Wyden asks federal agencies to ditch Adobe Flash

The senator wants agencies charged with issuing federal cybersecurity guidance to get Flash off of government systems before 2020.

Sen. Ron Wyden has called on federal agencies to stop using Adobe Flash, multimedia software that has consistently proven vulnerable over the years.

Adobe will stop providing security updates for Flash in 2020, and Wyden, D-Ore., wants agencies charged with issuing federal cybersecurity guidance to get Flash off government systems before then.

“At that point, Flash’s existing cybersecurity risks will only be compounded,” Wyden wrote in a July 25 letter to the heads of the Department of Homeland Security, National Security Agency, and National Institute of Standards and Technology. “The federal government has too often failed to promptly transition away from software that has been decommissioned.”

The missive asks DHS, NIST, and the NSA to work together to produce a policy, effective within 60 days of its issuance, that bans the use of new Flash-based content on federal websites.

For Wyden, agencies should not just refrain from deploying Flash but also rid existing Flash-based content from their websites by August 1, 2019. To that end, Wyden asked DHS to “promptly expand the routine cyber-hygiene scans” it does of agency assets to include Flash content. He also called for the letter’s recipients to help produce an inventory of Flash content on each agency’s website, along with guidance to eradicate it.

Further, Wyden is proposing that agencies clear their desktops of Flash, staring with a “small number” of them via a pilot, and then all agency desktops by August 1, 2019.

“A critical deadline is looming,” Wyden wrote, referring to the end of technical support for Flash in 2020, and “the government must act to prevent the security risk posed by Flash from reaching catastrophic levels.”

Flash’s over two-decade history has been plagued by vulnerabilities, and popular web browsers’ abandonment of the software in recent years has hastened its demise.

Flash accounted for eight of the 10 vulnerabilities used in exploit kits over nine months in 2015, according to cybersecurity company Recorded Future. In May 2018, security researchers disclosed a vulnerability that they deemed a high risk to large and medium-size government organizations.

You can read Wyden’s full letter below.

[documentcloud url=”http://www.documentcloud.org/documents/4618702-Wyden-Flash-Letter-to-Nsa-Dhs-Nist.html” responsive=true height=500]

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure