All organisations urged to shore up protection from most often-exploited known vulnerabilities

The main US national cyber defence agencies, along with several other governments including the UK, has warned organisations that they should make sure protection is in place against the most common vulnerabilities frequently exploited by malicious cyber actor.

---

► National security bodies join to warn businesses that they must ensure core protection is good

► Response to further anticipated global wave of cybercrime

---

The joint directive was put out by the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI), joined with the Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security (CCCS), New Zealand National Cyber Security Centre (NZ NCSC), and the UK’s National Cyber Security Centre (NCSC-UK).

The directive makes specific reference to 15 of the most commonly exploited vulnerabilities of 2021.  The cybersecurity authorities recommend priority be given to the following mitigation measures

• Vulnerability and configuration management, including updating software, operating systems, applications, and firmware, with prioritisation on patching known exploited vulnerabilities; implementing a centralised patch management system; and replacing end-of-life software
• Identity and access management, including enforcing multi-factor authentication (MFA) for all users; if MFA is unavailable, require employees engaging in remote work to use strong passwords; and regularly reviewing, validating, or removing privileged accounts.
• Protective controls and architecture, including properly configuring and secure internet-facing network devices, disabling unused or unnecessary network ports and protocols, encrypting network traffic, and disabling unused network services and devices.

The directive has been released to remind organisations that criminals and other malicious actors don't need to develop sophisticated tools when they can simply exploit well-known vulnerabilities. Both public and private sector organisations – and individuals – are urged to tighten up their security measures against known vulnerabilities and make contact with their national authority as soon as they detect a cyber incident.