Russia-Ukraine Crisis: How to Strengthen Your Security Posture to Protect against Cyber Attack, based on CISA Guidelines

Protecting Customer Data on Qualys Cloud Platform
Urgent: Assess and Heighten Your Security Posture
Step 1: Monitor Your Shodan/Internet Exposed Assets
Step 2: Detect, Prioritize and Remediate CISAs Catalog ofKnown Exploited Vulnerabilities
Step 3: Protect Your Cloud Services and Office 365
Step 4: Continuously Detect any Potential Threats and Attacks
Take Action to Learn More about How to Strengthen Your Defenses

CISA has created Shields Up as a response to the Russian invasion of Ukraine. Qualys is responding with additional security, monitoring and governance measures. This blog details how and what our enterprise customers can do to immediately strengthen their security posture and meet CISA’s recommendations.

With the invasion of Ukraine by Russia, the U.S. Cybersecurity & Infrastructure Security Agency (CISA) has created a program titled Shields Up and provided specific guidance to all organizations. The Russian government has used cyber operations as a key component of force projection in the past and has targeted critical infrastructure to destabilize a governments’ response capabilities. Critical infrastructure can include supply chain (including software supply chain), power, utilities, communications, transportation, and government and military organizations.

Protecting Customer Data on Qualys Cloud Platform

Qualys is strongly committed to the security of our customers and their data. In addition to proactive risk mitigation with continuous patch and configuration management, we continually monitor all our environments for any indication of active threats, exploits and compromises. We hold our platforms to the highest security and compliance mandates like FedRAMP. However, given the heightened risk environment around the globe, the Qualys Security and Engineering teams have been at a heightened state of vigilance in recent weeks. We continuously monitor our internal systems in this amplified threat environment. We are working with our security partners to access the latest threat intel. We have implemented additional security, monitoring, and governance measures involving our senior leadership and are committed to ensuring that the Qualys Cloud Platform remains available and secure to support the enterprises we serve worldwide.

Urgent: Assess and Heighten Your Security Posture

Based on high-level guidelines provided by CISA, Qualys is recommending all organizations to establish the following actionable steps to adopt heightened cybersecurity posture to protect critical assets.

There are 4 steps necessary to strengthen security posture per CISA’s Shields Up guidance:

Step 1: Know Your Shodan/Internet Exposed Assets Automatically
Step 2: Detect, Prioritize, and Remediate CISA’s Catalog of Known Exploited Vulnerabilities
Step 3: Protect Your Cloud Services and Office 365 Environment
Step 4: Continuously Detect a Potential Intrusion

Implement CISA’s Shields Up Guidance

Try it Now

Step 1: Monitor Your Shodan/Internet Exposed Assets

Discover and protect your external facing assets

An organization’s internet-facing systems represent much of their potential attack surface. Cyber threat actors are continuously scanning the internet for vulnerable systems to target attacks and campaigns. Often hackers find this information readily available on the dark web or in plain sight on internet search engines such as Shodan.io.

Inventory all your assets and monitor your external attack surface. Qualys CyberSecurity Asset Management (CSAM) provides comprehensive visibility of your external-facing IT infrastructure by natively correlating asset telemetry collected by Qualys sensors (e.g. Internet Scanners, Cloud Agents, Network Passive Sensors) and key built-in integrations such as Shodan.io and Public Cloud Providers.

One of the biggest risks is unknown unknowns. These gaps in visibility happen for many reasons – including shadow IT, forgotten websites, legacy services, mergers & acquisitions (M&A), or simply because a development team exposes an application or database without informing their security team.

CSAM enables you to continuously discover these blind spots and assess their security and compliance posture.

Monitor Industrial Control Systems and Operational Technology

Network segmentation traditionally kept Industrial Control Systems air-gapped. However, the acceleration of digital transformation has enabled more of these systems to connect with corporate as well as external networks, such as device vendors and Industrial IoT platforms. Further, the majority of Operational Technology utilizes legacy, non-secure protocols.

Build full visibility of your critical infrastructure, network communications, and vulnerabilities with Qualys Industrial Control Security (ICS).

Detect and disable all non-essential ports and protocols, especially on internet exposed assets

Inventory your internal and external-facing assets, report open ports, and detected services on each port. Qualys CSAM supports extensive query language that enables teams to report and act on detected external facing assets that have a remote-control service running (for example Windows Remote Desktop).

Ensure all systems are protected with up-to-date antivirus/anti-malware software

Flag assets within your inventory that are missing antivirus, or with signatures that are not up to date. CSAM allows you to define Software Rules and assign required software on a specific scope of assets or environment. For example, all database servers should have antivirus and a data loss prevention agent.

Verify that your antivirus/anti-malware engine is up to date with the latest signatures.

For devices missing antivirus or anti-malware, Qualys Multi-Vector EDR with Integrated Anti-Malware can be easily enabled wherever the Qualys Cloud Agent is installed to provide immediate threat protection. In addition to basic anti-malware protection, Multi-Vector EDR will monitor endpoint activity to identify suspicious and malicious activity that usually bypasses traditional antivirus such as Living-off-the-Land attacks as well as MITRE ATT&CK tactics and techniques.

Step 2: Detect, Prioritize and Remediate CISA’s Catalog of Known Exploited Vulnerabilities

Qualys Researcher analyzed all the 300+ CVEs from CISA known exploited vulnerabilities and mapped them to the Qualys QIDs. Many of these CVEs have patches available for the past several years. A new “CISA Exploited” RTI was added to VMDR to help customers create vulnerabilities reports that are focused on CISA exploited vulnerabilities. Customers can use the VMDR vulnerabilities page or VMDR prioritization page and filter the results to focus on all the “CISA Exploited” open vulnerabilities in their environment.

Following are some of the critical vulnerabilities cataloged by CISA, as specifically known to be exploited by Russian state-sponsored APT actors for initial access include:

CVE	QID	Title	Release Date	CVSS_V3
CVE-2018-13379	43702	Fortinet Fortigate (FortiOS) System File Leak through Secure Sockets Layer (SSL) Virtual Private Network (VPN) via Specially Crafted Hypertext Transfer Protocol (HTTP) Resource Requests (FG-IR-18-384)	9/12/2019	9.8
CVE-2019-2725	87386	Oracle WebLogic Server Remote Code Execution Vulnerability (Oracle Security Alert Advisory – CVE-2019-2725)	4/27/2019	9.8
CVE-2019-7609	371687	Kibana Multiple Security Vulnerabilities (ESA-2019-01,ESA-2019-02,ESA-2019-03)	4/18/2019	10
CVE-2019-10149	50092	Exim Remote Command Execution Vulnerability	6/5/2019	9.8
CVE-2019-11510	38771	Pulse Connect Secure Multiple Security Vulnerabilities (SA44101)	8/6/2019	10
CVE-2019-19781	372305	Citrix ADC And Citrix Gateway Arbitrary Code Execution Vulnerability(CTX267027)	12/23/2019	9.8
CVE-2020-0688	50098	Microsoft Exchange Server Security Update for February 2020	2/12/2020	9.8
CVE-2020-4006	13215	VMware Workspace One Access Command Injection Vulnerability (VMSA-2020-0027)	12/7/2020	9.1
CVE-2020-5902	38791	F5 BIG-IP ASM,LTM,APM TMUI Remote Code Execution Vulnerability (K52145254) (unauthenticated check)	7/5/2020	9.8
CVE-2020-14882	87431	Oracle WebLogic Server Multiple Vulnerabilities (CPUOCT2020)	10/21/2020	9.8
CVE-2021-26855, CVE-2021- 26857 CVE-2021-26858, CVE-2021-27065	50107	Microsoft Exchange Server Remote Code Execution Vulnerability (ProxyLogon)	3/3/2021	9.8

See the full list of CISA known exploited vulnerabilities.

Remediate CISA recommended catalog of exploited vulnerabilities

For all CISA cataloged vulnerabilities known to be exploited by Russian state-sponsored actors, Qualys Patch Management customers can create a patch and configuration fix jobs to remediate the risk of all vulnerabilities directly from the VMDR console. Qualys Patch Management maps “CISA Exploited” vulnerabilities detected in the environment to the relevant patches required to remediate those vulnerabilities by downloading the patches without needing to go through the VPN. Customers may use Zero Touch patching to automate the process and ensure all CISA exploited vulnerabilities are automatically fixed including the new vulnerabilities added to the CISA catalog in the future.

Monitor and ensure your software are always up to date

Immediately know all end-of-support critical components across your environment, including open-source software. Qualys CSAM tracks lifecycle stages and corresponding support status, to help organizations manage their technical debt and to reduce the risk of not receiving security patches from the vendor. Security and IT teams can work together to plan upgrades ahead of time by knowing upcoming end-of-life & end-of-support dates.

Use the “Prioritize Report” function in Qualys Patch Management to map software in your environment to the security risk opposed. Prioritize your remediation efforts based on software that introduces the most risk. Use this report to create automated patch jobs to ensure that the riskiest software is always up to date. Alternatively, deploy individual patches for the riskiest software.

Step 3: Protect Your Cloud Services and Office 365

As noted by CISA, misconfiguration of cloud services and SaaS applications like Office 365 are the primary attack vector for breaches.

Detect and Remediate Public Cloud Infrastructure Misconfigurations

Protect your public cloud infrastructure by securing the following services on priority:

IAM: Ensure all users are MFA enabled and rotate all access keys older than 30 days. Verify that all service accounts are valid (i.e. in use) and have the minimum privilege.
Audit Logs: Turn on access logging for all cloud management events and for critical services (e.g. S3, RDS, etc.)
Public-facing assets: Validate that the firewall rules for public-facing assets allow only the needed ports. Pay special attention to RDP access. Place any system with an open RDP port behind a firewall and require users to use a VPN to access it through the firewall.

Automatically detect and remediate cloud misconfigurations using Qualys CloudView.

Protect your Office 365 and Other SaaS Services

Enforce multi-factor authentication on all accounts with access to Office 365 tenants. At a minimum, enable MFA for accounts with different admin access rights to the tenant. Qualys SaaSDR lists all such accounts on which MFA is disabled. Further, Qualys SaaSDR enables continuous security posture assessment of Office 365 via the CIS (Center for Internet Security) certified policy for Office, along with automated security configuration assessment for Zoom, Salesforce, and Google Workspace. This is based on an analysis of all security weaknesses, critical vulnerabilities, and exploits leveraged by attackers in historical attacks as well as security assessments based on the MITRE ATT&CK framework.

Step 4: Continuously Detect any Potential Threats and Attacks

Monitor for increases in suspicious and malicious activities as well as anomalous behavior on all endpoints. With Qualys Multi-Vector EDR, customers can detect Indicators of Compromise (IOC) and MITRE ATT&CK Tactics & Techniques provided by CISA and respond quickly to mitigate the risk by capturing process, file, and network events on the endpoint and correlating them with the latest Threat Intelligence, including new and upcoming Indicators of Compromise (IOC) constantly added by the Qualys Research Team. Anomalous endpoint behavior is detected and identified as MITRE ATT&CK Tactics and Techniques.

The Appendix at the bottom of this post contains a list of Indicators of Compromise (IOC) and MITRE ATT&CK Tactics & Techniques being utilized.

Take Action to Learn More about How to Strengthen Your Defenses

We encourage you to learn more about how to strengthen your defenses consistent with CISA Shields Up guidelines using Qualys Cloud Platform. Join our webinar, How to Meet CISA Shields Up Guidelines for Cyberattack Protection, on March 3, 2022.

Qualys recommends that all organizations, regardless of size, heighten their security posture based on the above actionable steps, to protect critical cyber infrastructure from potential state-sponsored, advanced cyberattacks. Qualys Cloud Platform remains continuously committed to high standards of security and compliance to safeguard customer data. In this amplified threat environment, the entire Qualys team is available to help our customers improve cybersecurity and resilience.