CISA revises incident reporting form to help link attacks that may belong to the same campaign
CISA has revised the questionnaire in its online Incident Reporting Portal so analysts can spot when attacks on different organizations may be part of one campaign (helpnetsecurity.com). The new form asks more specific questions on malware, social engineering, hacking techniques and insider threats, removes duplicate questions, and uses MITRE ATT&CK terms so that submissions can be compared (helpnetsecurity.com; nextgov.com). Nextgov reports that the changes followed feedback from incident response partners and that the broader CIRCIA final rule, which would make disclosure mandatory for critical infrastructure, was still listed as pending White House review (nextgov.com). The story names no vulnerability, exploit, malware family or threat actor, so it carries no direct threat to defenders.
Remediação
- Report incidents through the online form, which needs no sign-in. Signing in with Login.gov and a work email allows saving drafts, tracking submissions and following up with CISA (helpnetsecurity.com).
- Use [email protected] only as a fallback, since CISA prefers the online form (helpnetsecurity.com).
- Include personal information only when the incident requires it. To share a file with malicious code, submit the report first, then link the file with the CISA incident ID through the separate malware analysis form (helpnetsecurity.com).
- Federal civilian executive branch agencies must follow the reporting requirements and deadlines that apply to them; other critical infrastructure operators are encouraged to report voluntarily (helpnetsecurity.com).
Linha do tempo
-
CISA revises incident reporting form to help link attacks that may belong to the same campaign
ler a análise desta fonte ocultar
CISA has revised the questionnaire in its online Incident Reporting Portal so analysts can spot when attacks on different organizations may be part of one campaign (helpnetsecurity.com). The new form asks more specific questions on malware, social engineering, hacking techniques and insider threats, removes duplicate questions, and uses MITRE ATT&CK terms so that submissions can be compared (helpnetsecurity.com; nextgov.com). Nextgov reports that the changes followed feedback from incident response partners and that the broader CIRCIA final rule, which would make disclosure mandatory for critical infrastructure, was still listed as pending White House review (nextgov.com). The story names no vulnerability, exploit, malware family or threat actor, so it carries no direct threat to defenders.
Remediation
- Report incidents through the online form, which needs no sign-in. Signing in with Login.gov and a work email allows saving drafts, tracking submissions and following up with CISA (helpnetsecurity.com).
- Use [email protected] only as a fallback, since CISA prefers the online form (helpnetsecurity.com).
- Include personal information only when the incident requires it. To share a file with malicious code, submit the report first, then link the file with the CISA incident ID through the separate malware analysis form (helpnetsecurity.com).
- Federal civilian executive branch agencies must follow the reporting requirements and deadlines that apply to them; other critical infrastructure operators are encouraged to report voluntarily (helpnetsecurity.com).