<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Franklin Gothic Book";
panose-1:2 11 5 3 2 1 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.xxmsonormal, li.xxmsonormal, div.xxmsonormal
{mso-style-name:x_x_msonormal;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.contentpasted0
{mso-style-name:contentpasted0;}
span.xxcontentpasted2
{mso-style-name:x_x_contentpasted2;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">FYSA<o:p></o:p></p>
<div>
<div>
<div>
<div style="margin-bottom:8.0pt">
<p class="xxmsonormal"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Yesterday, the Cybersecurity and Infrastructure Security Agency (CISA), Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) and National Security
Agency (NSA) published a joint </span><span style="font-size:12.0pt;color:black"><a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-208a"><span style="font-size:11.0pt;font-family:"Franklin Gothic Book",sans-serif">Cybersecurity Advisory</span></a></span><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">
(CSA) titled “Preventing Web Application Access Control</span><span style="font-size:12.0pt;color:black"> </span><span class="contentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Abuse." </span></span><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">The
joint CSA warns vendors, designers, developers, and end-user organizations of web applications about insecure direct object reference (IDOR) vulnerabilities that are frequently exploited by malicious actors. The CSA provides important guidance to reduce prevalence
of IDOR flaws and vulnerabilities. </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Depending on the type of IDOR vulnerability, malicious actors can access sensitive data, modify or delete objects, or access functions. These vulnerabilities exist
because an object identifier is exposed, passed externally, or easily guessed, allowing any user to use or modify the identifier. And these flaws and vulnerabilities are common, hard to prevent outside of the development process, and can be abused at scale
in data breach incidents. </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">In the joint advisory,
<span class="xxcontentpasted2">mitigations are categorized and aligned for specific groups - vendors and developers;
<i>all end-user organizations</i>; end-user organizations with on-premises software, infrastructure-as-a-service (IaaS), or private cloud models; and
<i>end-user organizations with software-as-a-service (SaaS).</i></span> Implementing secure-by-design principles into each state of software development life cycle (SDLC) is strongly encouraged. </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">Vendors, designers, and developers of web application frameworks and web applications are strongly encouraged to implement secure-by-design into each stage of software
development life cycle (SDLC). </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xxmsonormal"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black">All organizations are strongly urged to review the advisory and apply mitigation measures to reduce the prevalence of IDOR vulnerabilities and flaws to protect sensitive
data in their systems. <o:p></o:p></span></p>
<p class="xxmsonormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span style="color:#1F497D">Theresa A. Masse<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity State Coordinator/Advisor, Region 10 (Oregon)
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity and Infrastructure Security Agency<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Department of Homeland Security<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Phone: (503) 930-5671
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Email:</span><span style="font-size:10.0pt;color:#777777">
</span><a href="mailto:theresa.masse@cisa.dhs.gov"><span style="font-size:10.0pt;color:#0563C1">theresa.masse@cisa.dhs.gov</span></a><u><span style="font-size:10.0pt;color:#0760C1"><o:p></o:p></span></u></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><img border="0" width="97" height="97" style="width:1.0138in;height:1.0138in" id="Picture_x0020_2" src="cid:image001.png@01D9C121.93FB6CF0"><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="xxmsonormal" style="margin-bottom:8.0pt"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
</div>
</body>
</html>