Week of May 9, 2022: EU negotiators agree NIS2, and the US ties SATCOM attacks to Russia

What mattered to security leaders in the week of May 9, 2022? On May 13 the Council of the EU and the European Parliament struck a provisional deal on NIS2, which pulls every medium-sized and large company in covered sectors under common cyber rules, and on May 10 the US formally attributed the February attacks on commercial satellite networks to Russia. Five Eyes agencies also published joint guidance on threats to managed service providers, and attackers moved quickly on a critical F5 BIG-IP flaw.

EU reaches a provisional agreement on the NIS2 directive

On May 13 the Council and the European Parliament agreed on NIS2, the replacement for the original NIS directive. It sets baseline risk-management and incident-reporting duties across covered sectors such as energy, transport, health and digital infrastructure, and replaces member-state designation with a size-cap rule so that all medium-sized and large entities in those sectors fall in scope. Central and regional public administrations are included, and the text formally creates the EU-CyCLONe crisis network. Member states would get 21 months after entry into force to transpose it. (Council of the European Union)

US attributes February's satellite network attacks to Russia

CISA and the FBI updated their March 17 advisory on securing satellite communications with a formal US government attribution on May 10. Washington assessed that Russia attacked commercial SATCOM networks in late February to disrupt Ukrainian command and control during the invasion, and that the attacks spilled over into other European countries. CISA pointed operators to its January guidance on VSAT communications and its Shields Up material. The case showed how an attack aimed at one military could degrade civilian services across a continent. (CISA)

Five Eyes agencies publish joint guidance on MSP risk

Cyber authorities from the UK, Australia, Canada, New Zealand and the US (CISA, NSA and FBI) said on May 11 that they were seeing more malicious activity aimed at managed service providers and expected the trend to continue. Their advisory, AA22-131A, gave MSPs and customers immediate steps: disable unused accounts, enforce MFA on MSP accounts that reach into customer environments while watching for unexplained failed logins, and make contracts spell out who owns each security responsibility. It gave customers a checklist to bring to their next MSP contract review. (CISA)

Exploit attempts follow proof-of-concept code for F5 BIG-IP CVE-2022-1388

By May 9 researchers had built working exploits for CVE-2022-1388, a critical flaw that lets an unauthenticated remote attacker take over F5 BIG-IP devices, run system commands, create or delete files and disable services, and in-the-wild exploitation attempts had been spotted. F5 had patched it the previous week. Researchers noted that attempts were not limited to management interfaces, so boxes configured as load balancers and firewalls through a self IP could also be exposed. Internet-facing BIG-IP fleets needed patching or the vendor's mitigations without delay. (Help Net Security)

CISA pulls a Patch Tuesday bug from KEV after domain controller login failures

On May 13 CISA temporarily removed CVE-2022-26925 from its Known Exploited Vulnerabilities catalog because Microsoft's May 10 rollup could cause authentication failures when installed on domain controllers. Affected services included Network Policy Server, Routing and Remote Access, RADIUS, EAP and PEAP; Microsoft traced the problem to how domain controllers mapped certificates to machine accounts. CISA stressed that client devices and servers that are not domain controllers should still receive the May 10 updates. It was a rare case of the federal patch mandate bending to operational risk. (CISA)

Lincoln College shuts on May 13 after ransomware and pandemic losses

Lincoln College, a 157-year-old liberal-arts school in rural Illinois, set May 13, 2022 as the date it would close, citing the financial toll of COVID-19 and a December 2021 ransomware attack. The college said the attack blocked admissions work and access to institutional data, leaving every system needed for recruitment, retention and fundraising inoperable; by the time systems were restored in March 2022, enrollment projections showed significant shortfalls. It said no personal identifying information was exposed. The closure is a stark reference point for how long recovery can outlast the attack itself. (BleepingComputer)