Week of March 20, 2023: CISA Ransomware Notifications and Cisco's Nine-Advisory Patch Batch

CISOs tracking the week of March 20, 2023 saw CISA disclose that it had notified more than 60 organizations of early-stage ransomware intrusions since January, publish thirteen industrial control systems advisories across two releases, and issue joint identity and access management guidance with the NSA, while Cisco pushed out nine security advisories spanning IOS XE and DNA Center. The same week, CISA's Cybersecurity Advisory Committee swore in new members including a former UK National Cyber Security Centre chief, and the agency marked one year of CIRCIA implementation with an update on the Joint Ransomware Task Force and Ransomware Vulnerability Warning Pilot.

Cisco Publishes Nine Security Advisories for IOS XE and Related Products

Cisco published security advisories on March 23, 2023 covering a cluster of vulnerabilities across IOS XE, IOS XE SD-WAN, DNA Center, wireless LAN controllers and Catalyst 9300 switches, among other products. CISA echoed the advisories the same day, warning that a remote attacker could exploit several of the flaws to gain control of an affected device. The bulletin listed nine separate advisories, spanning denial-of-service conditions, privilege escalation, command injection and a secure-boot bypass, giving network defenders a single reference point for patching priorities across widely deployed Cisco infrastructure that week. (Cybersecurity and Infrastructure Security Agency (CISA))

CISA Issues Seven ICS Advisories Covering Keysight, Siemens and Rockwell Automation

On March 21, 2023, CISA published seven industrial control systems advisories covering products from Keysight, Delta Electronics, Siemens, VISAM, Rockwell Automation and Hitachi Energy. The bulletins detailed current vulnerabilities and exploits affecting operational technology used across manufacturing, energy and other critical infrastructure sectors. For CISOs responsible for OT environments, the advisories offered technical specifics and mitigation steps covering devices such as SIPROTEC 5 relay clients, ThinManager deployments and SCALANCE network gear, underscoring the breadth of ICS exposure that continued to demand attention alongside enterprise IT patching cycles. (Cybersecurity and Infrastructure Security Agency (CISA))

Second ICS Advisory Batch Covers RoboDK, Schneider Electric and ABB

Two days later, on March 23, 2023, CISA issued a second batch of six ICS advisories, this time covering RoboDK, CP-Plus KVMS Pro, SAUTER building automation stations, Schneider Electric IGSS, ABB's Pulsar Plus controller and ProPump and Controls' Osprey pump controller. The advisories gave administrators of building automation, water system and manufacturing equipment technical details on current security issues and exploits. Combined with the advisories issued two days earlier, the week's ICS output gave operational technology teams thirteen separate bulletins to triage across multiple vendors and sectors. (Cybersecurity and Infrastructure Security Agency (CISA))

CISA Reports Over 60 Pre-Ransomware Notifications Since January

CISA detailed the results of its Pre-Ransomware Notification Initiative on March 23, 2023, reporting that the agency had notified more than 60 organizations of early-stage ransomware intrusions since the start of January 2023. The notified entities spanned the energy, healthcare and public health, water and wastewater, and education sectors. The initiative relies on tips from the cybersecurity research community and threat intelligence companies, allowing CISA field personnel to warn victims before ransomware actors encrypt data, giving organizations a window to evict intruders before damage occurs. (Cybersecurity and Infrastructure Security Agency (CISA))

CISA Realigns Cybersecurity Performance Goals to NIST Framework

CISA published updated Cross-Sector Cybersecurity Performance Goals on March 21, 2023, restructuring the voluntary practices first issued in October to align with the five NIST Cybersecurity Framework functions of Identify, Protect, Detect, Respond and Recover. The reorganization and renumbering were intended to help businesses and critical infrastructure owners more easily prioritize security investments within a broader program built around the NIST framework. CISA urged stakeholders to review the refreshed goals, which remain voluntary rather than mandatory for the organizations the agency works with. (Cybersecurity and Infrastructure Security Agency (CISA))

CISA Marks One Year of CIRCIA Implementation Work

CISA Executive Director Brandon Wales marked the first anniversary of the Cyber Incident Reporting for Critical Infrastructure Act on March 24, 2023, reviewing the law's operational milestones. He noted that CISA and the FBI had established the Joint Ransomware Task Force in September 2022 and that CISA had launched its Ransomware Vulnerability Warning Pilot in January 2023 to identify systems already containing vulnerabilities favored by ransomware actors. The post also confirmed that proposed CIRCIA incident-reporting regulations remained on track for a Notice of Proposed Rulemaking by March 2024. (Cybersecurity and Infrastructure Security Agency (CISA))