CISA launches Installed Base Program with OEMs to find and notify owners of internet-exposed OT assets
The Cybersecurity and Infrastructure Security Agency (CISA) has launched the Installed Base Program, a voluntary partnership with original equipment manufacturers (OEMs) aimed at helping critical infrastructure operators find and remove vulnerable, internet-exposed operational technology (OT) assets before attackers exploit them. The gap it targets is that public data usually names only the internet service provider behind an exposed device, not the organization that owns it. CISA uses open-source scanning, its Cyber Hygiene Vulnerability Scanning Service and, when ownership cannot be established otherwise, its administrative subpoena authority to reach owners, then notifies them with OEM input. The agency says these notifications have already helped remove thousands of vulnerable assets from internet exposure, and participating OEMs report large drops in exposed devices across their customers. The article presents this as a program announcement and names no specific vulnerability, product flaw or exploitation campaign.
Detalhes técnicos
The program runs in five stages. In the first, data gathering and asset discovery, OEMs review vulnerable IP data from internal sources, third parties or CISA, validate ownership, prioritize which installed equipment CISA should analyze and send validated data back to CISA. In the second, CISA uses open-source and internal tools to confirm that a device exists, is exposed and is vulnerable, and to identify its owner or operator; where ownership stays unclear, CISA checks whether the IP address qualifies for the subpoena process. In the third, CISA issues the administrative subpoena to the relevant service provider, typically the owner's ISP, to obtain the operator's contact details. In the fourth, notification, CISA sends the owner a CISA-developed mitigation guide that summarizes the flaw and includes OEM recommendations. In the fifth, feedback, CISA reports the analysis, subpoena, notification and mitigation status to the OEM, and shares aggregated sector data with OEMs and Sector Risk Management Agencies. Shared OEM data is marked Traffic Light Protocol (TLP) Amber+STRICT, so it stays with CISA and the originating company. Partners meet with CISA monthly, and participation requires an agreement covering roles, responsibilities and data-sharing rules.
Remediação
The program itself is aimed at OEMs and asset owners, so the article describes no patch or workaround. Its stated guidance is that owners of exposed OT assets should remove them from internet exposure and apply the hardening steps in the CISA mitigation guide. OEMs that want to join can contact CISA directly, as the article describes. The article does not name a contact address, and the CISA program page could not be opened during research, so the enrolment details come from the article alone.
Relatos divergentes
No conflicting reports were found. The program page on cisa.gov appeared in search results but could not be fetched, so the article is the only full source for the program's process.
Linha do tempo
-
CISA launches Installed Base Program with OEMs to find and notify owners of internet-exposed OT assets
ler a análise desta fonte ocultar
The Cybersecurity and Infrastructure Security Agency (CISA) has launched the Installed Base Program, a voluntary partnership with original equipment manufacturers (OEMs) aimed at helping critical infrastructure operators find and remove vulnerable, internet-exposed operational technology (OT) assets before attackers exploit them. The gap it targets is that public data usually names only the internet service provider behind an exposed device, not the organization that owns it. CISA uses open-source scanning, its Cyber Hygiene Vulnerability Scanning Service and, when ownership cannot be established otherwise, its administrative subpoena authority to reach owners, then notifies them with OEM input. The agency says these notifications have already helped remove thousands of vulnerable assets from internet exposure, and participating OEMs report large drops in exposed devices across their customers. The article presents this as a program announcement and names no specific vulnerability, product flaw or exploitation campaign.
Technical Details
The program runs in five stages. In the first, data gathering and asset discovery, OEMs review vulnerable IP data from internal sources, third parties or CISA, validate ownership, prioritize which installed equipment CISA should analyze and send validated data back to CISA. In the second, CISA uses open-source and internal tools to confirm that a device exists, is exposed and is vulnerable, and to identify its owner or operator; where ownership stays unclear, CISA checks whether the IP address qualifies for the subpoena process. In the third, CISA issues the administrative subpoena to the relevant service provider, typically the owner's ISP, to obtain the operator's contact details. In the fourth, notification, CISA sends the owner a CISA-developed mitigation guide that summarizes the flaw and includes OEM recommendations. In the fifth, feedback, CISA reports the analysis, subpoena, notification and mitigation status to the OEM, and shares aggregated sector data with OEMs and Sector Risk Management Agencies. Shared OEM data is marked Traffic Light Protocol (TLP) Amber+STRICT, so it stays with CISA and the originating company. Partners meet with CISA monthly, and participation requires an agreement covering roles, responsibilities and data-sharing rules.
Remediation
The program itself is aimed at OEMs and asset owners, so the article describes no patch or workaround. Its stated guidance is that owners of exposed OT assets should remove them from internet exposure and apply the hardening steps in the CISA mitigation guide. OEMs that want to join can contact CISA directly, as the article describes. The article does not name a contact address, and the CISA program page could not be opened during research, so the enrolment details come from the article alone.
Conflicting Reports
No conflicting reports were found. The program page on cisa.gov appeared in search results but could not be fetched, so the article is the only full source for the program's process.