Yesterday CISA announced the creation of the Ransomware Vulnerability Warning Pilot (RVWP). This pilot program was authorized under §105 (135 STAT 1035) of the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) in Division Y of PL 117-103. Under this pilot, CISA will identify critical infrastructure organizations that have known vulnerabilities that have been exploited by ransomware attackers and notify those organizations of the identified vulnerabilities. CISA has prepared a fact sheet about this pilot program.
How Will CISA Identify Facilities?
CISA has specifically identified their Cyber Hygiene Service program as one of the methods by which the agency will identify vulnerabilities withing critical infrastructure systems. This is a voluntary program under which CISA would conduct continuous scans of public, static IPv4s for accessible services and vulnerabilities. Critical infrastructure organizations can request this service from CISA.
CISA is not limiting this program to CI organizations that request support. They note that they will leverage “commercial tools to identify organizations that may be at heightened cybersecurity risk.” Presumably, they would use tools such as the Shodan Search Engine to identify internet facing vulnerabilities that have been previously identified as being employed by ransomware attackers. Then, utilizing their Administrative Subpoena Authority under 6 USC 659(p) they would require the ISP to provide CISA with contact information for the owner of the affected IP.
Interesting question here; if CISA identifies a facility with a known ransomware vulnerability, but it is not a critical infrastructure facility, will they still make notification? I mean, when they request that an ISP identify the owner of an affected IP, CISA does not know whether or not the facility is CI. I understand that CISA has a CI protection mandate in this section, but how much in the way of resources does it take to send out a boiler plate email about a vulnerability?
How Will CISA Make Notifications?
CISA regional offices will make the notifications by email or phone. Organizations wishing to confirm the identity of someone making a phone notification can contact CISA Central at Central@cisa.gov or (888) 282-0870. CISA will provide key information regarding the vulnerable system, such as the manufacturer and model of the device, the IP address in use, how CISA detected the vulnerability, and guidance on how the vulnerability should be mitigated.
Commentary
This sounds really good in a big government kind of way. CISA with its infinite resources and unlimited knowledge will be watching out for the little guy, letting them know if they are vulnerable to ransomware attacks and how to fix the situation if they are vulnerable. This is what Congress (or at least the staffers who crafted §105) intended when they included CIRCIA in the spending bill, CISA will protect us. And to be fair, there should be some successes with this program. But…
This will not stop ransomware. If this is truly successful in reducing the ransomware attacks on critical infrastructure organizations, it will probably have the unintended consequence of pushing those attacks on to facilities that do not make the ‘critical infrastructure’ cut. And many of those facilities will be suppliers of critical infrastructure, so critical infrastructure will still be impacted (2nd hand) by those ransomware attacks.
Even for covered critical infrastructure organizations that participate in CISA Cyber Hygiene Services, this will not stop all ransomware attacks. This program is focused on known vulnerabilities in software and hardware that allow elevation of privilege and lateral movement within an organization. Focused attacks on personnel with already elevated privilege will not be affected. And well-funded (successful) ransomware organizations and nation-state adversaries supporting such organizations have the wherewithal to conduct research to find or to buy newly discovered vulnerabilities for which CISA is unaware that they need to search under this program.
Oh, and let’s not forget that the vulnerable organization identified by CISA still has to have the resources (time, money, personnel and expertise) necessary to go back and correct the vulnerabilities identified by CISA. CISA is only identifying ‘known vulnerabilities’ that the organizations should have already been correcting anyway. There has to be some underlying reason that the organization has not already corrected the vulnerability that CISA has identified. This program will not correct those issues.
Do not get me wrong. This is a reasonably good program that with which I hope CISA has some success. But it will not solve the ransomware problem.