Week of November 21, 2022: CISA's KEV Update and the Hive Ransomware Advisory

Security leaders tracking the week of November 21, 2022 saw CISA add a single actively-exploited vulnerability to its Known Exploited Vulnerabilities Catalog, publish eight new Industrial Control Systems advisories, and join the FBI and HHS in a Hive ransomware advisory describing over 1,300 victim organizations. The same week also brought a confirmed guest-data breach at hospitality company Sonder, a new Chief Information Officer named at New York City's Department of Finance, and a European Commission briefing on the forthcoming Cyber Resilience Act.

CISA Adds Single Vulnerability to Known Exploited Vulnerabilities Catalog

On November 21, 2022, CISA added one new vulnerability to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation. Binding Operational Directive 22-01 required federal civilian agencies to remediate catalog entries by set deadlines, and CISA again urged all organizations to treat the catalog as a vulnerability-management priority rather than a federal-only requirement. The single-item update kept the KEV list as the principal benchmark CISOs used that week when triaging patch backlogs against documented in-the-wild exploitation. (CISA)

CISA Publishes Eight ICS Advisories Covering AVEVA, GE, Moxa and More

On November 22, 2022, CISA released eight Industrial Control Systems advisories spanning AVEVA Edge, Digital Alert Systems DASDEC, Phoenix Contact Automation Worx, GE Cimplicity, Moxa ARM-based computers, Hillrom medical device management, and two updates for Mitsubishi Electric factory-automation engineering products. Each advisory detailed vulnerabilities and mitigations for operational-technology environments, giving CISOs overseeing manufacturing, healthcare, and utility networks a single batch of technical guidance to route to OT security teams for the week. (CISA)

New York City's Finance Department Names New Chief Information Officer

On November 23, 2022, NYC Department of Finance Commissioner Preston Niblack announced Caroline Carney as the agency's new Deputy Commissioner and Chief Information Officer. Carney, who had served as acting CIO, took on oversight of the department's IT, application, network, and cybersecurity teams supporting its tax, property-valuation, and treasury operations. The appointment placed a long-serving internal technology leader in charge of the agency's data-security posture heading into the following budget cycle. (NYC Department of Finance)

Hospitality Company Sonder Confirms Guest-Data Breach

On November 23, 2022, hospitality company Sonder published a security update confirming unauthorized access to one of its systems, discovered November 14, 2022. Sonder said guest records created before October 1, 2021, were involved, including usernames, encrypted passwords, names, phone numbers, birth dates, addresses, partial card numbers, booking dates, and in some cases copies of government-issued identification. The company said it contained the access, began notifying affected users and regulators, and contacted law enforcement. (Infosecurity Magazine)

European Commission Briefs Industry on Upcoming Cyber Resilience Act

On November 22, 2022, the European Commission's Connect University program hosted a session explaining the proposed Cyber Resilience Act, the EU's forthcoming hardware and software security rules, with policy officers from the Cybersecurity and Digital Privacy Policy unit presenting the proposal and its annexes. Materials from the session, including slides and a recording link, were published afterward for security and compliance professionals tracking the regulation's progress toward mandatory security requirements for connected products sold in the EU. (European Commission)