Removed: internet-reachable management interfaces on routers, switches, firewalls, VPN concentrators, proxies, load balancers and out-of-band management cards, across federal agencies.
Outcome: the interfaces are gone rather than monitored. A management page that was never reachable from the internet cannot be logged into from the internet.
CISA’s Binding Operational Directive 23-02 requires federal agencies to find and remove those interfaces, and states its own purpose plainly: “This Directive requires agencies to take steps to reduce the attack surface created by insecure or misconfigured management interfaces across certain classes of devices.”
Exposure is also a decision that regulators now make on your behalf.
Source: CISA, Binding Operational Directive 23-02 (13 June 2023)