CISA tweaks cyber incident form to spot attacks that might be linked

The U.S. Cybersecurity and Infrastructure Security Agency ( CISA ) has updated its online incident reporting form to help analysts spot when attacks on different organizations may be part of the same campaign. The revised questionnaire asks more specific questions and removes duplicate ones.

The form asks whether an incident involved malware , attempts to trick people, hacking techniques, or an insider threat. It also uses terms from MITRE ATT&CK, a catalog of attacker techniques. When organizations describe what they observed in consistent terms, CISA can more easily compare reports, look for connections, and warn other potential targets.

“As the national coordinator for critical infrastructure cybersecurity and resilience, CISA is able to leverage such incident reporting to identify emerging cyber campaigns, warn potential targets, and strengthen the Nation’s collective defense,” said Acting Executive Assistant Director for Cybersecurity Chris Butera .

Organizations can submit a report without signing in. Those who sign in with Login.gov using their work email can save a draft, return to it later, track a submitted report, and follow up with CISA. The paperwork notice estimates 30 minutes to prepare and complete a response, including the time needed to gather information.

Source: CISA’s Incident Reporting Portal

CISA prefers the online form and continues to accept reports by email at @cisa.dhs.gov. Federal civilian executive branch agencies must follow the reporting requirements and deadlines that apply to them. CISA encourages critical infrastructure operators and other organizations to report voluntarily.

The portal asks reporters to include personal information only when it is necessary to understand the incident. To a file containing malicious code, first submit the incident report, then use its CISA incident ID to link the file through the separate malware analysis form.