On November 3, the Biden administration mandated federal agencies to patch hundreds of cybersecurity flaws. The end goal is to prevent the next big cybersecurity crisis. This comes after major events like the SolarWinds hack — when suspected Russian hackers weaponized SolarWinds and Microsoft software to hack U.S. federal agencies — put the need to improve cybersecurity protocols center stage.
It further underscores just how ill-prepared governmental agencies, and the general public alike, are for major hacks.
The Verge reports on this new directive from the Cybersecurity and Infrastructure Security Agency (CISA), which highlighted “200 known threats that cybersecurity experts discovered between 2017 and 2020.”
Right now, these federal agencies have just six months to put patches in place to cover vulnerabilities exposed by older threats. Additionally, they have two weeks to fortify what was exposed by newer threats from the past year.
“The Directive lays out clear requirements for federal civilian agencies to take immediate action to improve their vulnerability management practices and dramatically reduce their exposure to cyber-attacks,” CISA director Jen Easterly said in a statement on the directive, which was first reported by The Wall Street Journal. “While this Directive applies to federal civilian agencies, we know that organizations across the country, including critical infrastructure entities, are targeted using these same vulnerabilities. It is therefore critical that every organization adopt this Directive and prioritize mitigation of vulnerabilities listed in CISA’s public catalog.”
SolarWinds is included in the list of major threats, along with the Microsoft Exchange Server flaw. The Microsoft attack involved the hacking of emails from 30,000 American commercial and governmental organizations. What makes that attack particularly frustrating for government officials is the reality that had just “four known security holes” been patched, the attack could have been stopped in its tracks, the Verge reports.
All of this means cybersecurity threats will continue to be at the top of headlines — not just in the U.S., but around the world.
Back in May, President Joe Biden signed an executive order that sought to prevent similar attacks. This order included provisions such as two-factor authentication throughout the federal government, the institution of a Cybersecurity Safety Review Board, and uniform recommendations for responding to these kinds of attacks, the Verge adds.
This increased vigilance signals we are only heading into an ever-heightened sense of alarm over cybersecurity dangers. Shielding individuals’ sensitive data while also putting cybersecurity central to both federal and commercial policy is key to combatting these threats.