The Cybersecurity and Infrastructure Security Agency set deadlines for federal agencies to implement supplemental actions under an emergency directive it issued following the abuse of vulnerabilities identified in on-premises Microsoft Exchange servers.
The updated directive CISA released Wednesday requires department-level chief information officers or their equivalents to report to CISA on further investigative actions by noon Monday, April 5 and on defensive measures by noon Monday, June 28.
“CISA is directing additional actions to identify compromises that may remain undetected. Since the original issuance of ED 21-02, Microsoft has developed new tools and techniques to aid organizations in investigating whether their Microsoft Exchange servers have been compromised,” the order reads. “CISA also identified Microsoft Exchange servers still in operation and hosted by (or on behalf of) federal agencies that require additional hardening.”
The more immediate forensic actions CISA listed would have agency personnel working evenings and over the weekend due to the computing power it will take to run two tools—Microsoft Safety Scanner, or MSERT, and Test-ProxyLogon.ps1 script—for identifying indicators of compromise.
Running MSERT in full scan mode, which CISA requires, “may cause server resource utilization to peak,” the agency said. “Accordingly, CISA recommends agencies run the tool during off-peak hours. The full scan is expected to take several hours. During the scan, files may present as possible matches, but only the final report is conclusive.”
Initial tests must be done by April 5, when the CIO-level reports are due. If there is any positive result from either tool, agencies must immediately report the details to CISA as an incident.
After the initial MSERT scan, agencies m ..
Support the originator by clicking the read the rest link below.
