The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday released incident and vulnerability response playbooks, in an effort to standardize and improve how federal agencies proactively defend against - and recover from - cyber incidents on government systems.
The publishing of the two playbooks was mandated by the Biden administration’s Executive Order 14028, “Improving the Nation’s Cybersecurity.” The playbooks give federal agencies step-by-step approaches for investigating actively exploited vulnerabilities and cyber incidents on their systems. While the playbooks are for federal government agencies, CISA stressed that they include checklists for incident and vulnerability response that can be utilized by public and private sector entities as well.
Casey Ellis, CTO and co-founder at Bugcrowd, said while every organization should have an incident response plan, the reality is that the presence and maturity of these plans can vary wildly, including among government agencies.
“CISA is very much staying on-brand by leveraging the considerable expertise they've amassed, and creating a baseline that is as comprehensive as possible, without completeness coming at the expense of simplicity and ease of use,” he said.
"This important step, set in motion by President Biden’s Cyber Executive Order, will enable more comprehensive analysis and mitigation of vulnerabilities and incidents across the civilian enterprise."
The incident response playbook applies to “incidents that involve confirmed malicious cyber activity and for which a major incident has been declared or not yet been reasonably ruled out,” such as cyberattacks involving lateral movement, compromised administrator accounts or network intrusions. It does not include response activities involving threats to classified information or national security systems. The playbook highlights various steps that agencies can take to detect and analyze incidents, such as determining the scope of the investigation, as well as containment and recovery efforts.
The vulnerability response playbook, meanwhile, offers guidance around adhering to effective vulnerability management practices, identifying potential actively exploited flaws on systems and applying patches. The playbooks focus on post-incident activities by instructing agencies to conduct a “lessons learned” type of analysis to review the efficiency of the incident handling, and they also prioritize coordination by instructing agencies to share cyber threat intelligence data or report information about how vulnerabilities are being exploited to CISA.
The new playbooks come as the Biden administration seeks to tighten the timeline for agencies to identify and mitigate flaws in their systems, on the heels of several high-profile cyberattacks that have involved critical infrastructure and government systems. Earlier in November, CISA created a catalog of known, actively exploited vulnerabilities and announced it would require federal civilian agencies to apply patches for them in “a more aggressive” timeline.
“This important step, set in motion by President Biden’s Cyber Executive Order, will enable more comprehensive analysis and mitigation of vulnerabilities and incidents across the civilian enterprise,” said Matt Hartman, deputy executive assistant director for cybersecurity, in a Tuesday statement. “We encourage our public and private sector partners to review the playbooks to take stock of their own vulnerability and incident response practices.”