Last week I discussed HR 10671, the Securing Our Critical Infrastructure Act. The bill would require CISA to establish a vulnerability notification program for water facilities. Today, I would like to take a brief look at how such a program might work.
Unfortunately, it is not really possible to produce a short version of the post that appears on my CFSN Detailed Analysis blog- https://patrickcoyle.substack.com/p/vulnerability-notifications - subscription required. It addresses the following topics:
- Notification Agency,
- Identification of Vulnerabilities,
- Vulnerable Device Identification,
- Notification Process,
- Facility Response,
- KEV Special Case,
- Other Routes of Attack, and
- Program Drawbacks
The article will be removed from the normal paywall tomorrow.
Posts
No comments:
Post a Comment