The departments of Defense and Justice have both agreed that the Federal Communications Commission must improve the security of internet routing and provided recommendations on how to address vulnerabilities in the Border Gateway Protocol.

DOJ said Wednesday its National Security Division joined the Pentagon in filing a submission in response to a notice of inquiry the FCC released in February to seek comments on how to protect the national communications network from risks posed by the BGP.

“We appreciate the opportunity to provide our input on how to address vulnerabilities threatening the security of internet routing,” said Matthew Olsen, assistant attorney general for national security.

In their filing, the departments recommended that the FCC implement technical security standards and boost transparency to manage BGP-associated vulnerabilities.

The Cybersecurity and Infrastructure Security Agency previously submitted comments to the FCC in which it acknowledged the national security threat of insecure BGP and suggested that the FCC “investigate and consider methods to drive down this risk by utilizing all of its statutory authorities.” 

The U.S. government and international cybersecurity authorities have issued a joint advisory on Iranian government-backed advanced persistent threat actors that exploit cyber vulnerabilities on networks to secure access to systems to support data extortion and disc encryption for ransom operations.

The advisory offers information on Microsoft Exchange, Fortinet and VMware Horizon log4j vulnerabilities that Iranian Islamic Revolutionary Guard Corps-linked cyberthreat actors exploit to gain initial access to U.S. critical infrastructure organizations and other targeted entities, the National Security Agency said Wednesday.

NSA, U.S. Cyber Command, Cybersecurity and Infrastructure Security Agency, FBI and the Department of the Treasury co-authored the advisory with the cybersecurity agencies of Australia, Canada and the U.K.

The agencies recommend that organizations using Fortinet devices, VMware Horizon applications and Microsoft Exchange servers to investigate malicious activity in their networks and implement several mitigation measures.

These measures include implementing backup and restoration policies and procedures; patching and updating systems; using multifactor authentication; implementing network segmentation; and assessing and updating blocklists and allowlists.

The Office of Management and Budget has released guidance for federal agencies to ensure the security of the software supply chain in accordance with a May 2021 executive order on cybersecurity.

Chris DeRusha, federal chief information security officer at OMB and deputy national cyber director, wrote in a blog post published Wednesday the OMB memo was developed using insights from academia and public and private sectors.

DeRusha, a previous Wash100 Award winner, said the document “directs agencies to use only software that complies with secure software development standards, creates a self-attestation form for software producers and agencies, and will allow the federal government to quickly identify security gaps when new vulnerabilities are discovered.”

According to the memo, federal agencies should comply with the National Institute of Standards and Technology’s guidance when using third-party software on government information systems.

Within 90 days of the memo’s issuance, agencies should conduct an inventory of all software, including a separate inventory for “critical software.”

The OMB guidance document also directs agencies to come up with a process to communicate relevant requirements to vendors and ensure that attestation letters are gathered in one system.