CISA tweaks cyber incident form to spot attacks that might be linked
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its online incident reporting form to help analysts spot when attacks on different organizations may be part of the same campaign.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its online incident reporting form to help analysts spot when attacks on different organizations may be part of the same campaign.
The revised questionnaire asks more specific questions and removes duplicate ones; the form asks whether an incident involved malware, attempts to trick people, hacking techniques, or an insider threat.
When organizations describe what they observed in consistent terms, CISA can more easily compare reports, look for connections, and warn other potential targets.
Those who sign in with Login.gov using their work email can save a draft, return to it later, track a submitted report, and follow up with CISA.
CISA prefers the online form and continues to accept reports by email at Contact@cisa.dhs.gov.
CISA encourages critical infrastructure operators and other organizations to report voluntarily.
To share a file containing malicious code, first submit the incident report, then use its CISA incident ID to link the file through the separate malware analysis form.
Federal civilian executive branch agencies must follow the reporting requirements and deadlines that apply to them.
What happened
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has updated its online incident reporting form to help analysts spot when attacks on different organizations may be part of the same campaign.
The revised questionnaire asks more specific questions and removes duplicate ones; the form asks whether an incident involved malware, attempts to trick people, hacking techniques, or an insider threat.
What changed
When organizations describe what they observed in consistent terms, CISA can more easily compare reports, look for connections, and warn other potential targets.
Those who sign in with Login.gov using their work email can save a draft, return to it later, track a submitted report, and follow up with CISA.
CISA prefers the online form and continues to accept reports by email at Contact@cisa.dhs.gov.
Who is affected
CISA encourages critical infrastructure operators and other organizations to report voluntarily.
Technical details
To share a file containing malicious code, first submit the incident report, then use its CISA incident ID to link the file through the separate malware analysis form.
What security teams should do
Federal civilian executive branch agencies must follow the reporting requirements and deadlines that apply to them.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.