A study by security company Censys has found hundreds of internet-exposed devices on federal systems that could be exploited by cyberthreat actors.
Censys researchers discovered over 13,000 distinct hosts, including firewalls, virtual private networks and routers, across more than 100 autonomous systems related to over 50 federal civilian executive branch organizations and sub-organizations as part of its analysis of attack surfaces, the company said Monday.
The findings from the study came after the Cybersecurity and Infrastructure Security Agency released in early June a binding operational directive, BOD 23-02, that requires FCEB agencies to initiate steps to mitigate risks from internet-connected interfaces.
The researchers also identified several instances of exposed managed file transfer tools, such as GoAnywhere MFT and MOVEit transfer, and more than 150 instances of end-of-life software on federal systems that could be targeted by cyber hackers.
The study notes that FCEB agencies have 14 days to initiate measures in compliance with the CISA directive by either securing the identified devices under a zero trust architecture or removing them from the public internet.
