All news with #cisa tag

CISA Strengthens Cyber Support for State and Local Govts

🔒 CISA has transitioned to a new direct-support model to equip state, local, tribal, and territorial (SLTT) governments with access to grant funding, no-cost cybersecurity tools, and hands-on expertise. The agency’s cooperative agreement with the Center for Internet Security concludes on September 30, 2025, and CISA will deliver funding via DHS/FEMA programs including SLCGP and TCGP. Offered services include cyber hygiene scanning, phishing assessments, vulnerability management, the Cybersecurity Performance Goals and Cyber Security Evaluation Tool, regional advisors and incident response coordination, while CISA continues collaboration with MS-ISAC for Albert sensor users.

CISA Strengthens Support for SLTT Governments Nationwide

🔒 CISA announced a transition to a new support model to better equip state, local, tribal, and territorial (SLTT) governments to strengthen shared responsibility nationwide. The agency's cooperative agreement with the Center for Internet Security (CIS) will end on September 30, 2025, prompting a shift to direct support. CISA will provide access to grant funding (via DHS/FEMA SLCGP and TCGP), no-cost tools such as cyber hygiene scanning and phishing assessments, regional advisors, and professional services to bolster local cybersecurity posture.

CISA Directs Agencies to Mitigate Cisco Device Risks

🚨 CISA issued Emergency Directive ED 25-03 directing federal agencies to identify, analyze, and mitigate potential compromises of Cisco ASA and Cisco Firepower devices after adding CVE-2025-20333 and CVE-2025-20362 to the Known Exploited Vulnerabilities Catalog. Agencies must inventory all devices (all versions) and collect memory/core dump files for forensic analysis, transmitting them to CISA by 11:59 p.m. EST on Sept. 26. CISA published supplemental guidance, an Eviction Strategies Tool template, and referenced Cisco and UK NCSC analyses to support containment, eviction, and remediation.

CISA: GeoServer RCE Exploit Led to Federal Agency Breach

🔒 CISA says attackers breached a U.S. federal agency after exploiting an unpatched GeoServer instance using the critical RCE flaw CVE-2024-36401. Threat actors uploaded web shells and access scripts, then moved laterally to compromise a web server and an SQL server. The intrusion remained undetected for three weeks until an EDR alert flagged suspected malware on July 31, 2024. CISA urges rapid patching of critical flaws and continuous EDR monitoring.

CISA Appoints Stephen Casapulla as Infrastructure Chief

🔔 The Cybersecurity and Infrastructure Security Agency (CISA) announced Stephen L. Casapulla as its new Executive Assistant Director for Infrastructure Security. Casapulla brings extensive federal experience, including service as Director for Critical Infrastructure Cybersecurity in the Office of the National Cyber Director and more than thirteen years at CISA and predecessor organizations. He also has prior roles at the Small Business Administration and the Department of State in Iraq, and over twenty years as a U.S. Navy Reserve officer. Casapulla will continue interim duties at the National Risk Management Center (NRMC) and serve as Acting Chief Strategy Officer.

CISA Issues Nine New ICS Advisories on Sep 18, 2025

🛡️ CISA released nine Industrial Control Systems (ICS) advisories on September 18, 2025, detailing vulnerabilities, exploits, and mitigations affecting multiple vendors and products. The advisories cover Westermo WeOS, Schneider Electric Saitel RTUs, Hitachi Energy Asset and Service Suites, Cognex In‑Sight devices, Dover Fueling Solutions ProGauge MagLink LX4 devices, plus updates for rail linking protocols and Mitsubishi FA engineering tools. Administrators and operators are urged to review the technical details and apply recommended mitigations promptly to reduce operational and safety risk.

OIG: CISA Wasted Millions and Mismanaged Incentives

🔍 The DHS Office of Inspector General (OIG) audit found that CISA misused federal funds and undermined its mission by broadly administering the Cyber Incentive program. The review identified 240 recipients in non-cyber support roles, poor record-keeping in OCHCO, and $1.4m in undocumented back pay among more than $138m disbursed since 2020. Payments typically ranged from $21,000 to $25,000 annually per person, more than 40% of staff received incentives, and the OIG issued eight recommendations to tighten eligibility, tracking, governance and recovery procedures; CISA has concurred with all recommendations.

CISA Publishes Strategic Roadmap for the CVE Program

🔒 CISA has published a strategic focus document, “CVE Quality for a Cyber Secure Future,” signaling federal support for the Common Vulnerabilities and Exposures (CVE) program and a shift from a growth-focused expansion to a defined Quality Era. The agency reaffirmed that the program should remain public and vendor‑neutral while evaluating potential mechanisms for diversified funding and taking a more active leadership role. The roadmap prioritizes automation, strengthened CNA services and CNAs of Last Resort, expanded API support, improved CVE.org capabilities, minimum data-quality standards and federated enrichment approaches such as Vulnrichment.

CISA Outlines Strategic Vision for CVE Program Quality

🛡️ CISA released "CISA Strategic Focus: CVE Quality for a Cyber Secure Future," a roadmap that shifts the CVE Program from its Growth Era to a Quality Era emphasizing trust, responsiveness, and improved vulnerability data. The plan highlights expanded community partnerships, potential diversified government sponsorship, technological modernization, and stronger transparency and communications. It also prioritizes data quality improvements, including standardized enrichment approaches such as Vulnrichment and expanded Authorized Data Publisher capabilities.

CISA Leads CVE Program: Mandate, Mission, Momentum

🔒CISA reaffirms federal leadership of the CVE Program, arguing that a neutral, government steward is essential to preserve trust and national security. The agency ties the program to operational initiatives such as the Known Exploited Vulnerabilities (KEV) Catalog and warns that privatization or fragmentation would erode reliability and increase risk. CISA outlines a shift from a 'Growth Era' to a 'Quality Era' focused on improving completeness, accuracy, timeliness, governance, and sustainable infrastructure, and invites practitioners, industry, and international partners to help shape the program's future.

CISA Priorities at 16th Billington CyberSecurity Summit

🔐 The Cybersecurity and Infrastructure Security Agency (CISA) will present senior leaders and experts at the 16th Annual Billington CyberSecurity Summit, Sept. 9–12 in Washington, D.C. Acting Director Madhu Gottumukkala and new Executive Assistant Director for Cybersecurity Nick Andersen will deliver fireside chats outlining CISA’s strategic objectives. Other sessions address vulnerability management, threat hunting, supply chain collaboration, and AI in code security. Registration is required.

CISA Issues Five ICS Advisories on Critical Vulnerabilities

⚠ CISA released five Industrial Control Systems (ICS) advisories on September 4, 2025, detailing vulnerabilities, impacts, and recommended mitigations for multiple OT products and protocols. The advisories address Honeywell OneWireless WDM, Mitsubishi Electric/ICONICS products, Delta Electronics COMMGR, Honeywell Experion PKS, and the End-of-Train/Head-of-Train Remote Linking Protocol. Several notices are updates (A/B) that include revised technical analysis and vendor-supplied mitigations. Administrators are urged to review the advisories promptly and apply recommended controls.

Fifteen Nations Agree Joint Guidance on SBOM Adoption

🔐 A coalition of 21 agencies from 15 countries, led by CISA and the NSA, published joint guidance titled A Shared Vision of Software Bill of Materials (SBOM) for Cybersecurity on September 3. The document defines SBOM concepts, clarifies roles for producers, choosers and operators, and urges cross-border adoption. It promotes harmonized technical implementations and integration of SBOMs into security workflows to reduce complexity and improve supply chain risk management.

CISA Adds TP-Link and WhatsApp Vulnerabilities to KEV

🔒 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a high‑severity flaw in TP‑Link TL‑WA855RE Wi‑Fi range extenders (CVE‑2020‑24363, CVSS 8.8) to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. The missing authentication issue lets an unauthenticated attacker on the same network submit a TDDP_RESET request to factory‑reset the device and set a new administrative password. CISA also added a WhatsApp vulnerability (CVE‑2025‑55177, CVSS 5.4) that was chained with an Apple platform flaw in a targeted spyware campaign; federal agencies must apply mitigations by September 23, 2025.

CISA Adds Two Vulnerabilities to KEV Catalog (Sept 2025)

⚠️ CISA added two vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog: CVE-2020-24363 affecting the TP-Link TL-WA855RE (missing authentication for a critical function) and CVE-2025-55177 affecting Meta Platforms' WhatsApp (incorrect authorization). These entries reflect evidence of active exploitation and significant risk to federal networks. Under BOD 22-01, FCEB agencies must remediate listed KEVs by the specified due dates. CISA urges all organizations to prioritize timely remediation.

CISA Names Nicholas Andersen Executive Cybersecurity Director

🔔 CISA announced the appointment of Nicholas Andersen as Executive Assistant Director for Cybersecurity, naming him to lead efforts to address major cyber threats and bolster critical infrastructure resilience. Andersen brings extensive public- and private-sector experience, including senior roles at Invictus and Lumen Technologies Public Sector, and prior service at the Department of Energy. He began at CISA on September 2, 2025; Chris Butera will assume the role of Acting Deputy Executive Assistant Director.

Top Cybersecurity Certifications to Advance a CISO Career

🔐 Certifications in cybersecurity validate expertise, increase credibility and can accelerate advancement into CISO roles. This article highlights five widely recognized credentials — CISSP, CCSP, CISM, CISA and the SANS/GIAC Strategic Planning, Policy and Leadership — and summarizes their primary focus areas and prerequisite experience. Experts advise selecting certifications that align with your career path, technical domain and leadership goals. While certifications are valued internationally (including in Germany), they complement rather than replace relevant experience and other leadership qualities.

DHS Launches $100M+ Funding to Strengthen Cybersecurity

🔐 CISA and FEMA announced the availability of more than $100 million in grant funding to bolster state, local, and tribal cybersecurity capabilities. The FY2025 Notice of Funding Opportunity includes the State and Local Cybersecurity Grant Program (SLCGP) with $91.7 million and the Tribal Cybersecurity Grant Program (TCGP) with $12.1 million. Awards may support planning, exercises, hiring cybersecurity experts, network hardening, and improvements to services provided to citizens. Applicants should consult CISA application resources to prepare proposals.

CISA Releases Thorium: Scalable Malware Analysis Platform

🛡️ CISA, in partnership with Sandia National Laboratories, released Thorium, an automated, scalable malware and forensic analysis platform that consolidates commercial, custom, and open-source tools into unified, automated workflows. Thorium is configured to ingest over 10 million files per hour per permission group and schedule more than 1,700 jobs per second, enabling rapid, large-scale binary and artifact analysis while maintaining fast query performance. It scales on Kubernetes with ScyllaDB, supports Dockerized tools and VM/bare-metal integrations, and enforces strict group-based access controls along with tag and full-text filtering for results.

CISA Releases Open-Source Eviction Strategies Tool

🛡️CISA published a no-cost Eviction Strategies Tool, developed with MITRE, to help cyber defenders build tailored incident response plans and adversary eviction strategies within minutes. The package includes COUN7ER, a database of atomic post-compromise countermeasures, and the Cyber Eviction Strategies Playbook NextGen web app to match findings to countermeasures. It exports results in JSON, Word, Excel and markdown and is available under the MIT Open Source License.