Week of June 17, 2024: CISA Network Access Guidance, New CISOs at Reco and ARPA-H

Security leaders tracked CISA's joint guidance on modern network access security alongside new CISO appointments at Reco and the Advanced Research Projects Agency for Health during the week of June 17, 2024. The agency also published election-security communications guidance, SSO adoption research for small businesses, and four industrial-control-system advisories covering Juniper, Yokogawa, CAREL, Westermo, and RAD Data Communications products.

Reco Names Merritt Baer First CISO; ARPA-H Appoints Chris Pashley

Data security startup Reco named Merritt Baer as its first Chief Information Security Officer, moving from more than five years in Amazon Web Services' Office of the CISO. Also joining a CISO role, the Advanced Research Projects Agency for Health appointed Chris Pashley, where he will help build the agency's internal cybersecurity program. Pashley previously held cybersecurity leadership roles at the Cybersecurity and Infrastructure Security Agency and U.S. Customs and Border Protection. The two appointments reflected continued movement of experienced federal and cloud-security leaders into dedicated CISO roles at startups and government agencies alike. (SecurityWeek)

CISA, FBI, and International Partners Issue Network Access Security Guidance

CISA, together with the FBI, New Zealand's GCSB and CERT-NZ, and the Canadian Centre for Cyber Security, published joint guidance titled Modern Approaches to Network Access Security. The document urged organizations of all sizes to move toward Zero Trust, Secure Service Edge, and Secure Access Service Edge architectures that provide greater visibility into network activity. It also detailed vulnerabilities and risks tied to traditional remote access and VPN deployments, including the business exposure created by remote access misconfiguration, and encouraged leaders to prioritize protection of remote computing environments. (CISA)

CISA and EAC Release Election Security Communications Guide

CISA and the U.S. Election Assistance Commission released a guide, Enhancing Election Security Through Public Communications, aimed at state, local, tribal, and territorial election officials. The guide offered a framework and practical worksheets for building a year-round communications plan that conveys accurate information about how elections are administered and secured. It emphasized that election officials, as the trusted authoritative sources on voting logistics and security measures, needed prepared teams capable of answering media and public questions effectively ahead of the 2024 election cycle. (CISA)

CISA Pushes SSO Adoption Guidance for Small and Midsize Businesses

CISA released a report, Barriers to Single Sign-On Adoption for Small and Medium-Sized Businesses: Identifying Challenges and Opportunities, examining why SMBs often skip SSO despite its security benefits. An accompanying blog post urged software manufacturers to make single sign-on available as a basic feature rather than a paid add-on, warning that premium pricing for essential security functions can discourage adoption. The agency pointed to CISA's Secure by Design initiative and said manufacturers should reduce operational friction that keeps smaller organizations locked out of stronger identity protections. (CISA)

CISA Flags Juniper Secure Analytics Vulnerabilities

Juniper Networks published a security bulletin addressing multiple vulnerabilities in the optional applications bundled with Juniper Secure Analytics. CISA flagged the bulletin, warning that a threat actor could exploit one of the flaws to take control of an affected system. The agency pointed administrators to Juniper Security Bulletin JSA82681 for technical details and urged users running the optional analytics applications to apply the vendor's updates without delay to reduce exposure. (CISA)

CISA Issues ICS Advisories for Yokogawa, CAREL, and Westermo

CISA published three Industrial Control Systems advisories covering Yokogawa CENTUM, CAREL Boss-Mini, and Westermo L210-F2G products. Each advisory detailed current vulnerabilities and provided mitigation guidance for operators running the affected equipment. The releases formed part of CISA's regular cadence of ICS advisories meant to give asset owners early notice of exploitable weaknesses in control-system products used across manufacturing, building automation, and networking environments. (CISA)

CISA Warns on RAD Data Communications SecFlow-2 Advisory

CISA issued a separate Industrial Control Systems advisory for RAD Data Communications' SecFlow-2 product, outlining vulnerabilities affecting the device. As with its other industrial-control releases issued in the same period, the agency encouraged users and administrators to review the advisory for technical specifics and apply recommended mitigations. The advisory was one of several ICS notices covering networking, refrigeration, and process-control equipment from multiple vendors published within the same days. (CISA)