CISA KEV Catalog Hits 860 After 13 Months

Top 10 vendors and vulnerable products

CISA starts to share KEV catalog to public back in Nov 3, 2021. There are total of 860 cve been added into KEV catalog after 13 months (849 cve by Nov 3).

Too many organizations are relying on the Common Vulnerability Scoring System, developed at FIRST.org, to decide when it is time to patch.Vulnerabilities with a Low/Medium CVSS score are often ignored completely or deferred to another time, while a vulnerability with a 7.0 and above generates a hair-on-fire “patch now” event.

And this is the reason why patches just don’t get applied in a timely fashion all the time.

It is time we reexamine each of our vulnerability management programs to assure we are not letting impactful and known CVEs continue to exist in our networks long past the time that vendor fixes are available. We need to evolve our practices to incorporate capabilities such as KEV into our operational vulnerability analysis decision making.

The screenshot above shows the top 10 vulnerable products and the vendors within the KEV catalog. And I have shared the script at GitHub back in April 2022.

Links:

• CISA Known Exploited Vuln Catalog
• Ancient CVEs Can Cause You Problems
  

8 Essential Tips for Securing Networks

Here're the 8 tips I copied from Rapid7 for "emergency field security" that any defenders can take immediately. 

Given the urgency, many information security teams find themselves scrambling to prioritize mitigation actions and protect their networks. Some may not have time to make their networks less flat, patch all the vulnerabilities, set up a backup plan, encrypt all the data at rest, and practice a incident response scenarios before disaster strikes. 

With essential security, it helps identifying urgent steps to take right now.

1. Starts prioritize those patches with CISA's KEV.
   
2. Keep an eye on egress.
3. Review Active Directory (AD) groups.
4. Don't laugh off LOL.
5. Don't push it.
6. Stick to the script.
7. Call for backup.
8. Practice good posture.
   

Links

• 8 Tips for Securing Networks When Time Is Scarce
• Project Doppler
  

Essential Security from CISA and NSA

CISA and NSA have published a lot of good resources for Cybersecurity. For example,  an advanced persistent threat (APT) that capable to gain full access to multiple ICS/SCADA was discovered recently.

The tool enable the APT actors to scan for, compromise, and control affected devices once they have established access to the OT network. Here's the technical details of the APT tools for Schneider Electric devices:

• Interact via management protocols and Modbus (502/tcp)
• Identifies PLCS via multicast 27127/udp
• Brute-force using CODESYS via 1740/udp
• Conduct DoS to PLC
• Conduct a 'packet-of-death' attach to crash the PLC
• Send custom Modbus commands
  

Proactive mitigations against APT tools that targeting ICS/SCADA devices

•  Isolate ICS/SCADA from corporate and Internet networks
• Enforce multi-factor authentication
• Prepare and exercise cyber incident plan
• Regular update of password, especially all detail passwords.
• Maintain known-good offline backup
• Implement robust log collection and retention
• Deploy Device Guard, Credential Guard, and Hypervisor Code Integrity (HVCI)
• Leverage continuous OT monitoring and alert
• Enforce principle of least privilege

Links:

• APT Cyber Tools Targeting ICS/SCADA Devices
• Layering Network Security
• Stop Malicious Cyber Activity Against Connected OT
• Reduce Exposure Across all OT and CS
  

3 Days Left to Patch

There are 66 vulnerabilities is going to reach the deadline on April 15 based on the CISA KEV Directive.

These include:

• 7 vulnerabilities from Microsoft including the SMBv1 vulnerability (CVE-2017-0146).
• 33 RCE vulnerabilities including 2 from Apache. 
• 2 DoS attacks to Cisco BGP.

kev-dashboard.py