The Cybersecurity and Infrastructure Security Agency (CISA)
CISA is the federal agency under the Department of Homeland Security (DHS) responsible for coordinating cybersecurity efforts across all levels of government and private industry, focused on protecting critical infrastructure sectors like energy, healthcare, transportation, and even financial services. But what does that mean for you and your institution?
CISA services include:
- Awareness
- CISA publishes up-to-date advisories and alerts on security issues and vulnerabilities. Subscribers can customize their subscription to specific subjects of interest.
- Maintaining the Known Exploited Vulnerabilities (KEV) database of software vulnerabilities that have been exploited in the wild.
- Tools
- Cyber Hygiene Services (free)
- CISA’s Cyber Hygiene services help secure internet-facing systems from weak configurations and known vulnerabilities. Services include vulnerability scanning and web application scanning.
- Cybersecurity Performance Goal (CPG) Assessment
- CISA’s CPGs are a common set of practices organizations can implement to enhance their cybersecurity efforts.
- Conducting cybersecurity exercises such as facilitating tabletop testing (CTEP).
- Cyber Hygiene Services (free)
One of the most critical services that CISA provides to the cybersecurity community is the sponsorship of the MITRE ATT&CK framework. This framework is a globally utilized structure for categorizing tactics and techniques (aka the Common Vulnerabilities and Exposures (CVE) program) used by threat actors. Almost all cybersecurity professionals utilize this framework. Recently, funding for MITRE was extended for eleven months, but there remains uncertainty about the long-term status of this key tool of the cybersecurity world.
CISA plays a significant role in protecting the critical infrastructure of the United States and can provide benefits to your institution too!
Neovera SV (formerly 10-D Security) is an independent firm specializing in IT security and compliance for financial institutions. We help clients mitigate risk and comply with GLBA requirements, offering tailored services and expertise to strengthen cybersecurity programs.