Initial tests must be done by April 5, when the CIO-level reports are due. During the scan, files may present as possible matches, but only the final report is conclusive.” The full scan is expected to take several hours. “Accordingly, CISA recommends agencies run the tool during off-peak hours. Running MSERT in full scan mode, which CISA requires, “may cause server resource utilization to peak,” the agency said. The more immediate forensic actions CISA listed would have agency personnel working evenings and over the weekend due to the computing power it will take to run two tools-Microsoft Safety Scanner, or MSERT, and Test-ProxyLogon.ps1 script-for identifying indicators of compromise. “CISA also identified Microsoft Exchange servers still in operation and hosted by (or on behalf of) federal agencies that require additional hardening.” Since the original issuance of ED 21-02, Microsoft has developed new tools and techniques to aid organizations in investigating whether their Microsoft Exchange servers have been compromised,” the order reads.
“CISA is directing additional actions to identify compromises that may remain undetected. The updated directive CISA released Wednesday requires department-level chief information officers or their equivalents to report to CISA on further investigative actions by noon Monday, April 5 and on defensive measures by noon Monday, June 28.
The Cybersecurity and Infrastructure Security Agency set deadlines for federal agencies to implement supplemental actions under an emergency directive it issued following the abuse of vulnerabilities identified in on-premises Microsoft Exchange servers.
0 kommentar(er)
