The US government Cybersecurity and Infrastructure Security Agency (CISA) is one of our go-to information sources for cyber security information. Whilst I have been away my team have been keeping up with the news there, but I have not! Here is a round-up of their latest alerts:
VMware Releases Security Advisory for Aria Automation | CISA
Atlassian Releases Security Updates for Multiple Products | CISA
Citrix Releases Security Updates for NetScaler ADC and NetScaler Gateway | CISA
Oracle Releases Critical Patch Update Advisory for January 2024 | CISA
Drupal Releases Security Advisory for Drupal Core | CISA – Drupal is a content management system similar to WordPress – your website may be affected. Do you know?
CISA Issues Emergency Directive on Ivanti Vulnerabilities | CISA
Apple Releases Security Updates for Multiple Products | CISA – (Apple Updates)
Mozilla Releases Security Updates for Thunderbird and Firefox | CISA
Juniper Networks Releases Security Bulletin for J-Web in Junos OS SRX Series and EX Series | CISA
Although CISA’s main responsibility is to the US Government and their departments, so some of the software here could be a bit obscure, some of the alerts above impacted our clients, which makes this a useful resource.
Secure AI
CISA has joined with the UK’s National Cyber Security Centre (NCSC) and other international government agencies, with responsibility for cyber security, from around the world to create guidelines for the secure developement of AI systems. Here is a link to the report on the NCSC site:
Guidelines for secure AI system development (ncsc.gov.uk)
Known Exploited Vulnerabilities Catalog
CISA also maintains a database of exploited vulnerabilities which it knows about and includes mitigation for the issues.
CISA also releases industrial control system advisories – if you are responsible for these types of systems you should monitor their news page:
My advice: Either you or your IT support need to check whether these issues impact your systems. You need to have a master document that details your systems, hardware, software, online, networks, back-ups, suppliers etc – so when cyber security (or operational) issues arise you and your support teams can quickly check if you are affected. From there you can take fast, effective action.
Clive Catton MSc (Cyber Security) – by-line and other articles
