Stay informed on the latest CISA updates, guidelines, and alerts critical for robust information security and cyber threat prevention.
Search across headline titles and summaries.
Background for this topic.
Cybersecurity and Infrastructure Security Agency (CISA) is the U.S. Department of Homeland Security agency for reducing cyber and physical risks to critical infrastructure and federal civilian networks. Created by the 2018 CISA Act, it works with government and industry, publishes alerts and guidance, and coordinates assistance during significant incidents. Its direct federal-network role chiefly covers the Federal Civilian Executive Branch, including .gov; private-sector engagement is often voluntary or sector-specific.
Practitioners use CISA advisories and the Known Exploited Vulnerabilities catalog to prioritize patching where exploitation has been observed, and consult applicable directives and incident-response guidance. CISA supports vulnerability reporting and promotes controls such as multifactor authentication, logging, and tested recovery. A CISA alert is an actionable risk signal, not proof every organization is affected; teams should verify product, version, exposure, and obligations.
CISA and the FBI said today that Black Basta ransomware affiliates breached over 500 organizations between April 2022 and May 2024. [...]
CISA's agreement is voluntary and, frankly, basic. Signatories say that's a good thing.
New regulations will require the private sector to turn over incident data to CISA within three days or face enforcement. Here's how the agency is presenting this as a benefit to the entire private sector.
68 Tech Companies Join US Cyber Agency's Pledge to Build Security Into ProductsThe U.S. Cybersecurity and Infrastructure Security Agency has announced a new voluntary pledge featuring 68 inaugural members that have committed to take specific actions to improve the security of their products, shifting responsibilities from end users to the providers themselves.
Over 60 companies sign the secure by design pledge from CISA to consider security from the design phase and throughout the product life cycle.
Explosion in Threat Actors, Poorly Configured Technology Compound the RiskGeopolitical events increasingly pose risks to organizations' cybersecurity posture, the current and former leaders of the U.S. Cybersecurity and Infrastructure Security Agency - Jen Easterly and Chris Krebs - warned at this year's RSA Conference in San Francisco.
CISA launched a new software vulnerability enrichment program to fill the gap left by NIST’s National Vulnerability Database backlog
And it would seriously inconvenience the Chinese and Russians, too RSAC There's a way to vastly reduce the scale and scope of ransomware attacks plaguing critical infrastructure, according to CISA director Jen Easterly: Make software secure by design.…
Vulnerabilities added to the CISA known exploited vulnerability (KEV) list do indeed get patched faster, but not fast enough.
In the first year alone, that's saved us all a lot of money and woe RSAC As ransomware gangs step up their attacks against healthcare, schools, and other US critical infrastructure, CISA is ramping up a program to help these organizations fix flaws exploited by extortionists in the first place.…
More work to do as most deadlines are missed and worst bugs still take months to fix The deadlines associated with CISA's Known Exploited Vulnerabilities (KEV) catalog only apply to federal agencies, but fresh research shows they're having a positive impact on private organizations too.…
Recent attacks on healthcare thrust infosec agency into alert mode CISA is calling on the software industry to stamp out directory traversal vulnerabilities following recent high-profile exploits of the 20-year-old class of bugs.…