Supporting Our U.S. Federal Customers for BOD 23–02 by Mitigating the Risk From Internet-Exposed Management Interfaces | Qualys
Summary: On June 13, 2023, CISA released Binding Operational Directive 23-02, requiring federal civilian executive-branch agencies to take two primary actions to mitigate risk from internet-exposed management interfaces on devices such as routers, switches, firewalls, VPN concentrators, proxies, load balancers, and out-of-band server management interfaces. Qualys describes its FedRAMP-authorized Cloud Platform, including CSAM with EASM, VMDR, Policy Compliance, and Web Application Scanning, as purpose-built to support compliance with BOD 23-02 and BOD 23-01.
What you should know: The directive's own background states that inadequate security, misconfigurations, and out-of-date software make these internet-facing devices more vulnerable to exploitation, and Qualys notes such endpoints can blend in with other HTTPS webpages, run on non-standard ports, or sit in cloud environments behind a provider's IP space - making a complete inventory of exposed administrative interfaces the hard part of compliance.
Read the original at Qualys Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026