CISA Issues Directive for Federal Agencies to Secure Internet-Exposed Management Interfaces

June 13, 2023

The Cybersecurity and Infrastructure Security Agency (CISA) has issued Binding Operational Directive (BOD) 23-02, titled 'Mitigating the Risk from Internet-Exposed Management Interfaces.' This directive mandates federal civilian agencies to either remove specific networked management interfaces from the public-facing internet or implement Zero Trust Architecture capabilities that enforce access control to the interface within 14 days of discovery. The recent threat campaigns have highlighted the severe risk posed to the federal enterprise due to improperly configured network devices. This directive is part of CISA and the broader U.S. government's effort to move the federal civilian enterprise into a more defensible posture, thereby reducing the attack surface of federal government networks.

CISA Director Jen Easterly stated, “Too often, threat actors are able to use network devices to gain unrestricted access to organizational networks, in turn leading to full-scale compromise.” She added, “Requiring appropriate controls and mitigations outlined in this Directive is an important step in reducing risk to the federal civilian enterprise. While this Directive only applies to federal civilian agencies, as the threat extends to every sector, we urge all organizations to adopt this guidance. When it comes to reducing cyber risk and ensuring resilience, we all have a role to play.”

As federal civilian agencies carry out this mandate, CISA will monitor and support agency adherence, providing additional resources as needed. CISA is dedicated to using its cybersecurity authorities to gain greater visibility and drive timely risk reduction across federal civilian agencies. The new directive can be found at Binding Operational Directive (BOD) 23-02.

The Cybersecurity and Infrastructure Security Agency, as the nation’s cyber defense agency and national coordinator for critical infrastructure security, leads the national effort to understand, manage, and reduce risk to the digital and physical infrastructure that Americans rely on daily. For more information, visit CISA.gov and follow CISA on Twitter, Facebook, LinkedIn, and Instagram.

Latest News

• Critical VMware vRealize Vulnerability Actively Exploited
• New Vulnerabilities Found in Wago Controllers and Schneider Electric Products
• Zyxel Addresses Critical Vulnerability in NAS Devices
• Asus Addresses Critical Security Flaws in WiFi Routers
• Western Digital Restricts Unpatched Devices From Accessing Cloud Services