Government
,
Industry Specific
,
Network Firewalls, Network Access Control
Binding Directive Requires Inventories and Replacements
U.S. federal agencies have 12 months to start replacing risky network appliances running past their vendor support cutoff date under a directive published Thursday by the U.S. Cybersecurity and Infrastructure Security Agency.
See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.
The cybersecurity agency targeted out-of-date firewalls, routers, switches, IoT edge devices, VPNs and network gateways that sit on the perimeters of agency networks in Binding Operational Directive 26-02.
Network appliances have become a recurring motif in recent nation-state and advanced criminal hacking campaigns as threat actors discovered they typically lack antimalware or other endpoint detection and response capabilities, are opaque to system administrators and can themselves suffer from sloppily-built internals.
The directive comes on the heels of a surge in attacks against internet-facing edge devices, which attackers increasingly exploit soon after vulnerabilities are disclosed. Recent vulnerabilities in Fortinet’s FortiSIEM security information and event management appliances were exploited within days of patch releases.
“Persistent cyberthreat actors, including those with ties to nation states, are increasingly exploiting unsupported edge devices,” said Nick Andersen, CISA’s executive assistant director for cybersecurity, during a media briefing. “Once an edge device is exploited, threat actors can gain initial access to networks, move laterally, disrupt operations and exfiltrate sensitive data.”
The directive outlines a series of actions agencies must take within specified timeframes to strengthen asset lifecycle management for active edge devices. “Unsupported devices should never remain on enterprise networks,” Anderson said.
The directive orders agencies to update supported devices immediately and gives them three months to create edge device inventories and identify those that are end-of-support. Within 12 to 18 months, all unsupported devices must be decommissioned and replaced with vendor-supported devices that receive security updates. It sets up a two-year timeline for the establishment of a continuous discovery and maintenance process to ensure continued compliance.
“This isn’t a response to any one incident or compromise, but a recognition that end-of-support devices pose such a serious risk to federal systems,” Andersen said.
CISA acknowledged that replacing unsupported hardware across federal agencies is a costly undertaking. The phased timeline is intended to give agencies some budgetary wiggle room on the timing of their investments.
“While the threat definitely demands timely action, we also recognize that this is a significant undertaking,” Anderson said. “In many cases, this may require investing in new devices.”
CISA will monitor agency compliance and work with the Office of Management and Budget and agency leadership to support implementation. Anderson said that the effort is intended to be collaborative rather than punitive.
“This is not about waving a big stick and forcing agencies to do something,” he said. “This is part of the collective responsibility that we have, working alongside CIOs and CISOs, CFOs and agency leaders as well as our OMB colleagues, to make sure that we have an or well-orchestrated whole of government effort to be able to meet the challenges that we’re seeing in cyberspace today.”