The FBI and Cybersecurity & Infrastructure Security Agency July 4 released guidance to respond to the recent supply-chain ransomware attack leveraging a vulnerability in Kaseya VSA software against multiple managed service providers and their customers. Among other actions, CISA and FBI strongly urge affected MSPs and their customers to download the Kaseya VSA detection tool, which analyzes a system and determines whether any indicators of compromise are present; enable and enforce multi-factor authentication on every single account that is under the control of the organization, and — to the maximum extent possible — enable and enforce MFA for customer-facing services; implement allowlisting to limit communication with remote monitoring and management capabilities to known IP address pairs. President Biden has directed the full resources of the government to investigate this incident.  
  
John Riggi, AHA's senior advisor for cybersecurity and risk, said, “This attack once again demonstrates that our cyber adversaries are conducting highly researched and strategic attacks targeting ubiquitous technology service providers that provide broad access to the initial targets and their customer base. It is incumbent upon all of us to implement and maintain risk-based vendor risk management programs, which identify mission critical business associates, their dependencies and any business associate, software or service that has elevated network access and privilege. Implementing the above controls is essential not only to mitigate the Kaseya risk, but also represents best practices to mitigate similar strategic third-party risk as we have seen in the recent SolarWinds, MS print spooler and Exchange compromises." 
 
For more on this or other cyber and risk issues, contact Riggi at jriggi@aha.org.
 

Related News Articles

Headline
The Cybersecurity and Infrastructure Security Agency, FBI and National Security Agency yesterday issued an advisory to help organizations secure their…
Headline
John Riggi, AHA’s senior advisory for cyber security and risk, speaks with Edward You, supervisory special agent in the FBI’s Weapons of Mass Destruction…
Headline
The National Institute of Standards and Technology will work with technology leaders to develop a framework to improve security in the technology supply chain…
Headline
The FBI today released an alert on Hive ransomware, which uses mechanisms such as phishing emails with malicious attachments and Remote Desktop Protocol to…
Headline
The FBI yesterday alerted U.S. organizations to ransomware attacks by a group using phishing emails to access victim networks and download Cobalt Strike threat…
Headline
BlackBerry yesterday announced a set of cyber vulnerabilities in its QNX Real Time Operating System for medical devices and other products, which a remote…