Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CISA’s January 31, 2024 Supplemental Direction V1 for ED 24-01 required federal agencies using affected Ivanti Connect Secure or Ivanti Policy Secure gateways to disconnect them, hunt for compromise, and rebuild them before returning them to service. Agencies also had to treat related domain accounts, credentials, keys, tokens, and certificates as potentially exposed. The direction was a federal-agency requirement—not a universal legal order for private organizations—and its current status must be confirmed against CISA’s latest directive record.
What CISA’s Ivanti directive covered
CISA issued Supplemental Direction V1 for Emergency Directive 24-01 on January 31, 2024, with an update noted on February 5. It superseded required action 4 in the original ED 24-01 and applied to federal agencies operating affected Ivanti Connect Secure or Ivanti Policy Secure solutions.
The direction described attackers capturing credentials and deploying webshells after working around earlier mitigations and detection methods. CISA’s operative language said: “Agencies running affected products—Ivanti Connect Secure or Ivanti Policy Secure solutions—are required to immediately perform the following tasks.”
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Who was—and was not—covered
- Covered: U.S. federal agencies running affected Ivanti gateways.
- Excluded by statute: National security systems and systems operated by the Department of Defense or the Intelligence Community.
- Private-sector organizations: The directive did not itself impose a universal legal mandate on every company using Ivanti equipment. Private operators should still treat the technical findings and vendor guidance as serious incident-response requirements for their own environments.
Required actions for affected federal agencies
- Disconnect the affected gateway. Remove each affected appliance from agency networks rather than leaving it online while investigating.
- Continue threat hunting. Search systems connected to, or recently connected to, the gateway for indicators of compromise.
- Monitor identity services. Review authentication and identity infrastructure that may have been exposed through the appliance.
- Isolate related systems where possible. Segmentation limits an attacker’s ability to move from the gateway into internal networks.
- Audit privileged accounts. Examine administrative and other high-impact accounts for unauthorized use or persistence.
Disconnecting the appliance was not the endpoint. CISA’s sequence treated the gateway and its surrounding identity environment as potentially compromised until agencies completed the prescribed recovery work.
#1 Best Overall
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
What agencies had to do before reconnecting an appliance
Returning an affected appliance to service required a rebuild, not merely installation of a patch. The sequence specified by CISA was:
- Export the appliance’s configuration settings.
- Perform a factory reset according to Ivanti’s instructions.
- Rebuild the appliance following Ivanti’s instructions.
- Upgrade it to a supported software version obtained from Ivanti’s download portal.
- Reimport the configuration.
- Revoke and reissue exposed certificates, cryptographic keys, and passwords.
Credentials and secrets that required replacement
- The administrator enable password.
- Stored API keys.
- Passwords for local gateway users.
- Service-account passwords used in authentication-server configurations.
- Any certificates or keys that may have been accessible from the compromised appliance.
This is materially different from ordinary patch-only remediation. A patch can close a known vulnerability, but it does not prove that an attacker did not already alter the appliance, steal secrets, or leave persistence behind. Factory resetting and rebuilding establish a clean software baseline; rotating secrets removes credentials that may already be in an attacker’s possession.
Rank #2
- APPLIANCE ONLY: Hardware unit sold without a service subscription — security services, firmware updates and support are NOT included and must be purchased separately to activate protection.
- PERFORMANCE: Up to 2.5 Gbps firewall inspection, 1 Gbps threat prevention and 1.2 Gbps IPSec VPN throughput driven by SonicWall's patented Reassembly-Free Deep Packet Inspection (RFDPI) engine.
- CONNECTIVITY: 8x1GbE + 2x1G SFP in a desktop form factor; zero-touch deploy and manage on-box or via cloud Network Security Manager (NSM).
- THREAT PROTECTION: SonicOS 8 delivers intrusion prevention, gateway anti-malware, application control, TLS/SSL decryption, Capture ATP multi-engine sandboxing (RTDMI) and reputation-based content & DNS filtering with an active service subscription.
- BUILT FOR SMALL BUSINESS & BRANCH: Secure SD-WAN, IPSec and SSL VPN plus Zero-Trust Network Access through Cloud Secure Edge keep distributed sites and remote workers protected.
Why CISA treated associated domain accounts as compromised
The direction instructed agencies to assume associated domain accounts were compromised, including accounts that authenticated through or interacted with the affected gateway. Its account-remediation steps included:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →- Resetting on-premises account passwords twice.
- Revoking Kerberos tickets.
- Revoking tokens for cloud accounts in hybrid deployments.
- Disabling cloud-joined or cloud-registered devices to revoke device tokens.
The direction listed February and March 2024 reporting deadlines. Those dates are historical and should not be presented as current deadlines.
Rank #3
- SonicWall TZ270W Appliance Only - No Service Subscription (02-SSC-2823) - Combines enterprise-grade firewalling with integrated 802.11ac Wave 2 Wi-Fi to deliver secure wired and wireless connectivity in one compact device for small offices and clinics.
- Blocks zero-day threats and ransomware with Capture ATP sandboxing enhanced by RTDMI, plus IPS and anti-malware scanning for layered protection.
- Eliminates the need for separate access points in smaller spaces thanks to built-in high-speed wireless that is simple to deploy and manage.
- Supports VPN, SD-WAN, and TLS 1.3 decryption to secure hybrid cloud access and remote workers while maintaining usability and performance.
- Delivers gigabit performance with up to 750,000 concurrent connections to handle growth in users, devices, and SaaS applications.
Mandatory direction versus broader security recommendations
CISA and partners published joint advisory AA24-060B on February 29, 2024. Its recommendations apply more broadly as defensive practices, but they are not substitutes for the supplemental direction’s federal-agency rebuild and credential actions.
| Area | Supplemental Direction V1 for ED 24-01 | AA24-060B advisory |
|---|---|---|
| Audience | Federal agencies operating affected Ivanti gateways | Organizations defending Ivanti Connect Secure and Policy Secure deployments |
| Authority | Required actions for covered agencies | Recommended risk-reduction measures |
| Network exposure | Disconnect affected instances and hunt connected systems | Limit appliance outbound internet connections to required services |
| Software maintenance | Rebuild and upgrade to a supported version before restoration | Keep operating systems and firmware current |
| Access control | Audit privileged accounts and replace exposed secrets | Limit SSL VPN access to unprivileged accounts where feasible |
Is the directive still in effect?
The published direction said it would remain in effect until CISA determined that all agencies operating affected software had completed the required actions, or until CISA terminated it through another appropriate action. The available published material does not establish a later termination or superseding action.
Rank #4
- SECURITY & SD-WAN PERFORMANCE: The MX75-HW cloud-managed appliance delivers up to 1 Gbps firewall throughput and 500 Mbps VPN throughput, supporting small branch deployments with up to 200 users.
- ADVANCED THREAT PROTECTION: Integrated intrusion prevention, advanced malware protection, and content filtering safeguard your network against evolving cyber threats.
- CLOUD-MANAGED SIMPLICITY: Zero-touch provisioning and centralized cloud dashboard for seamless configuration, monitoring, and troubleshooting.
- APPLICATION-AWARE CONTROL: Layer 7 traffic shaping prioritizes critical applications like voice and video while optimizing overall network performance.
- BUILT-IN SD-WAN & VPN: Simplifies multi-site connectivity with intelligent path control, automatic failover, and secure site-to-site VPN.
Therefore, it is not accurate to state categorically that the directive is still active, and it is equally unsafe to state that it has ended. For a current compliance decision, check CISA’s Cybersecurity Directives index and the latest CISA notice, then verify the applicable Ivanti security advisory for the software version in use.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How administrators should use the 2024 guidance today
If you operate a federal deployment
- Determine whether the appliance and software version fall within the affected products identified by the applicable CISA direction.
- Check the current CISA directive record for any termination, replacement, or updated deadlines.
- Preserve evidence and perform threat hunting before rebuilding.
- Follow the complete disconnect, reset, rebuild, upgrade, configuration-restore, and secret-rotation sequence; do not reduce it to patch installation.
- Coordinate password, ticket, token, and device actions with identity and cloud administrators.
If you operate a private-sector deployment
- Do not assume the federal directive automatically applies to your organization.
- Use the CISA advisory and current Ivanti guidance to assess exposure and define incident-response actions.
- Prioritize isolation, forensic review, supported-version upgrades, and rotation of credentials, certificates, keys, and tokens that could have been exposed.
- Document the decision to restore service and the evidence supporting that decision.
What changed in Ivanti’s 2024 update cycle
On April 4, 2024, CISA reported that Ivanti had released security updates for supported 9.x and 22.x gateway versions addressing vulnerabilities including CVE-2024-21894, CVE-2024-22052, CVE-2024-22053, and CVE-2024-22023. Those version and vulnerability details describe the 2024 update cycle; administrators should consult current vendor advisories rather than infer that those releases are the latest available today.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
