{"id":1298172,"date":"2021-07-15T14:38:02","date_gmt":"2021-07-15T21:38:02","guid":{"rendered":"https:\/\/www.esri.com\/arcgis-blog\/?post_type=blog&p=1298172"},"modified":"2022-02-04T16:27:43","modified_gmt":"2022-02-05T00:27:43","slug":"printnightmare-and-kayseya-ransomware-cyberattacks","status":"publish","type":"blog","link":"https:\/\/www.esri.com\/arcgis-blog\/products\/arcgis-online\/administration\/printnightmare-and-kayseya-ransomware-cyberattacks","title":{"rendered":"Printnightmare and Kayseya Ransomware Cyberattacks"},"author":3911,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","format":"standard","meta":{"_acf_changed":false,"_searchwp_excluded":""},"categories":[37501],"tags":[24081,24071],"industry":[],"product":[36571,36551,763582],"class_list":["post-1298172","blog","type-blog","status-publish","format-standard","hentry","category-administration","tag-ssamymlgp","tag-security","product-arcgis-enterprise","product-arcgis-online","product-trust-arcgis"],"acf":{"short_description":"A brief summary to clarify that Esri is not vulnerable to the Printnightmare and Kayseya Ransomware Cyberattacks","flexible_content":[{"acf_fc_layout":"content","content":"

Esri products are not vulnerable to either of these widely known issues, however your organization will want to ensure your systems are configured appropriately to minimize risk.<\/p>\n

On July 13, 2021 CISA issued an Emergency Directive 21-04<\/a> for mitigating a Windows Print Spooler service vulnerability CVE-2021-34527, referred to as the Printnightmare.\u00a0 We avoid providing an announcement for every event that we are not vulnerable to, however when we see a significant number of customers ask, we provide a Trust Center announcement. \u00a0\u00a0For ArcGIS Online and Esri MCS, the Windows Print Spooler service is not enabled due to enforcing security hardening of systems and is therefore not vulnerable to CVE-2021-34527.\u00a0 For our company operations, we have proactively implemented the recommended mitigation measures.\u00a0 For COTS products, ArcGIS Enterprise does not have a dependency on the print spooler service. Customers are advised to disable the print spooler service as part of standard hardening guidance for public facing web servers, apply the Microsoft security update across operations and restrict the ability to install print drivers on a print server to administrators only \u2013 See emergency directive for further details.<\/p>\n

Lastly, we continue to have some customers ask about the Kayseya Ransomware Cyberattack relative to our offerings.\u00a0 Esri does not utilize Kayseya as part of our operations and was therefore not exposed to this attack.\u00a0 If you are a Kayseya customer, please follow the latest vendor and industry ransomware guidance.<\/p>\n

 <\/p>\n