The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released an updated cyber incident reporting form, an enhanced web-enabled questionnaire available on CISA’s Incident Reporting Portal for reporting cyber incidents. By improving data quality, the more robust form strengthens the effectiveness and efficiency of national cyber defense. For instance, the new form will help CISA correlate related cyber threat activity to identify a larger trend from what otherwise would appear as independent incidents.
While only federal civilian agencies are required to report, CISA encourages any organization that experiences a cyber incident to voluntarily report. The CISA Incident Reporting System provides a secure web-enabled means of reporting computer security incidents to CISA. This system assists analysts in providing timely handling of security incidents as well as the ability to conduct improved analysis.
“In the team sport of cybersecurity, one organization’s detection is another’s protection,” Chris Butera, CISA’s acting executive assistant director for cybersecurity, said in a media statement. “As the national coordinator for critical infrastructure cybersecurity and resilience, CISA is able to leverage such incident reporting to identify emerging cyber campaigns, warn potential targets, and strengthen the Nation’s collective defense.”
The cyber incident reporting form is guided by community feedback CISA has received over the years and the agency’s efforts to improve data quality that enables rapid yet thorough threat analysis. For example, questions about the type of incident are more comprehensive and seek more granular information, including whether the incident involved malware, social engineering, hacking techniques, or an insider threat.
Also, questions about observed activity now incorporate the MITRE ATT&CK Framework, language about adversary behavior that is familiar to the cyber community.
For the federal government, the Federal Information Security Modernization Act of 2014 (44 USC 3552) defines an incident as an occurrence that either actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system, or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.
Additionally, the Protected Critical Infrastructure Information (PCII) Program enhances information sharing on the security of critical infrastructure between the public and private sectors with the government by protecting sensitive critical infrastructure information from disclosure per the Critical Infrastructure Information Act of 2002.
Federal incident notification guidelines, including definitions and reporting timeframes, are available online.
In general, the types of activity that may qualify as an incident include, but are not limited to, network intrusions that gain unauthorized access to a system or its data, including incidents involving Personally Identifiable Information (PII). They also include malicious disruption or denial of service, the unauthorized use of a system to modify data, and changes to system hardware, firmware, or software characteristics made without the owner’s knowledge, instruction, or consent.
“In order for us to respond appropriately, please answer the questions as completely and accurately as possible. Questions that must be answered are marked with a red asterisk. This website uses Secure Sockets Layer (SSL)/Transport Layer Security (TLS) to provide more secure communications than unencrypted,” CISA detailed.
Earlier this year, CISA released a comprehensive document that calls upon critical infrastructure organizations to act against insider threats by taking more decisive steps to address insider risk. The guidance laid down a ‘Plan, Organize, Execute, and Maintain’ (POEM framework) that encourages an organization to Plan how it will use a threat management team, Organize the team’s members according to the organization’s needs, Execute effective insider threat mitigation through use of the team, and Maintain the viability of the threat management team to grow its capabilities and improve its operations in the future.
