CISA: No federal agencies compromised by Exchange hack so far

Top officials at the Cybersecurity and Infrastructure Security Agency on Wednesday told House lawmakers no federal agencies are known to be compromised by vulnerabilities found in Microsoft Exchange, but warned it is "an evolving campaign with new information coming in by the hour."

"The vast majority of Microsoft Exchange servers have been mitigated across the federal civilian executive branch. We are working with individual agencies to assess their results of their forensic analysis," Eric Goldstein, the executive assistant director for cybersecurity at CISA told a House Appropriations subcommittee. "At this point in time, there are no federal civilian agencies that are confirmed to be compromised by this campaign."

Coming off the heels of multiple high-profile intrusions into both government agencies and private companies, Brandon Wales, CISA's acting director, said "we must raise our game."

"Both the Microsoft Exchange vulnerabilities and the SolarWinds campaign highlight the lengths to which sophisticated adversaries will go to compromise our networks. They will use never seen before techniques, exquisite tradecraft, zero-day vulnerabilities to defeat our current cybersecurity architecture," he said.

CISA's testimony come both as the federal government is reeling from multiple cybersecurity incidents as well as Congress nearing the passage of the $1.9 trillion American Rescue Plan Act, which will include $650 million for CISA.

Rep. Rosa DeLauro (D-Conn.) asked Wales and Goldstein why the Einstein program, which monitors activities flowing in and out of federal agencies, has not prevented any of the attacks in recent months – the Microsoft Exchange hack or the supply chain attack involving SolarWinds Orion.

Goldstein said that Einstein was "reasonably designed" at the time, but its capabilities have become "stale" as technology has evolved over time.

"For this reason, CISA is urgently moving our detective capabilities from that perimeter layer into agency networks to focus on these end points, the servers and workstations where we're seeing adversary activity today," he said. Goldstein added that there are endpoint detection pilots ongoing at certain agencies and the agency will use the $650 million to continue scaling those pilots.

Wales said additional funding is also needed for CISA to expand its ability to hunt for threats across the federal government's networks, but added that it is only a "down payment."

Goldstein said that federal agencies will likely need to request money to improve their own cybersecurity and that the “hope” is those requests will be built into baseline funding moving forward.

"But we do recognize that this will be a long journey. It will be a long path to get federal cybersecurity to the point where it needs to be given the sophistication of our adversaries targeting our networks," he said.

Asked about CISA's understanding of the supply chain attack, Wales said CISA in recent days deployed a new tool to look for evidence of the campaign "moving laterally off of the SolarWinds device into the network."