Report by CISA
Cybersecurity Performance Goals Adoption Report
Key Findings
Over 7,400 Common Vulnerabilities and Exposures (CVEs) were detected on cloud systems hosting security.txt files from insecure versions exposed to the internet as of September 2024.
Top publicly exposed OT/ICS protocols observed in 2024 included Open Platform Communications Unified Architecture (OPC UA) – 43%, Distributed Network Protocol (DNP) – 22%, Niagara-Fox – 21%, Ethernet/IP – 10%, Modbus – 4%.
The CISA Known Exploited Vulnerabilities (KEV) Catalog recorded 1,199 KEVs as of August 31, 2024.
The number of exploitable services per organization decreased from 12 in August 2022 to 8 in August 2024.
International entities experienced a 65% decrease in exploitable service instances.
SMB vulnerabilities declined by 72%, while RPC accounted for 92% of all exploitable service tickets.
Federal organizations saw a 60% decline in exploitable service instances.
83% of organizations remediated all identified exploitable services, reducing their cyber risk.
79% of private sector organizations reduced exploitable services, while SLTT (State, Local, Tribal, and Territorial) entities experienced a 95% increase in exploitable services over the analysis period.
Government Services and Facilities had the highest exposure to publicly accessible OT (Operational Technology) protocols, with 63% exposure.
Cisco-related vulnerabilities accounted for 9.8% of all observed KEVs.
High-severity KEVs saw a 25% reduction in remediation time.
Outdated SSL and TLS encryption misconfigurations declined, with the average misconfiguration ratio per enrollee dropping from 3.8 to 2.5.
Email security adoption showed strong progress, with 89% of organizations implementing DMARC (Domain-based Message Authentication, Reporting & Conformance).
Email security adoption showed strong progress, with 7% of organizations implementing both DMARC and SPF (Sender Policy Framework).
1% of organizations had no email security controls.
Cloud service providers began offering automated security.txt file generation to improve adoption.
Government Services and Facilities had the highest OT protocol exposure, at 63%.
Average remediation time for critical-severity KEVs improved by 50%, reducing from 60 days to 30 days.
SSL vulnerability remediation times improved significantly, dropping from 200 days in August 2022 to under 50 days in 2024.
58% of KEVs were linked to open-source software vulnerabilities, particularly PHP and Apache.
Only 2% of organizations implemented DMARC, SPF, and STARTTLS together for their email security.
Five sectors with the highest occurrences of exposed OT protocols were: Government Facilities – 63%, Information Technology – 10%, Energy – 10%, Healthcare and Public Health – 5%, Financial Services – 4%.
Organizations enrolled in CISA’s Vulnerability Scanning service saw a steady decline in KEVs on their networks.
Most security.txt files were hosted on port 443 (46%), while 18% were on unsecured ports like 80 and another 18% were on pots like 8080 that are not as safe but can be configured manually to support the necessary encryption.
The five most commonly exploited services in critical infrastructure sectors were File Transfer Protocol (FTP), Remote Desktop Protocol (RDP), Remote Procedure Call (RPC), Server Message Block (SMB), Internet Relay Chat (IRC).
Cyber Hygiene (CyHy) service enrollment increased by 201% from August 2022 to August 2024. The highest enrollment increases were observed in the following sectors: communications (300% increase), emergency services (268% increase), critical manufacturing (243% increase), water and wastewater systems (242%).
45% of all vulnerabilities detected were SSL misconfigurations, but this percentage dropped to 33.5% by mid-2024.
SSL remediation time decreased from 197 days in August 2022 to just 12 days in August 2024.