Binding Operational Directives

The Cybersecurity & Infrastructure Security Agency (CISA) develops and oversees the implementation of binding operational directives (BODs). These directives require action on the part of certain federal agencies in the civilian Executive Branch.

Lucidum can help you easily respond to BODs.

BOD 23-01

CISA BOD 23-01 includes the following requirements:

Connectors

Connectors enable Lucidum to ingest data from your environment and discover, identify, and classify assets, data, and users.

Lucidum includes pre-built connectors for the most commonly used solutions for security, vulnerability scanning, cloud, data warehouse, identity management, logs, network, endpoint management, IP management, file sharing, and devops.

To configure a connector, you provide credentials that allow Lucidum secure, read-only access to a deployed solution. Lucidum then makes read-only API calls to ingest data from the solution.

The current list of Connectors reflects all the Connectors currently in production at customer sites. With over 300 connectors, we’re sure we have yours. And if we don’t have your connector, we guarantee a 2-day turnaround for new connectors.

Perform Automated Asset Discovery

To find all the assets in your network, including nomadic/roaming devices and mobile devices:

1. Lucidum recommends you configure Lucidum connectors for:

   • The Endpoint Management solutions in your environment (for example, Jamf, Intune, Citrix Endpoint Management, Symantec Endpoint Management, Hexnode)

   • The Endpoint Protection solutions in your environment (for example, Trellix Endpoint Security, Symantec Endpoint Protection, SentinelOne, Crowdstrike Falcon, Microsoft Defender for Endpoint )

   • The Mobile Device Management solutions in your environment (for example, Addigy, Citrix Endpoint, Jamf Pro, Kandji)

   • The directory solutions in your environment (for example, Azure AD, Microsoft AD, Jump Cloud, PingOne, OpenLDAP,)

   • The DHCP solutions in your environment (for example, Infoblox, Efficient IP, BlueCat)

   • The VPN solutions in your environment (for example, Cisco AnyConnect, FortiClient, Palo Alto VPN, Citrix Gateway, Zscaler Private Access)

   • The cloud solutions in your environment (for example, AWS, Azure, Google Cloud, Oracle Cloud)

2. After Lucidum ingests data from these systems, Lucidum uses graph data, machine learning, and predictive analytics to detect and classify all assets and users, even those not detected by the solutions in your environment.

3. You can then create queries to find a list of all assets in your environment.

   • In this case, our query is as simple as “Lucidum Asset Name exists”, meaning Lucidum has found the asset.

4. The query results display all the assets in your environment.

5. You can easily filter and sort the query results and create dashboards.

   

6. To see new assets that have been added in the last week:

   • You can create a query “Lucidum Asset Name exists AND First Time Seen was within the past 7 days”
     

   

Initiate Vulnerability Enumeration

To audit the vulnerabilities on all assets in your environment and find unmitigated vulnerabilities on all assets in your environment:

1. In addition to the Lucidum connectors in the previous section, you must configure Lucidum connectors for:

   • One or more vulnerability Management solutions (for example, Burp Suite, Cycognito, Greenbone, Kenna, MS Defender, Qualys, Rapid7, Tenable, Vulcan)

2. After Lucidum ingests data from these systems, you can then create queries and dashboards that display information about vulnerabilities.

3. To find assets without vulnerability scanning, you can write a query like:

   • Lucidum Asset Name exists AND Vuln Scan is not Yes

   

4. You can then remediate by adding vulnerability scanning to these assets without vulnerability scanning.

5. To see each asset that has vulnerabilities, you can write a query like:

   • Lucidum Asset Name exists AND CVE list exists OR Vulnerabilities exists

   

   You can also create dashboards that display information about CVEs:

   

6. To find any assets with unmitigated vulnerabilities, you can write a query like:

   • Lucidum Asset Name exists AND CVE list exists OR Vulnerabilities exist AND Mitigated Vulns are less than 1

   

7. You can then take steps to mitigate those vulnerabilities on those assets.

Ingestion of Vulnerability Results

When you have added vulnerability scanning to all assets in your environment and remediated all vulnerabilities, you can again write the query:

• Lucidum Asset Name exists AND CVE list exists OR Vulnerabilities exist

You can then export the results of that query to a CSV file for upload to the CDM Agency Dashboard.

To do this:

1. Write the query “Lucidum Asset Name exists AND CVE list exists OR Vulnerabilities exists”

   

2. Click Show Result.

   

3. Click the … in the lower right and select Export Result.

4. Choose the fields to include in the export.

   • To delete a field, click on the x

   • To add a field, click anywhere in the box of fields and select from the list of available fields.

5. Click Confirm.

6. The query results are saved as a CSV file.