Replied to AAKL
Recent searches
Search options
#cisa
3 posts3 participants0 posts today
Interesting report. But will the new CISA do anything of the sort?
Ox Security: The KEV Illusion: Separating True Threats from Pretend-Critical Risks https://www.ox.security/the-kev-illusion-separating-true-threats-from-pretend-critical-risks/
More:
Infosecurity-Magazine: CISA Urged to Enrich KEV Catalog with More Contextual Data https://www.infosecurity-magazine.com/news/cisa-urged-enrich-kev-catalog/ #CISA #infosec #cybersecurity
Authorities carry out global takedown of infostealer used by cybercriminals - A consortium of global law enforcement agencies and tech com... - https://arstechnica.com/security/2025/05/authorities-carry-out-global-takedown-of-infostealer-used-by-cybercriminals/ #infostealers #infostealer #syndication #security #biz #cisa
Ars Technica · Authorities carry out global takedown of infostealer used by cybercriminals
New Best Practices Guide for Securing #AI #Data Released (via #CISA) https://www.cisa.gov/news-events/alerts/2025/05/22/new-best-practices-guide-securing-ai-data-released #infosec
#CISA moves to Social Media First Approach? via @endingwithali
Continued thread
A week after that #hack, the #CISA recommended that users "discontinue use of the product" barring any mitigating instructions about how to use the app from #Smarsh.
Jake Williams, a fmr #NationalSecurity Agency #cyber specialist, said that, even if the intercepted text messages were innocuous, the wealth of #metadata - the who & when of the #leaked conversations & chat groups - posed a #counterintelligence risk.
Well, that’s another pretty serious blow to #CISA. I know there are tons of good people still left but without folks like Matt to do the block and tackle work to keep them safe, it’s going to be harder for them to keep doing the work in keeping America secure.
https://bsky.brid.gy/r/https://bsky.app/profile/did:plc:gdxiuhym6fvbhxo5uhiohmyy/post/3lpmi4c4gh52i
Bluesky Social · Eric Geller (@ericjgeller.com)Scoop: Matt Hartman, the No. 2 official at CISA's Cybersecurity Division, is leaving the government at the end of the month. Hartman, a 15-year DHS employee, told staff in a town-hall meeting this morning. https://www.linkedin.com/in/matt-hartman-38a59a2/ https://www.cisa.gov/speaker/matt-hartman
CISA Adds Six Known Exploited Vulnerabilities to Catalog https://www.cisa.gov/news-events/alerts/2025/05/19/cisa-adds-six-known-exploited-vulnerabilities-catalog
Cybersecurity and Infrastructure Security Agency CISACISA Adds Six Known Exploited Vulnerabilities to Catalog | CISA
A coalition of 52 industry organizations is urging Congress to reauthorize CISA before it’s too late 
The joint letter includes voices from critical sectors — energy, telecom, finance, healthcare, transportation, retail, and tech
Without immediate reauthorization, programs supporting vulnerability coordination, incident response, and threat sharing will stall out.
The current authorization expires September 30 
The call: long-term, stable support for the U.S. government’s lead civilian cyber agency
When 52 business and infrastructure groups align on cyber policy, that’s not noise — it’s a warning flare.
#CyberSecurity #CISA #ThreatIntel #CyberPolicy #PublicPrivatePartnership #security #privacy #cloud #infosec
https://www.ciodive.com/news/cisa-reauthorization-congress-industry-letter/748356/
CIO Dive · Congress faces pressure to renew cyber information-sharing law
#CISA #cybersecurity #Twitter #RSS #YTho
'The US government's Cybersecurity and Infrastructure Security Agency (CISA) announced Monday that going forward, only urgent alerts tied to emerging threats or major cyber activity will appear on its website. Routine updates, guidance, and other notifications will instead be shared via email, RSS, and X.'
https://www.theregister.com/2025/05/12/cisa_vulnerabilities_updates_x/
The Register · CISA mutes own website, shifts routine cyber alerts to Musk’s X, RSS, email
Geez, TWENTY-TWO ICS advisories from CISA today? Is that as awful as it sounds?
Cybersecurity and Infrastructure Security Agency CISACISA Releases Twenty-Two Industrial Control Systems Advisories | CISA
CISA Adds One Known Exploited Vulnerability to Catalog https://www.cisa.gov/news-events/alerts/2025/05/14/cisa-adds-one-known-exploited-vulnerability-catalog
Cybersecurity and Infrastructure Security Agency CISACISA Adds One Known Exploited Vulnerability to Catalog | CISACISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
If you missed this, CISA is now backtracking on recent changes to the way it delivers cybersecurity alerts and advisories.
"We recognize this has caused some confusion in the cyber community. As such, we have paused immediate changes while we re-assess the best approach to sharing with our stakeholders."
CISA: Update to How CISA Shares Cyber-Related Alerts and Notifications https://www.cisa.gov/news-events/alerts/2025/05/12/update-how-cisa-shares-cyber-related-alerts-and-notifications #CISA #cybersecurity #infosec
Cybersecurity and Infrastructure Security Agency CISAUpdate to How CISA Shares Cyber-Related Alerts and Notifications | CISACISA is changing how we announce cybersecurity updates and the release of new guidance.
As #US #vulnerability-tracking falters, #EU enters with its own #security bug database
The European Vulnerability Database (#EUVD) is now fully operational, offering a streamlined platform to monitor critical and actively exploited security flaws amid the US struggles with budget cuts, delayed disclosures, and confusion around the future of its own tracking systems. The EUVD is similar to the US government's National Vulnerability Database (#NVD).
https://www.theregister.com/2025/05/13/eu_security_bug_database/ #CISA
The Register · As US vuln-tracking falters, EU enters with its own security bug database
RSS feed for CISA KEV vulnerabilities, powered by Vulnerability-Lookup:
www.vulnerability-lookup.orgFeed syndicationMachine learning datasets and models
#arstechnica:
"
DOGE software engineer’s computer infected by info-stealing malware
"
"The presence of credentials in leaked "stealer logs" indicates his device was infected."
"A steady stream of published credentials"
8.5.2025
Ars Technica · DOGE software engineer’s computer infected by info-stealing malware
Replied in thread
Thanks Jerry!
CISA's initial email announcement reducing public-facing security products preserved RSS feeds. But the website language has been updated to drop RSS as a remaining source.
The stated reasoning ("CISA wants this critical information to get the attention it deserves and ensure it is easier to find") is ... specious at best.
Even if we stipulate that keeping the general website less noisy is a net win, they could just ... provide a different web page? And it would be trivial to also create a separate RSS feed just for the vulnerability announcements. The automation is clearly already there and would be relatively easy to modify.
The actual reasoning is different from the stated reasoning, and is left as an exercise for the reader.
Edit: Jerry is setting up an email-to-Mastodon shim here!
https://infosec.exchange/@cisareflector
... which can then be followed as an RSS feed:
