Loading...

Federal Agencies Told to Act Quickly to Turn Back Cyberthreat

May 18, 2022 by Dan McCue
Federal Agencies Told to Act Quickly to Turn Back Cyberthreat

WASHINGTON — The entity charged with protecting federal agencies from bad cyber actors issued a rare emergency directive Thursday, warning they should quickly take steps to protect themselves from vulnerabilities found in VMware.

VMware is a cloud computing and virtualization technology company headquartered in Palo Alto, California. It is primarily known for creating a platform for the virtualization of IT infrastructure as an alternative to having dedicated hosts.

According to the Cybersecurity and Infrastructure Security Agency, vulnerabilities found in five of the company’s products: VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM), VMware vRealize Automation (vRA), VMware Cloud Foundation, and vRealize Suite Lifecycle Manager (vRSLCM) have placed federal networks and systems at immediate risk of a cyber intrusion.

It goes on to say the problem is a vulnerability that permits attackers to gain deep access into computer systems without the need to authenticate. 

“These vulnerabilities pose an unacceptable risk to federal network security,” said CISA Director Jen Easterly in a written statement. 

“CISA has issued this Emergency Directive to ensure that federal civilian agencies take urgent action to protect their networks. We also strongly urge every organization — large and small — to follow the federal government’s lead and take similar steps to safeguard their networks.”

The federal civilian executive branch agencies to whom the warning applies include every executive branch department — Energy, Commerce, Homeland Security, Treasury, Transportation, etc. — as well as “smaller” agencies like the board of governors of the Federal Reserve, the Federal Trade Commission, the National Transportation Safety Board, the Environmental Protection Agency and the Nuclear Regulatory Commission.

Even the Peace Corps could be vulnerable to the threat.

On its website CISA said VMware first discovered new vulnerabilities in early April and released an update to address the problem.

Unfortunately, the agency said, “threat actors were able to reverse engineer the update and begin exploitation of impacted VMware products that remained unpatched within 48 hours of the update’s release.”

Earlier today, VMware released an update for two new vulnerabilities. 

“Based on the above, CISA expects threat actors to quickly develop a capability to exploit these newly released vulnerabilities in the same impacted VMware products,” the agency said. “Exploiting the above vulnerabilities permits attackers to trigger a server-side template injection that may result in remote code execution; escalate privileges to ‘root’; and obtain administrative access without the need to authenticate.

“CISA has determined that these vulnerabilities pose an unacceptable risk … and require emergency action,” the agency said.

Dan can be reached at dan@thewellnews.com and @DanMcCue

In The News

Health

Voting

Cybersecurity

September 16, 2022
by Dan McCue
FEC Clears Path for Warren to Spend Campaign Funds on Cybersecurity

WASHINGTON — Sen. Elizabeth Warren, D-Mass., can use campaign funds to pay for the cost of reasonable cybersecurity measures to... Read More

WASHINGTON — Sen. Elizabeth Warren, D-Mass., can use campaign funds to pay for the cost of reasonable cybersecurity measures to protect her home network, the Federal Election Commission announced on Friday. The decision came in response to an advisory opinion request on behalf of Warren Democrats... Read More

September 9, 2022
by Madeline Hughes
CISA Looking to Change Cybercrime Reporting Rules

WASHINGTON — As cybercrimes are on the rise, the Cybersecurity and Infrastructure Security Agency is asking people, businesses and other... Read More

WASHINGTON — As cybercrimes are on the rise, the Cybersecurity and Infrastructure Security Agency is asking people, businesses and other organizations for feedback on what its new reporting rules should look like. The agency released the eight-page request for information Friday asking people how the agency... Read More

July 13, 2022
by Madeline Hughes
Atlantic Council Offers New Approach to Cybersecurity  

WASHINGTON — The Atlantic Council outlined Tuesday how the U.S. government and businesses can work together to protect the nation’s... Read More

WASHINGTON — The Atlantic Council outlined Tuesday how the U.S. government and businesses can work together to protect the nation’s power grid from cyberattacks. The United States’ power grid is increasingly reliant on digital technology and the internet. This is especially true as the country moves... Read More

July 6, 2022
by Reece Nations
National Computer Forensics Institute Reauthorization Critical to Security

HOOVER, Ala. — As the National Computer Forensics Institute comes up for congressional reauthorization, forensics and cybersecurity experts told The... Read More

HOOVER, Ala. — As the National Computer Forensics Institute comes up for congressional reauthorization, forensics and cybersecurity experts told The Well News how the institute’s standardized curriculum is critical to contemporary law enforcement activities. Having a centralized hub for preparing police for handling incidents related to... Read More

May 18, 2022
by Dan McCue
Federal Agencies Told to Act Quickly to Turn Back Cyberthreat

WASHINGTON — The entity charged with protecting federal agencies from bad cyber actors issued a rare emergency directive Thursday, warning... Read More

WASHINGTON — The entity charged with protecting federal agencies from bad cyber actors issued a rare emergency directive Thursday, warning they should quickly take steps to protect themselves from vulnerabilities found in VMware. VMware is a cloud computing and virtualization technology company headquartered in Palo Alto,... Read More

May 6, 2022
by Madeline Hughes
Cybercrime Tracking Bill Signed Into Law

WASHINGTON — The Department of Justice can now get a handle on the number of cybercrimes happening in the U.S.... Read More

WASHINGTON — The Department of Justice can now get a handle on the number of cybercrimes happening in the U.S. after President Joe Biden signed a bill into law Thursday granting the department the ability to track crimes that have become increasingly prevalent in recent years.... Read More

News From The Well