CISA report touts cyber hygiene enrollment surge for critical infrastructure orgs

The cyber agency said that surge has fueled “a moderate impact” in CI sectors meeting its cybersecurity performance goals.

The Cybersecurity and Infrastructure Security Agency has seen a surge in its Cyber Hygiene (CyHy) service enrollment from critical infrastructure organizations over a two-year period, with the communications sector representing the biggest jump.

In a report released Friday, CISA said an analysis of the 7,791 critical infrastructure organizations enrolled in the agency’s vulnerability scanning service from Aug. 1, 2022, through Aug. 31, 2024, showed a 201% increase in its CyHy enrollment, led by the communications (300%), emergency services (268%), critical manufacturing (243%) and water and wastewater systems (242%) industries.

As a result of this enrollment boom, CISA said it has found improvements across its six cybersecurity performance goals, or CPGs: mitigating known vulnerabilities, no exploitable services on the internet, strong and agile encryption, limit OT connections on the public internet, deploy a security.txt file, and email security.

One area of improvement cited by CISA is a steady decrease in the number of exploitable services routinely monitored by the agency’s vulnerability scanning, from 12 services per CyHy enrollee in August 2022 to roughly eight apiece two years later.

The number of known exploited vulnerability tickets also declined over those two years, with critical-severity KEVs falling 50% and high-severity KEVs dropping by 25%. Remediation times for Secure Sockets Layer (SSL) vulnerabilities fell as well, with tickets resolved in 200 or so days as of August 2022 before decreasing to less than 50 days months later. 

Also highlighted in CISA’s report was data on the highest occurrences of operational technology protocols exposed to the public internet, drawing particular attention to the 63% exposure rate found in the government services and facilities sector. The IT (10%), energy (10%), health care (5%) and financial services (4%) industries were also called out. 

“Overall, CISA initiatives, programs, and products are directly influencing critical infrastructure sector service enrollments and adoption of CPGs,” the report concluded. “General analysis of CISA data reveals a moderate impact of CPG adoption across critical infrastructure sectors.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure