[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmPoPTIHX0wbQFo1KxdoVzStDdla8h1kcyrKctxTA8b4":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"d8ec7959-ce2f-477c-a3b8-209a23533a44","CISA’s new strategy runs into America’s blind trust problem","cisa-s-new-strategy-runs-into-america-s-blind-trust-problem-3fda35","Persistent credentials and forgotten software approvals leave essential operational networks vulnerable under CISA’s latest cybersecurity roadmap. The post CISA’s new strategy runs into America’s blind trust problem appeared first on CyberScoop.","CISA's 'CISA 2030: Defend, Harden, Prevail' strategy highlights vulnerabilities in operational technology security due to persistent credentials and outdated software approvals. The agency acknowledges that even strong defenses can be bypassed if systems continue to implicitly trust devices, software, or identities approved long ago, especially as contractor access and remote connections evolve. The article stresses the need for continuous reassessment of these trust relationships and accountability for how devices, code, and identities interact throughout their lifecycle.","CISA's new strategy faces challenges with persistent credentials and forgotten software approvals in operational","https:\u002F\u002Fcyberscoop.com\u002Fcisa-2030-strategy-operational-technology-blind-trust-op-ed\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F09\u002FGettyImages-2240293448.jpg","2026-11-03T11:00:00+00:00","2026-11-03T12:00:50.021631+00:00",7,[17,20,23],{"name":18,"type":19},"CISA","vendor",{"name":21,"type":22},"operational technology","technology",{"name":24,"type":22},"AI","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":25,"icon":27,"name":28,"slug":29},null,"Policy","policy",[31,36,38,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":51,"vendors":138},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":82,"name":83,"problem":84,"products":85},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-access","Cloudflare Access","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Faccess\u002F","Zero trust access to internal applications without a VPN.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-private-access","Netskope Private Access","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fprivate-access","Zero trust access to private applications.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"slug":111,"name":112,"problem":113,"products":114},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[115,123,130],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":125,"url":128,"description":129},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":151},"blind-trust-in-old-credentials-and-approved-software-leaves-ot-systems-exposed","Blind Trust in Old Credentials and Approved Software Leaves OT Systems Exposed","CISA's 2030 strategy exposes a systemic flaw: organizations continue to implicitly trust devices, identities, and software simply because they were approved at some point in the past, without reassessing whether that trust is still warranted. This is especially dangerous in operational technology (OT) environments where contractor access, persistent credentials, and legacy software approvals can persist for years unchecked. As remote connections and supply chains evolve, a single stale trusted identity or outdated approval can serve as a bypass around even sophisticated defenses. Continuous reassessment of trust relationships—not just one-time vetting—is essential to modern security architecture.",[144,145,146,147,148,149,150],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing","DORA Article 9",{"DORA Article 9":152,"NIS2 Article 21(2)(b)":153,"MITRE ATT&CK T1566: Phishing":154,"NIST SP 800-53 SI-2: Flaw Remediation":155,"CIS Control 7: Continuous Vulnerability Management":156,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":157,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":158},"DORA requires financial entities to implement access control measures and continuously manage ICT third-party risk, addressing the contractor and remote-access trust gaps CISA warns about.","NIS2 mandates that operators of essential services implement policies on access control and identity management, directly targeting the blind trust in legacy credentials that this article highlights.","While not phishing-specific, the persistence of stale trusted identities mirrors the ATT&CK principle of adversaries leveraging trusted relationships and valid accounts to move laterally—highlighting why trust must be continuously validated rather than assumed.","Outdated software that retains implicit trust without re-evaluation represents unaddressed flaws; this control requires organizations to identify, report, and correct information system flaws on a defined schedule.","Regularly reassessing outdated software approvals and unpatched OT components requires the continuous vulnerability scanning and remediation cadence this control mandates.","This control requires timely identification and remediation of technical vulnerabilities, which includes reassessing whether previously approved software and devices remain secure over time.","This function directly addresses the need to continuously manage and validate identities and access rights, preventing the persistent-credential trust problem CISA identified."]