{"id":209108,"date":"2025-10-29T13:02:08","date_gmt":"2025-10-29T17:02:08","guid":{"rendered":"https:\/\/nationalcybersecuritysociety.org\/?p=209108"},"modified":"2025-11-14T09:31:58","modified_gmt":"2025-11-14T14:31:58","slug":"ctw-24-october-2025","status":"publish","type":"post","link":"https:\/\/nationalcybersecuritysociety.org\/?p=209108","title":{"rendered":"CTW #24 \u2014 October 2025"},"content":{"rendered":"

[et_pb_section fb_built=”1″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}” custom_padding=”||24px|||”][et_pb_row _builder_version=”4.27.4″ _module_preset=”default” locked=”off” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2025\/09\/NCSS-3397-Bulletin-Header-Footer-Header-Graphic-1600×350-Compressed.png” title_text=”NCSS-3397-Bulletin-Header-Footer-Header Graphic 1600×350-Compressed” _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

Published: October 24, 2025<\/em><\/p>\n

[\/et_pb_text][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

Our new bulletin Cyber Threat Watch<\/em><\/strong> has been created to help small businesses stay up to date on the latest threats, news, and events affecting their business. The content has been curated to make cybersecurity easy and accessible for both technical and nontechnical readers.<\/span><\/p>\n

[\/et_pb_text][et_pb_heading title=”Featured Cyber News \u2014 CIS Emergency Directive: Cisco Firewall Devices” _builder_version=”4.27.4″ _module_preset=”default” title_level=”h2″ title_font=”|600|||||||” title_text_color=”#00688E” global_colors_info=”{}”][\/et_pb_heading][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2025\/10\/AdobeStock_1245783325_Editorial_Use_Only-scaled.jpeg” title_text=”Cisco Logo at a Modern Office Building” _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” header_3_text_color=”#00688E” global_colors_info=”{}”]<\/p>\n

On September 25, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued Emergency Directive (ED) 25-03<\/a>, ordering all U.S. federal government agencies to identify and secure Cisco firewall devices that may have been compromised. The directive is legally binding only on the federal government organizations, not on government contractors or private businesses. However, CISA strongly urged all types of businesses to review their systems and take similar protective steps.<\/span><\/p>\n

What the Emergency Directive Is About\u00a0<\/h3>\n

CISA and its international partners reported an ongoing espionage campaign targeting Cisco firewalls used to protect business and government networks. Attackers have found ways to exploit weaknesses in older or unpatched devices, install hidden programs, and secretly view data passing through them. Cisco has since released security updates and detailed guidance on how to confirm whether systems have been affected before applying patches.<\/span><\/p>\n

Although these firewalls are not used solely for remote work, many are configured with virtual private network (VPN)<\/a> features that let employees connect securely from home or other locations. If compromised, attackers could potentially monitor those remote connections and steal sensitive data.<\/span><\/p>\n

Why It Matters for Small Businesses<\/h3>\n

Most small businesses don\u2019t manage Cisco equipment directly, but their IT service providers might. Professional services\u2014such as law, accounting, or consulting practices\u2014often rely on managed firewalls and VPNs to support remote access. If those systems are outdated or unsupported, they can become the weak link that attackers exploit.<\/span><\/p>\n

Even if your business doesn\u2019t use Cisco products, this threat highlights an important point\u2014the devices that guard your network need oversight just like any other business asset. Cybercriminals increasingly target smaller organizations with unpatched systems because they can serve as an easy entry point into larger networks.<\/span><\/p>\n

[\/et_pb_text][et_pb_image src=”https:\/\/nationalcybersecuritysociety.org\/wp-content\/uploads\/2025\/10\/AdobeStock_1567174220-scaled.jpeg” title_text=”AdobeStock_1567174220″ _builder_version=”4.27.4″ _module_preset=”default” global_colors_info=”{}”][\/et_pb_image][et_pb_text _builder_version=”4.27.4″ _module_preset=”default” header_3_text_color=”#00688E” custom_css_free_form=”ol {|| list-style: none !important; || counter-reset: item; ||}||||ol li {|| counter-increment: item; || position: relative; || padding-left: 2em; \/* Adjust as needed for spacing *\/||}||||ol li::before {|| content: counter(item) %22.%22; || font-weight: bold; || position: absolute;|| left: 0; || width: 1.5em; || text-align: right;||}” global_colors_info=”{}”]<\/p>\n

What Your Business Can Do If Cisco Devices Are in Use<\/h3>\n

Small businesses can take these practical steps to reduce potential risk.<\/span>\u00a0<\/span><\/p>\n

    \n
  1. Ask Your IT Provider About Firewall Updates:<\/span><\/strong> A simple question, \u201cAre the security systems that protect our network fully updated and supported?,\u201d can reveal whether your equipment needs attention.<\/span><\/li>\n
  2. Confirm the Patching Process:<\/strong> Cisco has released fixed versions that remove the vulnerabilities. Your IT provider should confirm the update and check for any signs of compromise before and after applying it.<\/li>\n
  3. Review Remote Access Settings:<\/strong> Ensure that only current employees have access to remote connections, with multi-factor authentication (MFA)<\/a> enabled, and that your IT provider monitors for unusual login times or locations.<\/li>\n
  4. Plan for Replacement of Aging Devices:<\/strong> Some older Cisco models are now out of support. Unsupported hardware cannot be updated and should be replaced with newer, secure equipment.<\/li>\n
  5. Pause and Escalate If Compromise Is Suspected:<\/strong> Don\u2019t attempt to fix issues by yourself. Your IT provider should isolate the affected system and, if necessary, contact Cisco or CISA for official guidance.<\/li>\n<\/ol>\n

    If Your Business Is Not Using Cisco Devices<\/h3>\n

    Your business can still take valuable lessons from this threat by applying the following practices:<\/p>\n