,
9 tweets,
2 min read
Read on Twitter
Yesterday, I issued an emergency directive to US civilian agencies requiring immediate actions to protect Federal information systems from ongoing DNS hijacking and tampering activities. This activity was first raised to CISA by partners in the internet security community. 1/7
We are aware of a number of agencies affected by the tampering activities and have notified them. In part, by issuing the directive, CISA seeks to work with agencies to detect and prevent additional impacts on agencies and systems. 2/7
The directive lays out a set of risk-informed, straightforward, and high impact/low burden actions that agencies must take to harden systems and improve awareness and trustworthiness of key security processes. 3/7
These actions are basic good practices for enterprise DNS management. While the Emergency Directive only applies to Federal civilian executive branch agencies, we encourage all organizations to follow suit to prevent DNS hijacking. 4/7
The American public should never have to question the security of their interactions with the federal government, whether their sensitive data is at risk, or that the information they rely on from the Government may have been tampered with. 5/7
Though we recognize that some agencies may have challenges implementing the directive during the ongoing partial government shutdown, we believe these actions are necessary, urgent, and implementable as most agencies are adequately staffed to take the necessary actions. 6/7
The CISA team will continue to work with agencies to support with operational and technical assistance as needed. 7/7
UPDATE: here’s a link to Emergency Directive 19-01. cyber.dhs.gov/ed/19-01/
UPDATE 2: here’s a blog with a bit more detail on the DNS hijacking activities, the mitigations we’ve laid out in the Directive, and how we’re working to shift the advantage to the defenders. cyber.dhs.gov/blog/#why-cisa…
