Tag

Vulnerability Management

All articles tagged with #vulnerability management

technology1 month ago•4 min saved

Microsoft bets on AI-powered Windows vulnerability management to speed patches

Microsoft is expanding AI-driven vulnerability discovery across Windows to identify issues earlier, accelerate fixes, and deliver more frequent security updates via the MDASH harness and the ACS team, integrating vulnerability discovery into the development lifecycle while maintaining human review to ensure quality. The shift will raise the number of updates per release, challenging IT admins to test and deploy patches—and use Known Issue Rollback and tools like Windows Autopatch to balance speed with stability, even as some experienced engineers depart.

via ZDNET|

#ai #cybersecurity #patching

technology2 months ago•3 min saved

CISA Tightens Patch Timelines for Federal Agencies, Pushing Critical Flaws to Three‑Day Fixes

The Cybersecurity and Infrastructure Security Agency issued Binding Operational Directive 26-04, requiring U.S. Federal Civilian Executive Branch agencies to remediate high‑risk vulnerabilities with accelerated timelines—down to three days for publicly exposed, known‑exploited flaws and up to two weeks for less urgent cases. The directive supersedes older BODs and mandates updates to vulnerability management policies, asset inventories, and automated KEV/CVE reporting, with full adherence within 180 days and policy changes within 60 days. It covers on‑premises, third‑party hosted, and cloud environments while excluding certain military, intelligence, and contractor systems, signaling a broader industry patch‑priority shift.

via BleepingComputer|

#cisa #cvekev #federal-agencies

technology2 months ago•12 min saved

Risk-Based Patch Strategy Drives Federal Cyber Hygiene Under BOD 26-04

CISA's Binding Operational Directive 26-04 requires federal civilian agencies to prioritize vulnerability remediation based on risk, using the Known Exploited Vulnerabilities (KEV) Catalog and SSVC data while considering asset exposure, exploit automation, and technical impact. It establishes a three-phase rollout—immediate policy updates and automation (Phase I), process updates within 60 days (Phase II), and vulnerability remediation within 180 days (Phase III)—with automated reporting via the Continuous Diagnostics and Monitoring program and ongoing Cyber Hygiene practices. The directive supersedes BOD 19-02 and 22-01, aligns with OMB Circular A-130 and FISMA, and aims to harden federal networks against sophisticated cyber threats by focusing on high-risk vulnerabilities and maintaining asset tagging and exposure data.

via CISA (.gov)|

#cisa #kev-catalog #known-exploited-vulnerabilities

cybersecurity11 months ago•20 min saved

CISA Shares Key Lessons from Incident Response

CISA released a cybersecurity advisory sharing lessons learned from responding to a breach at a U.S. federal agency, highlighting the importance of prompt patching, effective incident response planning, and log management. The attack involved exploitation of CVE-2024-36401 in GeoServer, with threat actors gaining initial access, establishing persistence, and moving laterally within the network over three weeks before detection. CISA emphasizes immediate patching of known vulnerabilities, testing incident response plans, and implementing comprehensive logging to improve security posture and prevent similar incidents.

via CISA (.gov)|

#cisa #cybersecurity #geoserver

cybersecurity3 years ago•5 min saved

"Urgent: Strengthen UEFI Cybersecurity Now, Warns CISA"

The Cybersecurity and Infrastructure Security Agency (CISA) is urging the UEFI community to enhance cybersecurity measures for Unified Extensible Firmware Interface (UEFI), a critical software standard in modern computing. UEFI serves as an interface between hardware and operating systems, but attackers have exploited UEFI implementation flaws to gain persistence and maintain access to compromised systems. The community needs to implement public key infrastructure (PKI) practices for patch distribution and improve secure by design and Product Security Incident Response Team (PSIRT) maturity. System owners should be able to audit and update UEFI components, operational teams should collect and respond to UEFI-related event logs, UEFI component developers should adopt secure development practices, and the UEFI vendor community should ensure uninterrupted and reliable update capabilities.

via CISA|

#cybersecurity #firmware #malware