CISA Implements New Alert Distribution Strategy via Email and Social Media

The US Cybersecurity and Infrastructure Security Agency (CISA) has implemented a notable change in its distribution strategy for cybersecurity alerts. Moving forward, standard update announcements will no longer be published on CISA’s Cybersecurity Alerts & Advisories webpage. Instead, these updates will be disseminated exclusively through CISA’s email subscription service and through its social media channels, including X (formerly known as Twitter) under the handle CISACyber.

This strategic shift means that the CISA webpage will now focus solely on time-sensitive alerts regarding significant cyber events or emerging threats. The agency’s intention is to enhance the accessibility of critical information and ensure it receives the necessary attention from stakeholders.

To stay informed, stakeholders are urged to subscribe to pertinent email topics via GovDelivery on CISA.gov. Those who monitor the Known Exploited Vulnerabilities (KEV) catalog through RSS feeds will also need to adjust their subscription settings to maintain the flow of notifications.

CISA credits feedback from stakeholders as a driving factor behind this change, emphasizing efforts to streamline communications and reduce unnecessary noise in the distribution of information.

However, the revised strategy has sparked concerns among some cybersecurity professionals. Patrick Garrity, a security researcher at VulnCheck, expressed reservations about the changes in a recent post on LinkedIn. He noted that the announcement lacks clarity regarding the full scope of services affected, suggesting that significant alterations to both CISA Advisories and the KEV catalog may not be improvements.

Garrity pointed out several potentially impacted services, including:

– CSAF GitHub Repository
– Alerts & Advisories webpage
– RSS Feeds for Advisories
– KEV GitHub Repository
– KEV JSON Feed
– KEV CSV Feed
– KEV Catalog Website
– KEV RSS Alerts

He emphasized the need for further clarification from CISA to help defenders understand how these adjustments might influence their operational workflows and the automated ingestion of threat intelligence.

Inquiries for more details have been directed to CISA; however, a response has not been received at this time.