Wall Street Journal, the Biden administration is pushing civilian government agencies to repair hundreds of cybersecurity weaknesses. According to the WSJ, the Cybersecurity and Infrastructure Security Agency’s (CISA) BOD 22-01 directive covers around 200 known dangers detected by cybersecurity specialists between 2017 and 2020, as well as 90 further holes revealed in 2021. Federal agencies have six months to patch older risks and only two weeks to update those uncovered in the last year.
According to the WSJ study, government agencies are typically left to their own ways when it comes to security, which can result in poor security management. The purpose is to compel government agencies to address all possible dangers, no matter how serious they are, and to provide a baseline list for other commercial and public entities to follow. While zero-day vulnerabilities that attack previously undisclosed gaps garner a lot of attention, resolving “the subset of vulnerabilities that are causing harm now” can help you stay ahead of many situations.
“The new Directive lays out clear obligations for federal civilian agencies to take urgent action to strengthen their vulnerability management policies and drastically decrease their risk of cyber assaults,” said Jen Easterly, CISA director. “
The Microsoft Exchange Server issue is prominent on CISA’s recently revealed list of known vulnerabilities. Emails from over 30,000 US governmental and commercial institutions were stolen by a Chinese outfit in March, due to four known security weaknesses that, if corrected, would have prevented the attacks. CISA’s list calls for the “Microsoft Exchange Remote Code Execution Vulnerability” to be patched and urges government entities to install available SolarWinds fixes by May 2022.
The Solarwinds Orion Platform, which was the subject of a large attack in late 2020 that affected US federal entities, is also on the list. According to the CISA, the “SolarWinds Orion API is vulnerable to an authentication bypass, which might allow a remote attacker to execute API instructions.”
In May, President Biden issued an executive order to aid in the prevention of future cybersecurity calamities. Among other things, the order mandates two-factor authentication throughout the federal government, provides a procedure for reacting to breaches, and establishes a Cybersecurity Safety Review Board.
