Week of June 26, 2023: CISA DDoS Alert, KEV Additions, and Election Security Shake-Up

Security leaders watched CISA publish a multi-sector DDoS warning, add eight actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, release nine industrial control systems advisories, and issue joint CI/CD pipeline guidance with the NSA, all within the same week the agency reshuffled its election security leadership. The agency also finalized cloud security guidance under its SCuBA project and published the 2023 CWE Top 25 list of dangerous software weaknesses, giving defenders a dense slate of advisories to track heading into the Fourth of July holiday.

CISA Warns of DoS and DDoS Attacks Across Multiple Sectors

On June 30, 2023, CISA published an alert noting open-source reporting of targeted denial-of-service and distributed denial-of-service attacks against organizations across multiple sectors. The agency said such attacks can cost organizations time and money and impose reputational costs while services are inaccessible, and urged administrators to contact network and internet service providers to confirm outages and apply mitigations such as firewall rules and traffic rerouting through DoS protection services. (CISA)

CISA Adds Eight Vulnerabilities to Known Exploited Vulnerabilities Catalog

On June 29, 2023, CISA added eight vulnerabilities—including flaws in D-Link routers and access points and six issues affecting Samsung mobile devices—to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The agency noted that Binding Operational Directive 22-01 requires Federal Civilian Executive Branch agencies to remediate catalog vulnerabilities by set deadlines, and it urged all organizations to prioritize timely remediation of these vulnerabilities as part of routine vulnerability management practice. (CISA)

CISA Issues Nine Industrial Control Systems Advisories

On June 29, 2023, CISA released nine Industrial Control Systems advisories covering products from vendors including Delta Electronics, Schneider Electric, Ovarro, Mitsubishi Electric, Medtronic, Rockwell Automation, and Enphase. The advisories detailed current security issues, vulnerabilities, and exploits affecting ICS environments and included updates to previously issued bulletins. CISA encouraged asset owners and administrators across critical infrastructure sectors to review the technical details and apply the recommended mitigations for each affected product line. (CISA)

CISA and MITRE Publish 2023 CWE Top 25 Software Weaknesses List

On June 29, 2023, the Homeland Security Systems Engineering and Development Institute, operated by MITRE for the Department of Homeland Security, released the 2023 CWE Top 25 Most Dangerous Software Weaknesses. The list was calculated from two years of public vulnerability data mapped to root-cause software weaknesses and incorporated updated data tied to CVEs in CISA's Known Exploited Vulnerabilities Catalog. CISA encouraged developers and product security teams to review the list and evaluate mitigations suited to their environments. (CISA)

CISA and NSA Release Guidance on Securing CI/CD Pipelines

On June 28, 2023, CISA and the National Security Agency released a joint Cybersecurity Information Sheet offering recommendations for strengthening continuous integration/continuous delivery pipeline security against malicious cyber actors. The guidance outlined common risks and attack surfaces within CI/CD environments that could be exploited to threaten network security, and the two agencies encouraged organizations to review the sheet and apply its recommended actions to their software development pipelines. (CISA)

CISA Shifts Election Security Leadership as Wyman Departs

On June 30, 2023, CISA Director Jen Easterly announced that Senior Advisor Cait Conley would take on additional responsibility for the agency's election security partnership engagement with state and local officials. The announcement came alongside news that Senior Election Security Lead Kim Wyman would depart CISA at the end of July 2023 for a private-sector opportunity after roughly a year and a half leading the agency's election security partnerships, with Wyman remaining an informal advisor afterward. (CISA)

CISA Finalizes Cloud Security Guidance Under SCuBA Project

On June 27, 2023, CISA released the first final guidance under its Secure Cloud Business Applications project, publishing the Technical Reference Architecture document and the Extensible Visibility Reference Framework Guidebook. The resources were meant to help public and private entities adopt cloud deployment, zero-trust architecture, and visibility practices that address gaps hampering cyber risk management, following input gathered during a 2022 public comment period on the drafts. (CISA)