New DHS order pushes agencies to quickly patch vulnerabilities

Hackers are getting quicker at exploiting flaws. DHS wants agencies to faster than the hackers.

The Department of Homeland Security has ordered federal civilian agencies to more swiftly plug the vulnerabilities found on their networks, citing evidence that hackers are getting quicker at exploiting such bugs.

In a Binding Operational Directive (BOD) dated April 29, DHS’s Cybersecurity and Infrastructure Security Agency gives agencies 15 days after discovery to fix vulnerabilities deemed critical – as opposed to the 30 days that agencies previously had to address those flaws.

“Recent reports from government and industry partners indicate that the average time between discovery and exploitation of a vulnerability is decreasing as today’s adversaries are more skilled, persistent, and able to exploit known vulnerabilities,” reads the memo from CISA Director Chris Krebs.

The new directive also gives agencies 30 days to fix vulnerabilities labeled “high” in severity, which are a step below critical. That is another change from a 2015 order, now revoked, which did not provide a timeline for agencies to address high vulnerabilities.

The hope is that agencies will be quicker than those deadlines. The order tells agencies to patch or otherwise secure their systems as soon as possible.

Last week, Krebs touted progress he said agencies had made in more quickly fixing software flaws. The average time it takes agencies to patch critical vulnerabilities after discovery is down from 149 days to just 20, he said.

BODs are a blunt tool used by Homeland Security officials when agencies aren’t doing enough to defend their networks on their own. The directives are sometimes published in response to what officials see as clear-and-present cyberthreats. In January, for example, DHS issued an unprecedented “emergency” directive telling agencies to shore up their domain name system security after researchers reported that Iran-linked hackers had manipulated DNS records at organizations on multiple continents.

As with other BODs, the new order doesn’t apply to the Pentagon and intelligence agencies, which are outside of DHS’s policy jurisdiction.

“CISA released [the directive] to continue to take deliberate steps to reduce the overall attack surface and minimize the risk of unauthorized access to federal information systems,” Jeanette Manfra, CISA’s assistant director, wrote in a blog post.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure