CyberWire Daily - CISA Alert AA22-137A – Weak security controls and practices routinely exploited for initial access. [CISA Cybersecurity Alerts]

Episode Date: May 17, 2022

This joint cybersecurity advisory was coauthored by the cybersecurity authorities of the US, Canada, New Zealand, the Netherlands, and the UK. Cyber actors routinely exploit poor security configurations, weak controls, and other poor cyber hygiene practices to gain initial access or as part of other tactics to compromise a victim’s system. This joint Cybersecurity Advisory identifies commonly exploited controls and practices, and includes best practices to mitigate these risks. AA22-137A Alert, Technical Details, and Mitigations White House Executive Order on Improving the Nation’s Cybersecurity NCSC-NL Factsheet: Prepare for Zero Trust NCSC-NL Guide to Cyber Security Measures N-able Blog: Intrusion Detection System (IDS): Signature vs. Anomaly-Based NCSC-NL Guide to Cyber Security Measures National Institute of Standards and Technology SP 800-123 – Keeping Servers Secured NCSC-UK Guidance – Phishing Attacks: Defending Your Organisation  Open Web Application Security Project (OWASP) Proactive Controls: Enforce Access Controls All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at [e-mail] or [phone] and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at [phone] or [e-mail]. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Canada, New Zealand, the Netherlands, and the UK. Cyber actors routinely exploit poor security configurations, weak controls, and other poor cyber hygiene practices to gain initial access as a part of other tactics to compromise a victim's system. This joint cybersecurity advisory identifies commonly exploited controls and practices and includes best practices to mitigate these risks. The alert documentation defines 10 major exploitation vectors regularly used by malicious cyber actors. defines 10 major exploitation vectors regularly used by malicious cyber actors. In order to mitigate these vectors, CISA outlines and provides resources for 18 security controls under 7 control categories.

CISA recommends organizations re-evaluate their security posture and implement additional controls under the categories of Control Access Implement Credential Hardening Establish Centralized Log Management of control access, implement credential hardening, establish centralized log management, employ antivirus programs, employ detection tools and search for vulnerabilities, maintain rigorous configuration management programs, and initiate a software and patch management program. Implementing the 18 security best practices under these critical control categories can help organizations strengthen their network defenses against commonly exploited and weak security controls.

The alert documentation and resources linked in the show notes provide additional guidance for establishing effective mitigation tactics and procedures. Organizations should report incidents and anomalous activity to CISA's 24-7 Operations Center at central at cisa.dhs.gov or 888-282-0870. And to the FBI via your local FBI field office or the FBI's 24-7 CyWatch at 855-292-3937 or cywatch at fbi.gov. This report was written by CISA, the United States Cybersecurity and Infrastructure Security Agency, and edited and adapted for audio by the Cyber Wire as a public service. Please visit www.cisa.gov to read the full report, which may include additional details, links, and illustrations. A link to this report can be found in the show notes. This has been a CISA Cybersecurity Alert.