The Department of Homeland Security’s (DHS) cyber unit has ordered federal agencies to immediately fix hundreds of known hardware and software vulnerabilities already exploited by threat actors to attack government networks and systems.
In a rare binding operational directive, the Cybersecurity and Infrastructure Security Agency (CISA) has cataloged nearly 300 security flaws it wants fixed that “carry significant risk to the federal enterprise." Since 2015, DHS and CISA have issued only 10 such mandates around pressing issues, two of which were subsequently revoked and superseded.
The order has multiple implications for managed security service providers (MSSPs). Among the variables to note:
U.S. Government Agencies and Vulnerability Management: The Directive Explained
The binding operational directive, termed BOD 22-01 Reducing the Significant Risk of Known Exploited Vulnerabilities, sets remediation requirements agencies must follow to shore up identified software and hardware flaws found on federal information systems, whether on premise or hosted by a third-party. It covers about 90 known security flaws identified this year alone and roughly another 200 observed in use by hackers dating to 2017, and applies to federal, executive branch, departments and agencies.
CISA said it will determine which vulnerabilities warrant inclusion in the catalog based on “reliable evidence” of hackers exploiting the flaw to infect public or private organizations. The directive adds to an earlier CISA order that establishes remediation requirements for flaws on internet-facing federal information systems.
Its lynchpin is the speed at which CISA is compelling agencies to audit their internal procedures to manage vulnerabilities and apply patches. Entities must review and update their processes within 60 days and remediate within six months for vulnerabilities with a Common Vulnerabilities and Exposures (CVE) ID assigned prior to 2021 and inside of two weeks for all other vulnerabilities. CISA said it might adjust the deadlines if the vulnerabilities present a “grave risk” to the federal government.
“These required actions apply to any federal information system, including an information system used or operated by another entity on behalf of an agency, that collects, processes, stores, transmits, disseminates, or otherwise maintains agency information,” the directive reads.
U.S. Government Agencies and Vulnerability Management: Requirements
In addition to the 60-day process review, here’s what agencies must do to comply with the order:
Here’s what CISA will do:
While not saying so directly, it’s clear that the high-profile cyber hijackings of the past few months have inspired the directive, particularly the SolarWinds Orion event that engulfed nine government agencies and cascaded to more than 100 businesses.
