CISA

CVE is a global vulnerability identification system maintained by the U.S. MITRE Corporation and funded by the U.S. Department of Homeland Security; since its launch in 1999, it has catalogued more than 200,000 vulnerability entries.

CVE-2021-44228 is the well-known Log4Shell vulnerability

CISA is responsible for coordinating the protection of 16 critical infrastructure sectors in the United States and operates US-CERT (the United States Computer Emergency Readiness Team).

美国CISA、欧盟ENISA以及中国的网络安全主管部门均在探索AI辅助防御的政策框架

DHS oversees multiple agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), the Secret Service, Customs and Border Protection, and Immigration and Customs Enforcement.

Faced with a CISA warning, the mistake development teams are most prone to making is "only upgrading the version without verifying the effect."

A CISA warning usually means exploitation of the vulnerability has entered the "in the wild" stage.

The "Known Exploited Vulnerabilities Catalog" (KEV) maintained by CISA is a widely cited authoritative list in the industry, cataloging vulnerabilities that have been confirmed to be used in real attacks.

The UK National Cyber Security Centre (NCSC), together with international partners including CISA, jointly published guidelines for secure AI system development, emphasizing supply chain security, verification of third-party components, documentation of models/data/prompts, asset tracking, and failover readiness for mission-critical systems.

The AI security development guidelines published by NCSC/CISA are guidelines, not a security certification.

Agencies may apply in writing for an exception within 60 days of the order's issuance, with CISA approving case by case; the Secretary of Homeland Security must review the order within one year and annually thereafter.

CISA's resources for small and medium businesses emphasize resilience and secure-by-design/default practices, which can be translated into procurement questions: multi-factor authentication, separation of roles, log export, device revocation, backup recovery, access control for recordings and images, and response to a compromised vendor account.

CISA advises checking whether a system has already been compromised and preserving forensic evidence before updating, because the update itself may erase evidence of an existing compromise.

Under the binding operational directive BOD 22-01, U.S. federal civilian executive branch agencies must complete mitigation or discontinue use of affected products by the deadline.

Four of the five vulnerabilities carry forensic investigation flags, requiring a search for signs of compromise on affected hosts before closing the ticket, including anomalous files, newly created accounts, web shells, and outbound connections.

Four of the five newly added vulnerabilities were disclosed between 2015 and 2021, and most of the fixing patches have existed for years.

CISA guidance requires first applying the vendor-provided iRule for forensic triage, followed by patching, rather than choosing one or the other.

Both the U.S. CISA and the EU AI Act list offensive cyber capabilities as a core evaluation dimension for high-risk AI systems.

According to U.S. CISA statistics, a significant proportion of initial entry points in successful attacks on critical infrastructure come from employee credential leaks or misconfigurations, rather than zero-day vulnerabilities.

Both the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI advise government agencies not to pay ransoms