CISA revises incident form to link attacks across organizations
Original title: CISA tweaks cyber incident form to spot attacks that might be linked
The form now uses malware, social-engineering, hacking, insider, and MITRE ATT&CK terms so analysts can compare reports.
CISA updated its online incident reporting form so analysts can tell when attacks on different organizations may belong to one campaign. The questionnaire asks more specific questions, drops duplicates, and uses consistent terms for malware, attempts to trick people, hacking techniques, and insider threats. Reports can be filed without signing in; Login.gov lets reporters save drafts and track submissions. CISA still accepts email at Contact@cisa.dhs.gov and says federal civilian agencies must meet their own deadlines.
- Paperwork notice estimates 30 minutes to prepare and complete a response.
- Critical infrastructure operators are encouraged to report voluntarily.
- Malicious files should be linked later with the CISA incident ID.
- Personal information is requested only when needed to understand the incident.
- 1.File through CISA’s online form or email Contact@cisa.dhs.gov.
- 2.Federal civilian agencies should follow the reporting deadlines that apply to them.
- Organizations
- CISA
- Countries
- United States
From the original article
1 min read at helpnetsecurity.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its online incident reporting form to help analysts spot when attacks on different organizations may be part of the same campaign.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.