Ride the Lightning

Cybersecurity and Future of Law Practice Blog
by Sharon D. Nelson Esq., President of Sensei Enterprises, Inc.

Calling All Bad Boys and Bad Girls! Have You Reviewed CISA’s Bad Practices List?

September 1, 2021

The Cybersecurity & Infrastructure Security Agency (CISA) has a list of Bad Practices in cybersecurity that are exceptionally risky.  On August 30, it added single-factor authentication for remote or administrative access systems to the list. If all you need to gain access to a network is a password, you are definitely on the “bad” list.

These bad practices apply to us all, though they are extremely dangerous to those entities that are supporting designated Critical Infrastructure or National Critical Functions (NCF). The agency plans to keep updating the narrow list based on feedback from cybersecurity professionals.

The updated list is now as follows:

  1. Use of unsupported (or end-of-life) software in service of Critical Infrastructure and National Critical Functions is dangerous and significantly elevates risk to national security, national economic security, and national public health and safety. This dangerous practice is especially egregious in technologies accessible from the Internet.
  2. Use of known/fixed/default passwords and credentials in service of Critical Infrastructure and National Critical Functions is dangerous and significantly elevates risk to national security, national economic security, and national public health and safety. This dangerous practice is especially egregious in technologies accessible from the Internet.
  3. The use of single-factor authentication for remote or administrative access to systems supporting the operation of Critical Infrastructure and National Critical Functions (NCF) is dangerous and significantly elevates risk to national security, national economic security, and national public health and safety. This dangerous practice is especially egregious in technologies accessible from the Internet.

If your bad practices are reflected in this list, it’s time to make some changes!

Hat tip to Dave Ries.

Sharon D. Nelson, Esq., President, Sensei Enterprises, Inc.
3975 University Drive, Suite 225|Fairfax, VA 22030
Email: Phone: 703-359-0700
Digital Forensics/Cybersecurity/Information Technology
https://senseient.com