Week of November 20, 2023: Citrix Bleed Hits Boeing, CISA-NCSC Unveil Secure AI Guidelines

The week of November 20, 2023, was dominated by a joint CISA-FBI advisory tying LockBit 3.0 ransomware affiliates to Citrix Bleed exploitation disclosed by Boeing, alongside CISA and the UK NCSC publishing their first joint guidelines for secure AI system development. CISOs also tracked Adobe ColdFusion and Mozilla Firefox/Thunderbird patches, five new ICS advisories, a GNU C Library addition to the KEV catalog, and CISA's relaunch of its Cybersecurity Insurance and Data Analysis Working Group.

CISA and UK NCSC Issue Joint Guidelines for Secure AI Development

On November 26, 2023, CISA and the UK National Cyber Security Centre published Guidelines for Secure AI System Development, co-sealed by 23 domestic and international cybersecurity organizations. The guidance applies secure-by-design principles to all types of AI systems, not just frontier models, targeting data scientists, developers, managers, and risk owners responsible for machine learning systems. It is organized around four lifecycle stages: secure design, secure development, secure deployment, and secure operation and maintenance, complementing earlier U.S. voluntary commitments on AI safety. (CISA)

CISA, FBI Detail LockBit Exploitation of Citrix Bleed After Boeing Disclosure

On November 21, 2023, CISA, the FBI, MS-ISAC, and Australia's ACSC released a joint advisory on LockBit 3.0 affiliates exploiting CVE-2023-4966, the Citrix Bleed vulnerability in NetScaler ADC and Gateway appliances. The advisory incorporated tactics, techniques, and indicators of compromise voluntarily shared by Boeing, which reported that LockBit affiliates used the flaw to gain initial access to its Distribution Inc. unit, a separate environment within its parts and distribution business. Citrix Bleed allows attackers to bypass passwords and multifactor authentication by hijacking legitimate user sessions. (CISA)

CISA Urges Patching After Adobe ColdFusion Security Updates

On November 22, 2023, CISA advised organizations to apply Adobe's security updates for unpatched ColdFusion software, released November 14, 2023 under bulletin APSB23-52. CISA warned that exploitation of some of the addressed vulnerabilities could let a malicious cyber actor take control of an affected system. Recommended actions included applying the updates, following ColdFusion hardening lockdown guides, and adding a web application firewall filter for CFIDE for external users. (CISA)

Mozilla Patches Firefox and Thunderbird Against Takeover Risks

On November 22, 2023, CISA flagged Mozilla's security updates for Firefox and Thunderbird, warning that a cyber threat actor could exploit some of the fixed vulnerabilities to take control of an affected system. The advisory pointed administrators to Firefox iOS 120, Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5.0, urging prompt application of the updates across enterprise deployments. (CISA)

CISA Releases Five Industrial Control Systems Advisories

CISA published five Industrial Control Systems advisories on November 21, 2023, covering WAGO's PFC200 series, Fuji Electric's Tellus Lite V-Simulator, an update to the Mitsubishi Electric CNC Series, an update to Keysight's N8844A Data Analytics Web Service, and an update to Rockwell Automation's Stratix 5800 and Stratix 5200 switches. CISA encouraged asset owners and administrators to review each advisory for technical details and mitigations relevant to operational technology environments. (CISA)

CISA Adds GNU C Library Flaw to Known Exploited Vulnerabilities Catalog

CISA added CVE-2023-4911, a GNU C Library buffer overflow vulnerability, to its Known Exploited Vulnerabilities Catalog on November 21, 2023, citing evidence of active exploitation. Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies must remediate catalog vulnerabilities by set deadlines, and CISA urged all organizations to prioritize timely remediation of the flaw as part of standard vulnerability management practice. (CISA)

CISA Deputy Director Announces Relaunch of Cybersecurity Insurance Working Group

On November 20, 2023, CISA Deputy Director Nitin Natarajan announced that the agency would relaunch its Cybersecurity Insurance and Data Analysis Working Group, originally created in 2014, following a Treasury Federal Insurance Office conference on catastrophic cyber risk. The re-envisioned group will partner with Stanford's Empirical Security Research Group to correlate loss data with security controls effectiveness, informing insurer risk analysis and CISA's assessment of whether programs like Secure by Design are reducing cyber risk exposure. The relaunch was planned for December. (CISA)