FBI, CISA share guidance for those affected by the Kaseya VSA ransomware attack
The FBI and Cybersecurity & Infrastructure Security Agency July 4 released guidance to respond to the recent supply-chain ransomware attack leveraging a vulnerability in Kaseya VSA software against multiple managed service providers and their customers. Among other actions, CISA and FBI strongly urge affected MSPs and their customers to download the Kaseya VSA detection tool, which analyzes a system and determines whether any indicators of compromise are present; enable and enforce multi-factor authentication on every single account that is under the control of the organization, and — to the maximum extent possible — enable and enforce MFA for customer-facing services; implement allowlisting to limit communication with remote monitoring and management capabilities to known IP address pairs. President Biden has the full resources of the government to investigate this incident.
John Riggi, AHA's senior advisor for cybersecurity and risk, said, “This attack once again demonstrates that our cyber adversaries are conducting highly researched and strategic attacks targeting ubiquitous technology service providers that provide broad access to the initial targets and their customer base. It is incumbent upon all of us to implement and maintain risk-based vendor risk management programs, which identify mission critical business associates, their dependencies and any business associate, software or service that has elevated network access and privilege. Implementing the above controls is essential not only to mitigate the Kaseya risk, but also represents best practices to mitigate similar strategic third-party risk as we have seen in the recent SolarWinds, MS print spooler and Exchange compromises."
For more on this or other cyber and risk issues, contact Riggi at jriggi@aha.org.