Week of May 15, 2023: CISA's BianLian Advisory and JD Sports' Interim CISO

During the week of May 15, 2023, security leaders tracked a joint BianLian ransomware advisory from CISA, the FBI, and the Australian Cyber Security Centre, three new CISA Known Exploited Vulnerabilities Catalog entries affecting Cisco and Samsung products, eight total CISA industrial control systems advisories, and a Cisco Small Business Switches advisory, alongside JD Sports' disclosure of an interim chief information security officer appointment following its January breach. Federal officials also marked cyber workforce achievement, naming the winners of the fourth annual President's Cup Cybersecurity Competition at the White House.

CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog

On May 19, 2023, CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: a Cisco IOS denial-of-service flaw (CVE-2004-1464), a Cisco IOS/IOS XR/IOS XE IKEv1 information disclosure flaw (CVE-2016-6415), and a Samsung Mobile Devices log file vulnerability (CVE-2023-21492). The agency's Binding Operational Directive 22-01 required federal civilian executive branch agencies to remediate catalog entries by set deadlines, and CISA urged all organizations to prioritize the same fixes as part of ongoing vulnerability management. (CISA)

Cisco Advisory Flags Critical Flaws in Small Business Switches

On May 19, 2023, Cisco published a security advisory covering multiple vulnerabilities in the web-based user interface of certain Small Business Series Switches. CISA relayed the advisory, warning that a remote attacker could exploit the flaws to cause a denial-of-service condition or execute arbitrary code with root privileges on an affected device. The agency encouraged users and administrators to review the Cisco Small Business Series Switches Buffer Overflow Vulnerabilities advisory and apply the necessary updates without delay. (CISA)

CISA, FBI, and ACSC Issue Joint BianLian Ransomware Advisory

On May 16, 2023, CISA, the FBI, and the Australian Cyber Security Centre released a joint Cybersecurity Advisory detailing technical indicators and tactics used by the BianLian ransomware and data extortion group, with contributions from Microsoft and Sophos. The advisory, part of CISA's ongoing #StopRansomware effort, recommended mitigations aligned with the Cross-Sector Cybersecurity Performance Goals developed by CISA and NIST, giving network defenders concrete steps to reduce the likelihood and impact of BianLian and similar ransomware incidents. (CISA)

CISA Publishes Five ICS Advisories Covering Gavazzi, Mitsubishi, Hitachi, Johnson Controls, Rockwell

CISA released five Industrial Control Systems advisories on May 16, 2023, covering Carlo Gavazzi Powersoft, Mitsubishi Electric MELSEC WS, Hitachi Energy MicroSCADA Pro/X SYS600, Johnson Controls OpenBlue Enterprise Manager Data Collector, and an update to a Rockwell Automation FactoryTalk Diagnostics advisory. The bulletins, announced May 18, 2023, gave operators of industrial and critical-infrastructure equipment technical details on current vulnerabilities and exploits, prompting CISA to encourage administrators to review the advisories and apply the recommended mitigations promptly. (CISA)

CISA Releases Three Additional ICS Advisories for Snap One and Rockwell Products

CISA also released three separate Industrial Control Systems advisories on May 16, 2023, addressing Snap One OvrC Cloud, Rockwell ArmorStart, and Rockwell Automation FactoryTalk Vantagepoint. The advisories outlined current security issues, vulnerabilities, and exploits affecting the named products and urged users and administrators overseeing operational technology environments to consult the technical details and mitigations before the vulnerabilities could be leveraged against critical infrastructure networks. (CISA)

JD Sports Appoints Interim CISO Amid Post-Breach Security Overhaul

In a regulatory filing published May 17, 2023, JD Sports said it had appointed an interim chief information security officer to oversee a strengthening of its cyber security posture while the retailer continued searching for a permanent CISO, alongside a separate search for a chief information technology officer. The filing followed a January 2023 cyber incident and disclosed that JD Sports had engaged Boston Consulting Group to help design a "better-integrated cyber vendor ecosystem" across its retail brands, which include JD, Go Outdoors, Size?, Blacks, Scotts, and Millets. (IT Pro)

CISA and ONCD Crown Fourth Annual President's Cup Cybersecurity Champions

At a White House ceremony held Monday, May 15, 2023, CISA and the Office of the National Cyber Director awarded the winners of the fourth annual President's Cup Cybersecurity Competition. Individual honors went to Ben Marks of the National Security Agency in the defensive track and Army Chief Warrant Officer 1 Andrew Fricke of the 781st Military Intelligence Battalion in the offensive track, while the U.S. Army's 780th Military Intelligence Brigade won the team competition for the third consecutive year, recognizing standout cyber talent across the federal workforce. (CISA)