Week of May 1, 2023: CISA KEV additions and NFL Draft security deployment

Security leaders tracked CISA's addition of three actively exploited vulnerabilities, including an Apache Log4j2 flaw, to its Known Exploited Vulnerabilities Catalog, alongside new ICS advisories covering Mitsubishi Electric and Dataprobe products. CISA also pressed organizations to adopt the FCC's Covered List, urged small businesses to enable multifactor authentication, and helped secure the NFL Draft with newly deployed physical barrier technology.

CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog

On May 1, 2023, CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: a command injection flaw in TP-Link Archer AX-21 routers (CVE-2023-1389), an Apache Log4j2 deserialization vulnerability (CVE-2021-45046), and an unspecified Oracle WebLogic Server vulnerability (CVE-2023-21839). The addition triggered Binding Operational Directive 22-01 remediation deadlines for federal civilian agencies, while CISA urged all organizations to prioritize patching these entries as part of standard vulnerability management practice. (CISA)

CISA Urges Supply Chain Teams to Adopt FCC Covered List

On May 1, 2023, as National Supply Chain Integrity Month concluded, CISA urged critical infrastructure owners and operators to incorporate the FCC's Covered List into their supply chain risk management programs. The agency pointed organizations toward its joint guidance with NIST, Defending Against Software Supply Chain Attacks, and encouraged enrollment in CISA's free Vulnerability Scanning service to identify high-risk devices, including those named on the FCC list of communications equipment and services deemed to pose an unacceptable national security risk. (CISA)

CISA Issues ICS Advisory for Mitsubishi Electric Factory Automation Products

On May 2, 2023, CISA released an industrial control systems advisory covering vulnerabilities in Mitsubishi Electric Factory Automation Products, urging asset owners and operators to review the technical details and apply the listed mitigations. The advisory was part of CISA's ongoing effort to flag current security issues, vulnerabilities, and exploits affecting operational technology environments relied upon by manufacturers and critical infrastructure operators. (CISA)

CISA Cybersecurity Lead Urges Small Businesses to Adopt MFA, Drop On-Prem Mail

In a blog posted May 2, 2023 timed to Small Business Week, CISA Executive Assistant Director for Cybersecurity Eric Goldstein urged small and medium businesses to enable multifactor authentication across all accounts and to migrate on-premises mail and file-storage systems to secure cloud services such as Google Workspace or Microsoft 365. Goldstein cited ransomware's disproportionate harm to SMBs and said total cybercrime costs to small businesses reached $2.4 billion in 2021, calling for technology vendors to ship products that are secure by design and default. (CISA)

DHS, Army, and NFL Deploy New Barrier Tech for 2023 NFL Draft Security

In a press release dated May 4, 2023, CISA detailed how the agency, DHS Science and Technology Directorate, and the U.S. Army Engineer Research and Development Center worked with the NFL and Kansas City officials to deploy two new physical security products, the RAPID barrier and the DETER traffic regulator, to protect the 88th annual NFL Draft. CISA said the draft and similar sporting events concluded without major incident, while noting that open-source reporting has tracked numerous bomb threats at sports venues in recent years. (CISA)