CISA orders federal agencies to replace end-of-life edge devices

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a new binding operational directive requiring federal agencies to identify and remove network edge devices that no longer receive security updates from manufacturers. It also warned that end-of-life edge devices (including routers, firewalls, and network switches) leave federal systems vulnerable to newly discovered exploits and expose them to "disproportionate and unacceptable risks." "The imminent threat of exploitation to agency information systems running EOS edge devices is substantial and constant, resulting in a significant threat to federal property. CISA is aware of widespread exploitation campaigns by advanced threat actors targeting EOS edge devices," the cybersecurity agency said on Thursday. "These devices are especially vulnerable to cyber exploits targeting newly discovered, unpatched vulnerabilities. Additionally, they no longer receive supported updates from the original equipment manufacturer, exposing federal systems to disproportionate and unacceptable risks." Binding Operational Directive 26-02 (BOD 26-02) mandates U.S. government agencies to decommission end-of-support (EOS) hardware and software on federal networks to prevent exploitation by advanced threat actors. The directive requires immediate action on vendor-supported devices running end-of-support software for which updates are available, and an inventory of all devices on CISA's end-of-support list within three months. ...