Re: Cybersecurity and Infrastructure Security Agency(CISA) Cyber Hygiene scan services

["Powell, Andy" <ap16 () WILLIAMS EDU>]

Hi Vince,

  We signed up for CISA's CyHy services in July and have only received the
results of their web app scanning to date (still waiting on general vuln
scan results), and your post is a timely reminder for me to ping them again.

  Speaking only of Web App scanning, I found their scan to be helpful and
informative. They use Qualys, so their report format was familiar to me. It
surfaced several concerns, some we were previously aware of and some others
that we weren't. In my opinion, that's working as intended and we're happy
with the service.

  I can only speculate on the cause for delay on the vuln scanning side,
which I chalk up to a supply/demand crunch...we operate a /16 space, which
is probably a pretty unusual slice for CISA, who typically scans "critical
infrastructure" organizations that would work hard to reduce their internet
exposure to something less than 65,000 addresses. I'm guessing we've been
prioritized downward, and wouldn't necessarily take issue with that.

Andrew F. Powell Jr., CISSP, CCSP
Information Security Director
Williams College
22 Lab Campus Drive, Williamstown, MA, 01267
O - (413) 597 - 4340
C - (978) 502 - 0086
(he/him/his)


On Fri, Sep 3, 2021 at 9:43 AM Vince Bonura <vbonura () fordham edu> wrote:

> Good morning, All!
>
>
>
> I am writing to inquire whether anyone is taking advantage of the
> Cybersecurity and Infrastructure Security Agency(CISA) Cyber Hygiene scan
> services?
>
>
>
> We became aware of it recently and are considering signing up. Since it’s
> a free service, and another way to test the vulnerabilities of your
> publicly accessible networks, it seems like a no-brainer.
>
>
>
> But we are curious who is/has used it and what you thought of their
> findings.
>
>
>
> Thanks in advance!
>
>
>
> Vince Bonura
>
> IT Risk Analyst
>
>
>
> Fordham University
>
> (718) 817-1875
>
> **********
> Replies to EDUCAUSE Community Group emails are sent to the entire
> community list. If you want to reply only to the person who sent the
> message, copy and paste their email address and forward the email reply.
> Additional participation and subscription information can be found at
> https://www.educause.edu/community

**********
Replies to EDUCAUSE Community Group emails are sent to the entire community list. If you want to reply only to the 
person who sent the message, copy and paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community