CISA Releases Analysis of FY23 Risk and Vulnerability Assessments

CISA has released CISA Analysis: Fiscal Year 2023, Risk and Vulnerability Assessments, an analysis detailing the findings from the 143 Risk and Vulnerability Assessments (RVAs) conducted across multiple critical infrastructure sectors in fiscal year 2023 (FY23).

The analysis details a sample attack path including tactics and steps a cyber threat actor could follow to compromise an organization with weaknesses representative of those CISA observed in FY23 RVAs. The infographic highlights the most successful techniques for each tactic that RVAs documented. Both the analysis and infographic map threat actor behavior to the MITRE ATT&CK® framework.

The FY23 reports provided these general observations:

• Assessors completed their most successful attacks via common methods, such as phishing, valid accounts, and default credentials.
• Assessors used a variety of tools and techniques CISA has captured in previous RVA analyses to successfully conduct common attacks.
• Many organizations across varying CI sectors exhibited the same vulnerabilities.
• CISA assessment personnel used common vulnerabilities facilitated by shortcomings in secure by design and default principles and other misconfigurations to compromise systems.

CISA encourages network defenders to review the analysis and apply the recommended mitigations to protect against the observed tactics and techniques.

JANUS Associates has been serving the best interests of our clients since 1988. We have helped protect 32 Federal agencies, 102 state agencies, small businesses, large commercial organizations across all sectors, K-12/Higher Education, and non-profits harden their defenses, comply with government regulations, and protect their operations, employees, and end users.

Speak with a JANUS professional and learn what 2,100+ satisfied clients already know, and why we are considered one of the preeminent cyber security, privacy, and regulatory compliance consultancies in the nation.