As it promised two weeks ago when it first announced the publication of a federal government’s Catalog of Known Exploited Vulnerabilities, CISA (Cybersecurity & Infrastructure Security Agency) has just updated the catalog by adding four new vulnerabilities. All of them represent significant risks.

The CISA catalog is directed to non-military agencies and their contractors so they can identify open and new cybersecurity vulnerabilities. It also allows CISA to announce remediation deadlines. This bimonthly updating process should prove to be a valued resource to agencies, their contractors, and all of us in staying up-to-date in maintaining cybersecurity hygiene.

Three of the four newly added vulnerabilities involve Microsoft products. In one, a security feature bypass in Excel could allow for an attacker to perform arbitrary code execution. Another allows an attacker to use an improper validation in a cmdlet (a small script that performs a specific function) argument to perform remote code execution in Microsoft Exchange servers. The third identifies a vulnerability in Windows OS that could allow for an authorized user to escalate privileges.

The fourth newly listed vulnerability is in the Perl ExifTool. In this second listing in as many weeks, a vulnerability in ExifTool, a set of Perl modules that read and write metadata in a variety of formats, has been identified. This most recently described vulnerability could allow improper neutralizing of user data and arbitrary code execution.

December 1, 2021, is the remediation deadline for all four of these vulnerabilities, which are now being actively exploited by threat actors. And as with all the rest, the remediation action for these vulnerabilities is to apply updates per vendor instructions.

Well, the reports were right. On November 3rd the federal government’s Cybersecurity and Infrastructure Agency (CISA) issued a directive prioritizing vulnerability management by federal civilian agencies and establishing remediation deadlines.

This new directive is referenced as Binding Operational Directive 22-01 (BOD 22-01) and has a very straightforward title: Reducing the Significant Risk of Known Exploited Vulnerabilities. It establishes a CISA-managed catalog of known and exploited vulnerabilities that must be targeted for remediation by federal agencies. The directive can be accessed here and the catalog here.

The catalog lists the vulnerabilities by name, reference software vendor, description, remediation action, and remediation due date, most of which so far are two weeks from the listing. In all instances for the initially listed vulnerabilities, remediation action is simply to “Apply updates per vendor instructions.”

The catalog will be updated on an ongoing basis. CISA allows for a subscription to catalog updates through simply submitting an email address and choosing a password here. Doing that also provides an opportunity to subscribe to a long list of other CISA updates, many of which are industry-specific.

While the directive and catalog are addressed to a civilian federal agency audience, CISA does point out that the targeted federal information systems included those operated or used by any entity “on behalf of an agency, that collects, processes, stores, transmits, disseminates, or otherwise maintains agency information.” This broad statement of applicability really seems to put required compliance on some federal contractors despite CISA merely recommending that private business and local jurisdictions review and monitor the catalog, and remediate accordingly.

CISA noted in its fact sheet accompanying the directive that in 2020 alone, 18,358 new cybersecurity vulnerabilities were identified and 10,342 of those – 28 a day – were considered “critical” or “high severity.” Equally concerning is that as recently as 2015 it took federal agencies between 200 to 300 days to remediate vulnerabilities.

Just as with industry, there have been improvements by federal agencies over the last several years, but much remains to be done. This newly issued BOD 22-01 is requiring federal civilian agencies to continue improvements in their remediation efforts from this dismal record. Many contractors need to acknowledge that they also need improvement and accept CISA’s invitation to use the CISA catalog.

Reports are that on Wednesday, November 3, 2021, Jen Easterly, who is the director of Cybersecurity and Infrastructure Security Agency within the Department of Homeland Security, will issue a directive imposing new federal government cybersecurity mandates. Here’s what we know about it:

• The directive, which is intended to move forward some agencies that have been slower in addressing cyber-vulnerabilities, will require federal agencies to patch up to 300 known cybersecurity risks that could result in damaging hacks.
• These risks will be listed in a new federal catalog that will be updated periodically.
• Security flaws listed already in 2021 will require fixes in two weeks with those listed from now on requiring even quicker fixes. Older flaws will have to be fixed in six months.
• The directive will apply to all federal agencies except DoD, the CIA, and the Office of the Director of National Intelligence.
• The directive will also apply to all federal information systems, including those hosted by third parties and federal contractors, and including not just those that are considered critical or high risk.

We will post an update when the directive is published.

Following up on the July 28, 2021 cybersecurity memorandum by the President, the Department of Homeland Security (DHS) announced this week the results of a review of resources and practices by DHS’s Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST). This review led CISA and NIST to identify nine categories of cybersecurity practices and to use those categories as the preliminary basis of related cybersecurity performance controls.

The following are the nine identified categories and related high-level goals listed by the DHS, each of which has a familiar ring for all of us who have been involved over the years in implementing ITAR, DFARS, and NIST 800-171 controls and best practices:

1. Risk Management and Cybersecurity Governance
2. Architecture and Design
3. Configuration and Change Management
4. Physical Security
5. System and Data Integrity, Availability, and Confidentiality
6. Continuous Monitoring and Vulnerability Management
7. Training and Awareness
8. Incident Response and Recovery
9. Supply Chain Risk Management

In its written announcement, DHS provided a brief explanation of the goals, rationale, and baseline objectives for each category.

Each of us involved in trade compliance or federal contracting, or providing support for those who are, should become very familiar with what the DHS has announced as it will no doubt form the basis for what is coming.

As the provider of a compliant storage and collaboration platform for ITAR technical data and other forms of federal Controlled Unclassified Information, we often look on with amazement when some companies claim compliance with ITAR, NIST SP(s)800-171/172, and the CMMC for products and services that clearly don’t meet those standards. We assume that those companies just don’t understand what it takes to be compliant but suspect at times that there may be intentional misrepresentations.

It seems from Zoom’s $85 million lawsuit settlement for lying about end-to-end encryption and sharing confidential information with Facebook and Google that our suspicions often are justified. Trust but verify.