CISA Alert AA22-137A – Weak security controls and practices routinely exploited for initial access.

This joint cybersecurity advisory was coauthored by the cybersecurity authorities of the US, Canada, New Zealand, the Netherlands, and the UK. Cyber actors routinely exploit poor security configurations, weak controls, and other poor cyber hygiene practices to gain initial access or as part of other tactics to compromise a victim’s system. This joint Cybersecurity Advisory identifies commonly exploited controls and practices, and includes best practices to mitigate these risks.

AA22-137A Alert, Technical Details, and Mitigations

White House Executive Order on Improving the Nation’s Cybersecurity

NCSC-NL Factsheet: Prepare for Zero Trust

NCSC-NL Guide to Cyber Security Measures

N-able Blog: Intrusion Detection System (IDS): Signature vs. Anomaly-Based

NCSC-NL Guide to Cyber Security Measures

National Institute of Standards and Technology SP 800-123 – Keeping Servers Secured

NCSC-UK Guidance – Phishing Attacks: Defending Your Organisation 

Open Web Application Security Project (OWASP) Proactive Controls: Enforce Access Controls

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at central@cisa.dhs.gov or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or CyWatch@fbi.gov.