CISA report touts cyber hygiene enrollment surge for critical infrastructure orgs

The Cybersecurity and Infrastructure Security Agency has seen a surge in its Cyber Hygiene (CyHy) service enrollment from critical infrastructure organizations over a two-year period, with the communications sector representing the biggest jump.

In a report released Friday, CISA said an analysis of the 7,791 critical infrastructure organizations enrolled in the agency’s vulnerability scanning service from Aug. 1, 2022, through Aug. 31, 2024, showed a 201% increase in its CyHy enrollment, led by the communications (300%), emergency services (268%), critical manufacturing (243%) and water and wastewater systems (242%) industries.

As a result of this enrollment boom, CISA said it has found improvements across its six cybersecurity performance goals, or CPGs: mitigating known vulnerabilities, no exploitable services on the internet, strong and agile encryption, limit OT connections on the public internet, deploy a security.txt file, and email security.

One area of improvement cited by CISA is a steady decrease in the number of exploitable services routinely monitored by the agency’s vulnerability scanning, from 12 services per CyHy enrollee in August 2022 to roughly eight apiece two years later.

The number of known exploited vulnerability tickets also declined over those two years, with critical-severity KEVs falling 50% and high-severity KEVs dropping by 25%. Remediation times for Secure Sockets Layer (SSL) vulnerabilities fell as well, with tickets resolved in 200 or so days as of August 2022 before decreasing to less than 50 days months later. 

Also highlighted in CISA’s report was data on the highest occurrences of operational technology protocols exposed to the public internet, drawing particular attention to the 63% exposure rate found in the government services and facilities sector. The IT (10%), energy (10%), health care (5%) and financial services (4%) industries were also called out. 

“Overall, CISA initiatives, programs, and products are directly influencing critical infrastructure sector service enrollments and adoption of CPGs,” the report concluded. “General analysis of CISA data reveals a moderate impact of CPG adoption across critical infrastructure sectors.”