The official Website of Bernd Pulch. Since 2009 providing critical insights and political Satire on lawfare, media control, and political reality. Avoid fake sites.
Best Practices for Victim Response and Reporting of Cyber Incidents
15 pages
April 2015
Any Internet-connected organization can fall prey to a disruptive network intrusion or costly cyber attack. A quick, effective response to cyber incidents can prove critical to minimizing the resulting harm and expediting recovery. The best time to plan such a response is now, before an incident occurs.
This “best practices” document was drafted by the Cybersecurity Unit to assist organizations in preparing a cyber incident response plan and, more generally, in preparing to respond to a cyber incident. It reflects lessons learned by federal prosecutors while handling cyber investigations and prosecutions, including information about how cyber criminals’ tactics and tradecraft can thwart recovery. It also incorporates input from private sector companies that have managed cyber incidents. It was drafted with smaller, less well-resourced organizations in mind; however, even larger organizations with more experience in handling cyber incidents may benefit from it.
I. Steps to Take Before a Cyber Intrusion or Attack Occurs
Having well-established plans and procedures in place for managing and responding to a cyber intrusion or attack is a critical first step toward preparing an organization to weather a cyber incident. Such pre-planning can help victim organizations limit damage to their computer networks, minimize work stoppages, and maximize the ability of law enforcement to locate and apprehend perpetrators. Organizations should take the precautions outlined below before learning of a cyber incident affecting their networks.
A. Identify Your “Crown Jewels”
Different organizations have different mission critical needs. For some organizations, even a short-term disruption in their ability to send or receive email will have a devastating impact on their operations; others are able to rely on other means of communication to transact business, but they may suffer significant harm if certain intellectual property is stolen. For others still, the ability to guarantee the integrity and security of the data they store and process, such as customer information, is vital to their continued operation. The expense and resources required to protect a whole enterprise may force an organization to prioritize its efforts and may shape its incident response planning. Before formulating a cyber incident response plan, an organization should first determine which of their data, assets, and services warrants the most protection. Ensuring that protection of an organization’s “crown jewels” is appropriately prioritized is an important first step to preventing a cyber intrusion or attack from causing catastrophic harm. The Cybersecurity Framework produced by the National Institute of Standards and Technology (NIST) provides excellent 1guidance on risk management planning and policies and merits consideration.
B. Have an Actionable Plan in Place Before an Intrusion Occurs
Organizations should have a plan in place for handling computer intrusions before an intrusion occurs. During an intrusion, an organization’s management and personnel should be focused on containing the intrusion, mitigating the harm, and collecting and preserving vital information that will help them assess the nature and scope of the damage and the potential source of the threat. A cyber incident is not the time to be creating emergency procedures or considering for the first time how best to respond. The plan should be “actionable.” It should provide specific, concrete procedures to follow in the event of a cyber incident. At a minimum, the procedures should address:
Who has lead responsibility for different elements of an organization’s cyber incident response, from decisions about public communications, to information technology access, to implementation of security measures, to resolving legal questions;
How to contact critical personnel at any time, day or night;
How to proceed if critical personnel is unreachable and who will serve as back-up;
What mission critical data, networks, or services should be prioritized for the greatest protection;
How to preserve data related to the intrusion in a forensically sound manner;
What criteria will be used to ascertain whether data owners, customers, or partner companies should be notified if their data or data affecting their networks is stolen; and
Procedures for notifying law enforcement and/or computer incident-reporting organization.
All personnel who have computer security responsibilities should have access to and familiarity with the plan, particularly anyone who will play a role in making technical, operational, or managerial decisions during an incident. It is important for an organization to institute rules that will ensure its personnel have and maintain familiarity with its incident response plan. For instance, the procedures for responding to a cyber incident under an incident response plan can be integrated into regular personnel training. The plan may also be ingrained through regularly conducted exercises to ensure that it is up-to-date. Such exercises should be designed to verify that necessary lines of communication exist, that decision-making roles and responsibilities are well understood, and that any technology that may be needed during an actual incident is available and likely to be effective. Deficiencies and gaps identified during an exercise should be noted for speedy resolution.
Incident response plans may differ depending upon an organization’s size, structure, and nature of its business. Similarly, decision-making under a particular incident response plan may differ depending upon the nature of a cyber incident. In any event, institutionalized familiarity with the organization’s framework for addressing a cyber incident will expedite response time and save critical minutes during an incident.
…
II. Responding to a Computer Intrusion: Executing Your Incident Response Plan
An organization can fall victim to a cyber intrusion or attack even after taking reasonable precautions. Consequently, having a vetted, actionable cyber incident response plan is critical. A robust incident response plan does more than provide procedures for handling an incident; it also provides guidance on how a victim organization can continue to operate while managing an incident and how to work with law enforcement and/or incident response firms as an 4investigation is conducted. An organization’s incident response plan should, at a minimum, give serious consideration to all of the steps outlined below.
A. Step 1: Make an Initial Assessment
During a cyber incident, a victim organization should immediately make an assessment of the nature and scope of the incident. In particular, it is important at the outset to determine whether the incident is a malicious act or a technological glitch. The nature of the incident will determine the type of assistance an organization will need to address the incident and the type of damage and remedial efforts that may be required. Having appropriate network logging capabilities enabled can be critical to identifying the cause of a cyber incident. Using log information, a system administrator should attempt to identify:
The affected computer systems;
The apparent origin of the incident, intrusion, or attack;
Any malware used in connection with the incident;
Any remote servers to which data were sent (if information was exfiltrated); and
The identity of any other victim organizations, if such data is apparent in logged data.
In addition, the initial assessment of the incident should document:
Which users are currently logged on;
What the current connections to the computer systems are;
Which processes are running; and
All open ports and their associated services and applications.
Any communications (in particular, threats or extortionate demands) received by the organization that might relate to the incident should also be preserved. Suspicious calls, emails, or other requests for information should be treated as part of the incident.
Evidence that an intrusion or other criminal incident has occurred will typically include logging or file creation data indicating that someone improperly accessed, created, modified, deleted, or copied files or logs; changed system settings; or added or altered user accounts or permissions. In addition, an intruder may have stored “hacker tools” or data from another 5intrusion on your network. In the case of a root-level intrusion, victims should be alert for signs that the intruder gained access to multiple areas of the network. The victim organization should take care to ensure that its actions do not unintentionally or unnecessarily modify stored data in a way that could hinder incident response or subsequent criminal investigation. In particular, potentially relevant files should not be deleted; if at all possible, avoid modifying data or at least keep track of how and when information was modified.
Department Of Justice Chicago, Department Of Justice Head, Department Of Justice Jobs, Department Of Justice Definition, Department Of Justice Wisconsin, Department Of Justice Washington Dc, Department Of Justice Chicago Police Report, Department Of Justice Secretary, Department Of Justice Agencies, Department Of Justice Illinois, Department Of Justice Agencies, Department Of Justice Address, Department Of Justice Antitrust, Department Of Justice Attorney General, Department Of Justice Ada, Department Of Justice Appointments, Department Of Justice Attorney Jobs, Department Of Justice Accomplishments, Department Of Justice Atf, Department Of Justice Attorney, Department Of Justice Budget, Department Of Justice Building, Department Of Justice Background Check, Department Of Justice Branch, Department Of Justice Badge, Department Of Justice Bureau Of Justice Statistics, Department Of Justice Budget 2016, Department Of Justice Baltimore Report, Department Of Justice Baton Rouge, Department Of Justice Budget 2018, Department Of Justice Chicago, Department Of Justice Chicago Police Report, Department Of Justice Civil Rights Division, Department Of Justice Careers, Department Of Justice California, Department Of Justice Case Search, Department Of Justice Contact, Department Of Justice Crime Statistics, Department Of Justice Civil Division, Department Of Justice Certificate Of Confidentiality, Department Of Justice Definition, Department Of Justice Dc, Department Of Justice Dea, Department Of Justice Deputy Attorney General, Department Of Justice Duties, Department Of Justice Domestic Violence, Department Of Justice Director, Department Of Justice Drug Enforcement Administration, Department Of Justice Description, Department Of Justice Divisions, Department Of Justice Email, Department Of Justice Executive Branch, Department Of Justice Employment, Department Of Justice Employees, Department Of Justice Environment And Natural Resources Division, Department Of Justice Executive Office Of Immigration Review, Department Of Justice Established, Department Of Justice Eclinicalworks, Department Of Justice Education, Department Of Justice Elder Justice Initiative, Department Of Justice Fbi, Department Of Justice Function, Department Of Justice Foia, Department Of Justice Ferguson Report, Department Of Justice Federal Bureau Of Investigation, Department Of Justice Forms, Department Of Justice Funding, Department Of Justice Florida, Department Of Justice Fraud Section, Department Of Justice Federal Bureau Of Prisons, Department Of Justice Gta V, Department Of Justice Grants, Department Of Justice Gift Shop, Department Of Justice Georgia, Department Of Justice Grants 2017, Department Of Justice Guide To The Freedom Of Information Act, Department Of Justice Grants Management System, Department Of Justice Gun Control, Department Of Justice Glassdoor, Department Of Justice Gaming, Department Of Justice Head, Department Of Justice Hierarchy, Department Of Justice Honors Program, Department Of Justice Hiring Freeze, Department Of Justice Health Care Fraud, Department Of Justice Human Trafficking, Department Of Justice History, Department Of Justice Headquarters, Department Of Justice Human Resources, Department Of Justice Hours, Department Of Justice Illinois, Department Of Justice Internship, Department Of Justice Inspector General, Department Of Justice Indiana, Department Of Justice Issues, Department Of Justice Investigation, Department Of Justice Immigration, Department Of Justice Inmate Search, Department Of Justice Identity Theft, Department Of Justice Indictments, Department Of Justice Jobs, Department Of Justice Jobs Illinois, Department Of Justice Jeff Sessions, Department Of Justice Job Description, Department Of Justice Judicial Branch, Department Of Justice Juvenile, Department Of Justice Jurisdiction, Department Of Justice Jacksonville Fl, Department Of Justice Jobs Texas, Department Of Justice Jobs In Florida, Department Of Justice Kentucky, Department Of Justice Ky, Department Of Justice Kansas, Department Of Justice Kleptocracy Initiative, Department Of Justice Kansas City Mo, Department Of Justice Kidnapping Statistics, Department Of Justice Knoxville Tn, Department Of Justice Kimberley, Department Of Justice Kenya, Department Of Justice Kzn, Department Of Justice Logo, Department Of Justice Leader, Department Of Justice Legal, Department Of Justice Letter, Department Of Justice Lawyers, Department Of Justice Leadership, Department Of Justice Louisiana, Department Of Justice Location, Department Of Justice Los Angeles, Department Of Justice Live Scan, Department Of Justice Milwaukee, Department Of Justice Mission Statement, Department Of Justice Motto, Department Of Justice Memo, Department Of Justice Manual, Department Of Justice Members, Department Of Justice Mailing Address, Department Of Justice Media, Department Of Justice Media Contact, Department Of Justice Michigan, Department Of Justice Northern District Of Illinois, Department Of Justice News, Department Of Justice New York, Department Of Justice Number, Department Of Justice Number Of Employees, Department Of Justice National Security Division, Department Of Justice New Orleans, Department Of Justice North Carolina, Department Of Justice National Sex Offender Registry, Department Of Justice Ny, Department Of Justice Org Chart, Department Of Justice Oregon, Department Of Justice Oig, Department Of Justice Offices, Department Of Justice Office Of Justice Programs, Department Of Justice Office Of Civil Rights, Department Of Justice Office Of Legal Counsel, Department Of Justice Obama, Department Of Justice Office Of International Affairs, Department Of Justice Office Of Public Affairs, Department Of Justice Phone Number, Department Of Justice Press Release, Department Of Justice Purpose, Department Of Justice Policy On Executive Privilege, Department Of Justice Police, Department Of Justice Programs, Department Of Justice Puerto Rico, Department Of Justice Phone, Department Of Justice Phone Number Washington Dc, Department Of Justice Positions, Department Of Justice Quizlet, Department Of Justice Qualifications, Department Of Justice Quicken Loans, Department Of Justice Quotes, Department Of Justice Quit, Department Of Justice Quantico Va, Department Of Justice Qui Tam, Department Of Justice Qld, Department Of Justice Quezon City, Department Of Justice Qld Forms, Department Of Justice Report, Department Of Justice Responsibilities, Department Of Justice Report Chicago, Department Of Justice Roleplay, Department Of Justice Role, Department Of Justice Rosenstein, Department Of Justice Report On Ferguson, Department Of Justice Ranks, Department Of Justice Regulations, Department Of Justice Records, Department Of Justice Secretary, Department Of Justice Statistics, Department Of Justice Seal, Department Of Justice Sex Offender, Department Of Justice Springfield Il, Department Of Justice Structure, Department Of Justice Service Animals, Department Of Justice Salary, Department Of Justice Statement, Department Of Justice Sacramento, Department Of Justice Twitter, Department Of Justice Tax Division, Department Of Justice Trump, Department Of Justice Texas, Department Of Justice Training, Department Of Justice Travel Ban, Department Of Justice Telephone Number, Department Of Justice Title Ix, Department Of Justice Transgender, Department Of Justice Trump Investigation, Department Of Justice Usa, Department Of Justice Us Attorney, Department Of Justice Use Of Force Policy, Department Of Justice Us Marshals Service, Department Of Justice Undergraduate Internship, Department Of Justice Utah, Department Of Justice Under Trump, Department Of Justice Usa Patriot Act, Department Of Justice Use Of Force, Department Of Justice Uber, Department Of Justice Vs Fbi, Department Of Justice Virginia, Department Of Justice Volkswagen, Department Of Justice Voting Rights, Department Of Justice V Reporters Committee, Department Of Justice Virgin Islands, Department Of Justice Vns, Department Of Justice Veterans, Department Of Justice Vawa, Department Of Justice Victims Of Crime, Department Of Justice Wisconsin, Department Of Justice Washington Dc, Department Of Justice Wiki, Department Of Justice Which Branch Of Government, Department Of Justice What Does It Do, Department Of Justice Western Union, Department Of Justice Whistleblower, Department Of Justice Washington State, Department Of Justice Website Accessibility, Department Of Justice What Branch, Department Of Justice Virus Xp, Department Of Justice Region Xi, Department Of Justice Siriusxm, Department Of Justice Virus Windows Xp, Department Of Justice Virus Removal Xp, Mario Xuereb Department Of Justice, Sean Xie Department Of Justice, Xochitl Hinojosa Department Of Justice, Department Of Justice Youtube, Department Of Justice Yates, Department Of Justice Yates Memo, Department Of Justice Yukon, Department Of Justice Yellowknife, Department Of Justice Youth Justice, Department Of Justice Yarmouth Nova Scotia, Department Of Justice Year Created, Department Of Justice Youth Grants, Department Of Justice Your Computer Is Blocked, Department Of Justice Zip Code, Department Of Justice Za, Department Of Justice Zamboanga City, Department Of Justice Zimbabwe, Department Of Justice Z83 Form, Department Of Justice Zwelitsha, Department Of Justice Zimmerman, Department Of Justice Z83, Department Of Justice Zarrab, Department Of Justice Zofran, Cyber Security News, Cybersecurity Stocks, Cyber Security Jobs, Cybersecurity Definition, Cybersecurity Framework, Cybersecurity Executive Order, Cybersecurity Depaul, Cyber Security Chicago, Cyber Security Salary, Cybersecurity Certificate, Cybersecurity Act Of 2015, Cybersecurity Assessment Tool, Cyber Security Analyst, Cybersecurity Awareness Month, Cyber Security Attacks, Cybersecurity Associations, Cybersecurity Articles, Cybersecurity And Cyberwar, Cybersecurity Act, Cybersecurity Audit, Cybersecurity Basics, Cybersecurity Bootcamp, Cybersecurity Books, Cybersecurity Best Practices, Cyber Security Blogs, Cybersecurity Breach, Cyber Security Bls, Cybersecurity Breaches 2017, Cybersecurity Bachelor’s Degree, Cyber Security Business, Cyber Security Chicago, Cybersecurity Certificate, Cybersecurity Companies, Cybersecurity Careers, Cyber Security Certifications, Cybersecurity Compliance, Cybersecurity Conferences 2017, Cybersecurity Conferences, Cybersecurity Companies In Chicago, Cybersecurity Classes, Cybersecurity Definition, Cybersecurity Depaul, Cyber Security Degree, Cybersecurity Disclosure Act Of 2017, Cybersecurity Disclosure Act, Cybersecurity Demand, Cyber Security Defined, Cybersecurity Define, Cybersecurity Domains, Cyber Security Degree Online, Cybersecurity Executive Order, Cybersecurity Etf, Cybersecurity Education, Cyber Security Engineer, Cybersecurity Engineering, Cybersecurity Events, Cybersecurity Enhancement Act Of 2014, Cybersecurity Experts, Cybersecurity Ethics, Cybersecurity Executive Order Pdf, Cybersecurity Framework, Cybersecurity Firms, Cybersecurity For Medical Devices, Cybersecurity Fundamentals, Cyber Security For Dummies, Cybersecurity For Beginners, Cyber Security Facts, Cybersecurity For Beginners Pdf, Cybersecurity Forensic Analyst, Cybersecurity Fundamentals Certificate, Cybersecurity Graduate Programs, Cyber Security Games, Cybersecurity Governance, Cybersecurity Gif, Cybersecurity Growth, Cyber Security Grants, Cybersecurity Graduate Certificate, Cyber Security Glossary, Cybersecurity Guidelines, Cybersecurity Girl Scouts, Cybersecurity Healthcare, Cybersecurity High School, Cyber Security Hack, Cyber Security History, Cybersecurity Hygiene, Cyber Security Headlines, Cybersecurity Hashtags, Cybersecurity Healthcare Jobs, Cybersecurity Humor, Cyber Security Hardware, Cybersecurity Insurance, Cybersecurity International Symposium, Cybersecurity Internships, Cybersecurity Information Sharing Act, Cybersecurity Images, Cybersecurity In Healthcare, Cyber Security Infographics, Cybersecurity Information Sharing Act Of 2015, Cybersecurity Industry, Cybersecurity Issues, Cyber Security Jobs, Cyber Security Jobs Chicago, Cybersecurity Job Outlook, Cybersecurity Job Growth, Cybersecurity Job Salary, Cybersecurity Job Titles, Cybersecurity Jokes, Cybersecurity Journal, Cybersecurity Job Growth 2017, Cybersecurity Job Description, Cybersecurity Kill Chain, Cybersecurity Kpp, Cyber Security Keywords, Cyber Security Kpi, Cyber Security Knowledge Quiz, Cyber Security K-12, Cybersecurity Kill Switch, Cyber Security Kenya, Cyber Security Key, Cybersecurity Khan Academy, Cybersecurity Law, Cybersecurity Lawyer, Cybersecurity Legislation, Cybersecurity Legislation 2017, Cybersecurity Law Firms, Cyber Security Logo, Cybersecurity Law Degree, Cybersecurity Law China, Cybersecurity Legend, Cybersecurity Law China 2017, Cybersecurity Major, Cybersecurity Meme, Cybersecurity Masters, Cybersecurity Meaning, Cybersecurity Magazine, Cyber Security Month, Cybersecurity Masters Online, Cyber Security Market, Cybersecurity Metrics, Cybersecurity Management, Cyber Security News, Cybersecurity National Action Plan, Cybersecurity Newsletter, Cybersecurity Nist, Cybersecurity Nexus, Cybersecurity National Action Plan (Cnap), Cybersecurity National Security, Cyber Security Nsa, Cybersecurity New York Times, Cybersecurity Nova, Cybersecurity One Word Or Two, Cybersecurity Online Masters, Cyber Security Online Degree, Cybersecurity Operations Center, Cybersecurity Overview, Cyber Security Online, Cyber Security Operations, Cyber Security Online Course, Cyber Security Organizations, Cybersecurity Of Medical Devices, Cybersecurity Policy, Cybersecurity Programs, Cybersecurity Podcast, Cybersecurity Pay, Cybersecurity Pictures, Cybersecurity Publications, Cyber Security Phd, Cybersecurity Principles, Cybersecurity Plan, Cybersecurity Professionals, Cyber Security Questions, Cybersecurity Quotes, Cybersecurity Quiz, Cyber Security Questionnaire, Cyber Security Qualifications, Cyber Security Q&a, Cyber Security Questions To Ask, Cyber Security Quora, Cybersecurity Quiz Pdf, Cybersecurity Quantum Computing, Cybersecurity Risk Management, Cybersecurity Risk Assessment, Cybersecurity Regulations, Cybersecurity Risk, Cybersecurity Report, Cyber Security Reddit, Cybersecurity Research, Cybersecurity Risk Assessment Template, Cybersecurity Requirements For Financial Services Companies, Cyber Security Resume, Cybersecurity Stocks, Cyber Security Salary, Cybersecurity Scholarships, Cybersecurity Statistics, Cyber Security Sales, Cybersecurity Startups, Cybersecurity Shortage, Cyber Security Summit, Cybersecurity Skills, Cybersecurity Standards, Cyber Security Training, Cybersecurity Threats, Cybersecurity Terms, Cybersecurity Topics, Cyber Security Tips, Cybersecurity Trends, Cybersecurity Terminology, Cybersecurity Tools, Cybersecurity Technology, Cybersecurity Trump, Cybersecurity Universities, Cybersecurity Umuc, Cybersecurity Utica College, Cybersecurity University Of Maryland, Cyber Security University, Cyber Security Usa, Cyber Security Unit, Cybersecurity Usf, Cybersecurity Ufc, Cyber Security Updates, Cybersecurity Ventures, Cybersecurity Vs Cyber Security, Cyber Security Vs Information Security, Cybersecurity Ventures 500, Cybersecurity Vulnerabilities, Cyber Security Video, Cybersecurity Vocabulary, Cybersecurity Vs Computer Security, Cybersecurity Venture Capital, Cybersecurity Vulnerability Assessment, Cybersecurity Wiki, Cybersecurity Workforce, Cybersecurity Wright College, Cybersecurity Wallpaper, Cybersecurity Workforce Framework, Cybersecurity Workforce Shortage, Cybersecurity Webinar, Cybersecurity Words, Cyber Security Websites, Cybersecurity White House, Cybersecurity Xprize, Cyber Security Xls, Xkcd Cyber Security, Fidelis Cybersecurity Xps, Cybersecurity Framework Xls, Obama Xi Cyber Security, Tedx Cyber Security, President Xi Cyber Security, Cybersecurity Youtube, Cybersecurity Youtube Channels, Cybersecurity Year In Review, Cybersecurity- You’re Already Compromised, Cybersecurity Year In Review 2015, Cyber Security Yahoo, Cyber Security Video Youtube, Year Up Cybersecurity, Yokogawa Cyber Security, Youtube Cyber Security Training, Zurich Cyber Security, Cyber Security Zero Day, Cyber Security Za, Cyber Security Zertifikat, Zenos Cybersecurity, Zenedge Cybersecurity, Zdnet Cyber Security, Zeus Cyber Security, Zimbabwe Cybersecurity, Cyber Security New Zealand, Best Practices Inpatient Care, Best Practices Definition, Best Practices Synonym, Best Practices In Education, Best Practices In Literacy Instruction, Best Practices In Business, Best Practices In School Psychology, Best Practices Conference, Best Practices In Healthcare, Best Practices For Writing Test Items, Best Practices Analyzer, Best Practices Act, Best Practices Academy, Best Practices At Work, Best Practices At Tier 1, Best Practices Accounts Payable, Best Practices And Benchmarking, Best Practices Among All Competitors, Best Practices Anchor Activities, Best Practices Autism, Best Practices Book, Best Practices Business, Best Practices Benchmarking, Best Practices Blog, Best Practices Bank Physical Security, Best Practices Banner Ads, Best Practices Business Development, Best Practices Behavioral And Educational Strategies For Teachers, Best Practices Blog Writing, Best Practices Blended Learning, Best Practices Conference, Best Practices Cyber Security, Best Practices Customer Service, Best Practices Checklist, Best Practices Css, Best Practices Consulting, Best Practices Community Engagement, Best Practices Communication, Best Practices Cover Letter, Best Practices Certification, Best Practices Definition, Best Practices Document, Best Practices Document Template, Best Practices Document Format, Best Practices Diversity And Inclusion, Best Practices Data Management, Best Practices Data Visualization, Best Practices Defined, Best Practices Digital Marketing, Best Practices Distance Learning, Best Practices Examples, Best Practices Education, Best Practices Email Marketing, Best Practices Exchange, Best Practices Email Subject Lines, Best Practices Email Design, Best Practices Employee Engagement, Best Practices Early Childhood Education, Best Practices Email Signature, Best Practices Exchange 2017, Best Practices For Writing Test Items, Best Practices Forum, Best Practices For Social Media, Best Practices For Facebook Ads, Best Practices For Security, Best Practices For Instagram, Best Practices For Teaching, Best Practices For Subject Lines, Best Practices For Email Marketing, Best Practices For Webinar Presenters, Best Practices Guide, Best Practices Guide To Residential Construction Pdf, Best Practices Guide To Residential Construction, Best Practices Guide Template, Best Practices Git, Best Practices Group Policy, Best Practices Graphic, Best Practices Google, Best Practices Gifted Education, Best Practices Google Analytics, Best Practices Hospitalist, Best Practices Healthcare, Best Practices Human Resources, Best Practices Hr, Best Practices Hashtags, Best Practices Hiring, Best Practices Handling Fresh Produce In Schools, Best Practices Homelessness, Best Practices Html, Best Practices Hotel Laundry, Best Practices Inpatient Care, Best Practices In Education, Best Practices In Literacy Instruction, Best Practices In Teaching, Best Practices In Business, Best Practices In School Psychology, Best Practices In Healthcare, Best Practices Inpatient Care Physicians, Best Practices In Math, Best Practices Icon, Best Practices Javascript, Best Practices Java, Best Practices Job Descriptions, Best Practices Jira, Best Practices Journal, Best Practices Jquery, Best Practices Jenkins, Best Practices Juvenile Justice, Best Practices Java Exceptions, Best Practices Json Structure, Best Practices Knowledge Management, Best Practices Kindergarten, Best Practices Knowledge Base, Best Practices Kpi, Best Practices Knowledge Transfer, Best Practices Kubernetes, Best Practices Knowledge Sharing, Best Practices Kanban, Best Practices Kickstarter, Best Practices Keywords Seo, Best Practices Llc, Best Practices Linkedin, Best Practices Landing Pages, Best Practices Literacy, Best Practices Logo, Best Practices Linkedin Profile, Best Practices List, Best Practices Library, Best Practices Lessons Learned, Best Practices Linkedin Posts, Best Practices Meaning, Best Practices Manual, Best Practices Management, Best Practices Marketing, Best Practices Medicine, Best Practices Model, Best Practices Math, Best Practices Meme, Best Practices Mentoring, Best Practices Middle School Language Arts, Best Practices Nursing, Best Practices Naming Conventions, Best Practices Newsletter, Best Practices Network Segmentation, Best Practices Network Security, Best Practices Nonprofits, Best Practices Nonprofit Boards, Best Practices Nasp, Best Practices Nonprofit Board Governance, Best Practices Network Security Checklist, Best Practices Online Teaching, Best Practices Of Teaching, Best Practices Onboarding, Best Practices Of Project Management, Best Practices On Instagram, Best Practices On Interventions For Students With Reading Problems, Best Practices Online Learning, Best Practices On Collaboration And Communication, Best Practices Of High Performing Teams, Best Practices Outlook 2016, Best Practices Project Management, Best Practices Procurement Manual, Best Practices Presentation, Best Practices Powerpoint, Best Practices Python, Best Practices Podcasts, Best Practices Programming, Best Practices Performance Management, Best Practices Procurement, Best Practices Policy, Best Practices Quotes, Best Practices Quality Assurance, Best Practices Questions, Best Practices Quality Control, Best Practices Qualitative Interviews, Best Practices Qlikview, Best Practices Quotes Famous, Best Practices Query Optimization Sql Server, Best Practices Qlik Sense, Best Practices Query Optimization Oracle, Best Practices Research, Best Practices Resume, Best Practices Rest Api, Best Practices Report, Best Practices Reading, Best Practices Recruiting, Best Practices Responsive Design, Best Practices Ransomware, Best Practices Risk Management, Best Practices Resume Writing, Best Practices Synonym, Best Practices Staffing Bolingbrook Il, Best Practices Social Media, Best Practices Seo, Best Practices Software Development, Best Practices Salesforce, Best Practices Sales, Best Practices Sharing, Best Practices Security, Best Practices Strategies, Best Practices Template, Best Practices Teaching, Best Practices Training, Best Practices Twitter, Best Practices Thesaurus, Best Practices To Prepare Future Leaders, Best Practices To Avoid Malware, Best Practices To Prevent Ransomware, Best Practices To End Homelessness, Best Practices Toolkit, Best Practices Ux, Best Practices Ui Design, Best Practices Used In Social Media, Best Practices Used To Modify Abnormal Behavior, Best Practices Unit Testing, Best Practices Used In A Sentence, Best Practices Using Onenote, Best Practices Uat, Best Practices Unit Testing C#, Best Practices Ux Forms, Best Practices Volunteer Management, Best Practices Vocabulary Instruction, Best Practices Video Marketing, Best Practices Vendor Management, Best Practices Versus Best Fit, Best Practices Virtual Teams, Best Practices Vba, Best Practices Version Control, Best Practices Veeam, Best Practices Video Conferencing, Best Practices Web Design, Best Practices Workshop, Best Practices Wsus, Best Practices Web Design 2017, Best Practices Writing, Best Practices Webinar, Best Practices Wheaton Academy, Best Practices White Paper, Best Practices Website Design 2017, Best Practices Workforce Development, Best Practices Xenapp 7.6, Best Practices Xenapp 6.5, Best Practices Xendesktop 7.6, Best Practices Xml Schema Design, Best Practices Xml, Best Practices Xaml, Best Practices Xenapp 7.5, Best Practices Xendesktop, Best Practices Xamarin, Best Practices Xenapp 6.5 Vmware, Best Practices Yakima Wa, Best Practices Youtube, Best Practices Youtube Video, Best Practices Youth Engagement, Best Practices Yakima Patient Portal, Best Practices Yelp, Best Practices Yakima Washington, Best Practices Youth Development, Best Practices Youth Employment, Best Practices Zemelman, Best Practices Zendesk, Best Practices Zimbabwe, Best Practices Zoning San Switch, Best Practices Zabbix, Best Practices Zend Framework 2, Best Practices Zfs, Best Practices Zoning, Zen Cart Best Practices, 3par Best Practices Zoning,
Become a Patron! True Information is the most valuable resource and we ask you to give back.
FBI Cyber Division Private Industry Notification
PIN 150330-001
3 pages
TLP: GREEN
March 30, 2015
As of early March 2015, several extremist hacking groups indicated they would participate in a forthcoming operation, #OpIsrael, which will target Israeli and Jewish Web sites. The FBI assesses members of at least two extremist hacking groups are currently recruiting participants for the second anniversary of the operation, which started on 7 April 2013, and coincides with Holocaust Remembrance Day. These groups, typically located in the Middle East and North Africa, routinely conduct pro-extremist, anti-Israeli, and anti-Western cyber operations.
While the threat to US-based infrastructure is assessed as low for well-maintained and updated systems, the FBI is using the Private Industry Notification (PIN) as a method of notifying possible targeted entities.
FBI and private cybersecurity industry analysis of previous extremist hacker campaigns and operations indicate these groups are capable of low-level Distributed Denial of Service (DDoS)1 attacks and Web site defacements. The most likely targets for the campaign are Israel-based systems or the systems of worldwide Jewish-oriented organizations like synagogues or cultural centers. Based on historical targeting preferences, the attackers will likely focus primarily on Israeli financial institutions, but may also target Israeli media outlets.
Given the perceived connections between the Government of Israel and Israeli financial institutions, and those of the United States, #OpIsrael participants may also shift their operations to target vulnerable US-based financial targets or Jewish-oriented organizations within the United States. Based on historical attacks, the FBI assesses that attacks which may spawn from #OpIsrael to target US-based systems will likely constitute only a small percentage of overall activity.
The FBI assesses Web site defacements are the most likely method by which #OpIsrael participants will be successful against their targets. While most Web sites maintain up-to-date content management software, the ease with which attackers can exploit known or un-patched vulnerabilities makes this the more likely vector. Sites which maintain updated systems will not likely be impacted by defacement operations.
The FBI assesses most DDoS attempts made by #OpIsrael actors will have little to no effect on targeted Web sites, due to traditionally disorganized attacks, and existing DDoS mitigation measures in-place by potential victims. Historically, anti-Israel DDoS operations have failed to gain significant traction given competing priorities for the groups and individuals involved, and the limited number of participants who could organize to conduct successful DDoS campaigns.
Defense
In general, extremist hacktivism cyber attacks may result in denial of service, defacement of a Web site, and compromise of sensitive information, which may lead to harassment and identity theft. Precautionary measures to mitigate a range of potential extremist hacktivism cyber threats include:
– Implement a data back-up and recovery plan to maintain copies of sensitive or proprietary data in a separate and secure location. Backup copies of sensitive data should not be readily accessible from local networks.
– Scrutinize links contained in email attachments.
– Regularly mirror and maintain an image of critical system files.
– Encrypt and secure sensitive information.
– Use strong passwords, implement a schedule for changing passwords frequently, and avoid reusing passwords for multiple accounts.
– Enable network monitoring and logging where feasible.
– Be aware of social engineering tactics aimed at obtaining sensitive information.
– Securely eliminate sensitive files and data from hard drives when no longer needed or required.
– Establish a relationship with local law enforcement and participate in IT security information sharing groups for early warning of threats.
Fbi Most Wanted, Fbi Jobs, Fbi Director, Fbi Salary, Fbi Agent, Fbi Background Check, Fbi Agent Salary, Fbi Headquarters, Fbi Special Agent, Fbi Internships, Fbi Agent, Fbi Agent Salary, Fbi Academy, Fbi Application, Fbi Analyst, Fbi Atlanta, Fbi Agent Jobs, Fbi Anon, Fbi Address, Fbi Arrests, Fbi Background Check, Fbi Badge, Fbi Bau, Fbi Building, Fbi Boston, Fbi Bap, Fbi Baltimore, Fbi Benefits, Fbi Budget, Fbi Building Dc, Fbi Careers, Fbi Crime Statistics, Fbi Clearance, Fbi Criminal Background Check, Fbi Chicago, Fbi Citizens Academy, Fbi Crime Statistics By Race, Fbi Contact, Fbi Channeler, Fbi Candidates, Fbi Director, Fbi Director Candidates, Fbi Director James Comey, Fbi Definition, Fbi Director Fired, Fbi Director Salary, Fbi Definition Of Terrorism, Fbi Database, Fbi Dallas, Fbi Drug Policy, Fbi Employment, Fbi Email Address, Fbi Employment Drug Policy, Fbi El Paso, Fbi Employees, Fbi Emblem, Fbi Established, Fbi Education Center, Fbi Education, Fbi Executive Branch, Fbi Fingerprinting, Fbi Files, Fbi Field Offices, Fbi Fingerprint Card, Fbi Fitness Test, Fbi Facebook, Fbi Fingerprint Check, Fbi Forensic Accountant, Fbi Foia, Fbi Founder, Fbi Glock, Fbi Games, Fbi Gov, Fbi Glassdoor, Fbi Guns, Fbi Gang List, Fbi Gun Statistics, Fbi Gif, Fbi Gift Shop, Fbi General Counsel, Fbi Headquarters, Fbi Hrt, Fbi History, Fbi Houston, Fbi Hiring, Fbi Hate Crime Statistics, Fbi Head, Fbi Hat, Fbi Honors Internship, Fbi Hotline, Fbi Internships, Fbi Investigation, Fbi Intelligence Analyst, Fbi Informant, Fbi Irt, Fbi Investigation Trump, Fbi Ic3, Fbi Infragard, Fbi Internet Fraud, Fbi Id, Fbi Jobs, Fbi Jacket, Fbi James Comey, Fbi Jurisdiction, Fbi Job Description, Fbi Jobs Apply, Fbi Jacksonville, Fbi Jade Helm, Fbi Jobs Chicago, Fbi Jackson Ms, Fbi Kansas City, Fbi Kids, Fbi Knoxville, Fbi Kidnapping, Fbi Komi, Fbi Kentucky, Fbi Killed Jfk, Fbi Kkk, Fbi Kodi, Fbi K9 Unit, Fbi Logo, Fbi Leeda, Fbi Los Angeles, Fbi Locations, Fbi Las Vegas, Fbi Leaks, Fbi Leader, Fbi Linguist, Fbi Louisville, Fbi Login, Fbi Most Wanted, Fbi Most Wanted List, Fbi Meaning, Fbi Meme, Fbi Movies, Fbi Museum, Fbi Motto, Fbi Miami, Fbi Mission Statement, Fbi Most Dangerous Cities, Fbi Number, Fbi News, Fbi National Academy, Fbi Nics, Fbi New York, Fbi New Orleans, Fbi Newark, Fbi New York Tv Show, Fbi Near Me, Fbi Nominee, Fbi Offices, Fbi Org Chart, Fbi Omaha, Fbi Operative, Fbi On Trump, Fbi Organizational Chart, Fbi Obama Meme, Fbi Obama, Fbi Oklahoma City, Fbi Office Near Me, Fbi Phone Number, Fbi Profiler, Fbi Pft, Fbi Police, Fbi Pay Scale, Fbi Phoenix, Fbi Pay, Fbi Philadelphia, Fbi Positions, Fbi Pittsburgh, Fbi Quantico, Fbi Qualifications, Fbi Q Target, Fbi Quotes, Fbi Quiz, Fbi Questions, Fbi Qr Code, Fbi Qas, Fbi Quantico Address, Fbi Quantico Tours, Fbi Requirements, Fbi Russia, Fbi Russia Investigation, Fbi Report, Fbi Ranks, Fbi Recruiting, Fbi Raid, Fbi Records, Fbi Rape Statistics, Fbi Russia Trump, Fbi Salary, Fbi Special Agent, Fbi Stands For, Fbi Swat, Fbi Special Agent Salary, Fbi Surveillance, Fbi Statistics, Fbi Sos, Fbi Surveillance Van, Fbi Seal, Fbi Training, Fbi Top Ten, Fbi Trump, Fbi Trump Russia, Fbi Tip Line, Fbi Tv Shows, Fbi Twitter, Fbi Tips, Fbi Teen Academy, Fbi Tours, Fbi Ucr, Fbi Ucr 2016, Fbi Units, Fbi Ucr 2015, Fbi Undercover, Fbi Unsolved Cases, Fbi Upin, Fbi Utah, Fbi Usa, Fbi Uniforms, Fbi Vs Cia, Fbi Vault, Fbi Virus, Fbi Vs Apple, Fbi Virtual Academy, Fbi Vehicles, Fbi Violent Crime Statistics, Fbi Virginia, Fbi Van, Fbi Van Wifi, Fbi Website, Fbi Warning, Fbi Wiki, Fbi Wanted List, Fbi Watch List, Fbi Windbreaker, Fbi Warning Screen, Fbi White Collar Crime, Fbi Warrant Search, Fbi Weapons, Fbi X Files, Fbi Xl2, Fbi Xl31, Fbi Xl4, Fbi Xl2 Programming, Fbi Xl-31 Troubleshooting, Fbi Xl 31 Installation Manual, Fbi X Files Real, Fbi Xl2t Installation Manual, Fbi Xl 1215, Fbi Yearly Salary, Fbi Youtube, Fbi Youth Academy, Fbi Youth Leadership Academy, Fbi Yellow Brick Road, Fbi Youth Programs, Fbi Yearly Budget, Fbi Youth Leadership Academy Portland, Fbi Youngstown Ohio, Fbi Yearly Income, Fbi Zodiac Killer, Fbi Zodiac, Fbi Zip Code, Fbi Zodiac Killer List, Fbi Zero Files, Fbi Zodiac List, Fbi Zodiac Signs Killer, Fbi Zhang Yingying, Fbi Zion, Fbi Zodiac Crimes, Cyber Security News, Cybersecurity Stocks, Cyber Security Jobs, Cybersecurity Definition, Cybersecurity Framework, Cybersecurity Executive Order, Cybersecurity Depaul, Cyber Security Chicago, Cyber Security Salary, Cybersecurity Certificate, Cybersecurity Act Of 2015, Cybersecurity Assessment Tool, Cyber Security Analyst, Cybersecurity Awareness Month, Cyber Security Attacks, Cybersecurity Associations, Cybersecurity Articles, Cybersecurity And Cyberwar, Cybersecurity Act, Cybersecurity Audit, Cybersecurity Basics, Cybersecurity Bootcamp, Cybersecurity Books, Cybersecurity Best Practices, Cyber Security Blogs, Cybersecurity Breach, Cyber Security Bls, Cybersecurity Breaches 2017, Cybersecurity Bachelor’s Degree, Cyber Security Business, Cyber Security Chicago, Cybersecurity Certificate, Cybersecurity Companies, Cybersecurity Careers, Cyber Security Certifications, Cybersecurity Compliance, Cybersecurity Conferences 2017, Cybersecurity Conferences, Cybersecurity Companies In Chicago, Cybersecurity Classes, Cybersecurity Definition, Cybersecurity Depaul, Cyber Security Degree, Cybersecurity Disclosure Act Of 2017, Cybersecurity Disclosure Act, Cybersecurity Demand, Cyber Security Defined, Cybersecurity Define, Cybersecurity Domains, Cyber Security Degree Online, Cybersecurity Executive Order, Cybersecurity Etf, Cybersecurity Education, Cyber Security Engineer, Cybersecurity Engineering, Cybersecurity Events, Cybersecurity Enhancement Act Of 2014, Cybersecurity Experts, Cybersecurity Ethics, Cybersecurity Executive Order Pdf, Cybersecurity Framework, Cybersecurity Firms, Cybersecurity For Medical Devices, Cybersecurity Fundamentals, Cyber Security For Dummies, Cybersecurity For Beginners, Cyber Security Facts, Cybersecurity For Beginners Pdf, Cybersecurity Forensic Analyst, Cybersecurity Fundamentals Certificate, Cybersecurity Graduate Programs, Cyber Security Games, Cybersecurity Governance, Cybersecurity Gif, Cybersecurity Growth, Cyber Security Grants, Cybersecurity Graduate Certificate, Cyber Security Glossary, Cybersecurity Guidelines, Cybersecurity Girl Scouts, Cybersecurity Healthcare, Cybersecurity High School, Cyber Security Hack, Cyber Security History, Cybersecurity Hygiene, Cyber Security Headlines, Cybersecurity Hashtags, Cybersecurity Healthcare Jobs, Cybersecurity Humor, Cyber Security Hardware, Cybersecurity Insurance, Cybersecurity International Symposium, Cybersecurity Internships, Cybersecurity Information Sharing Act, Cybersecurity Images, Cybersecurity In Healthcare, Cyber Security Infographics, Cybersecurity Information Sharing Act Of 2015, Cybersecurity Industry, Cybersecurity Issues, Cyber Security Jobs, Cyber Security Jobs Chicago, Cybersecurity Job Outlook, Cybersecurity Job Growth, Cybersecurity Job Salary, Cybersecurity Job Titles, Cybersecurity Jokes, Cybersecurity Journal, Cybersecurity Job Growth 2017, Cybersecurity Job Description, Cybersecurity Kill Chain, Cybersecurity Kpp, Cyber Security Keywords, Cyber Security Kpi, Cyber Security Knowledge Quiz, Cyber Security K-12, Cybersecurity Kill Switch, Cyber Security Kenya, Cyber Security Key, Cybersecurity Khan Academy, Cybersecurity Law, Cybersecurity Lawyer, Cybersecurity Legislation, Cybersecurity Legislation 2017, Cybersecurity Law Firms, Cyber Security Logo, Cybersecurity Law Degree, Cybersecurity Law China, Cybersecurity Legend, Cybersecurity Law China 2017, Cybersecurity Major, Cybersecurity Meme, Cybersecurity Masters, Cybersecurity Meaning, Cybersecurity Magazine, Cyber Security Month, Cybersecurity Masters Online, Cyber Security Market, Cybersecurity Metrics, Cybersecurity Management, Cyber Security News, Cybersecurity National Action Plan, Cybersecurity Newsletter, Cybersecurity Nist, Cybersecurity Nexus, Cybersecurity National Action Plan (Cnap), Cybersecurity National Security, Cyber Security Nsa, Cybersecurity New York Times, Cybersecurity Nova, Cybersecurity One Word Or Two, Cybersecurity Online Masters, Cyber Security Online Degree, Cybersecurity Operations Center, Cybersecurity Overview, Cyber Security Online, Cyber Security Operations, Cyber Security Online Course, Cyber Security Organizations, Cybersecurity Of Medical Devices, Cybersecurity Policy, Cybersecurity Programs, Cybersecurity Podcast, Cybersecurity Pay, Cybersecurity Pictures, Cybersecurity Publications, Cyber Security Phd, Cybersecurity Principles, Cybersecurity Plan, Cybersecurity Professionals, Cyber Security Questions, Cybersecurity Quotes, Cybersecurity Quiz, Cyber Security Questionnaire, Cyber Security Qualifications, Cyber Security Q&a, Cyber Security Questions To Ask, Cyber Security Quora, Cybersecurity Quiz Pdf, Cybersecurity Quantum Computing, Cybersecurity Risk Management, Cybersecurity Risk Assessment, Cybersecurity Regulations, Cybersecurity Risk, Cybersecurity Report, Cyber Security Reddit, Cybersecurity Research, Cybersecurity Risk Assessment Template, Cybersecurity Requirements For Financial Services Companies, Cyber Security Resume, Cybersecurity Stocks, Cyber Security Salary, Cybersecurity Scholarships, Cybersecurity Statistics, Cyber Security Sales, Cybersecurity Startups, Cybersecurity Shortage, Cyber Security Summit, Cybersecurity Skills, Cybersecurity Standards, Cyber Security Training, Cybersecurity Threats, Cybersecurity Terms, Cybersecurity Topics, Cyber Security Tips, Cybersecurity Trends, Cybersecurity Terminology, Cybersecurity Tools, Cybersecurity Technology, Cybersecurity Trump, Cybersecurity Universities, Cybersecurity Umuc, Cybersecurity Utica College, Cybersecurity University Of Maryland, Cyber Security University, Cyber Security Usa, Cyber Security Unit, Cybersecurity Usf, Cybersecurity Ufc, Cyber Security Updates, Cybersecurity Ventures, Cybersecurity Vs Cyber Security, Cyber Security Vs Information Security, Cybersecurity Ventures 500, Cybersecurity Vulnerabilities, Cyber Security Video, Cybersecurity Vocabulary, Cybersecurity Vs Computer Security, Cybersecurity Venture Capital, Cybersecurity Vulnerability Assessment, Cybersecurity Wiki, Cybersecurity Workforce, Cybersecurity Wright College, Cybersecurity Wallpaper, Cybersecurity Workforce Framework, Cybersecurity Workforce Shortage, Cybersecurity Webinar, Cybersecurity Words, Cyber Security Websites, Cybersecurity White House, Cybersecurity Xprize, Cyber Security Xls, Xkcd Cyber Security, Fidelis Cybersecurity Xps, Cybersecurity Framework Xls, Obama Xi Cyber Security, Tedx Cyber Security, President Xi Cyber Security, Cybersecurity Youtube, Cybersecurity Youtube Channels, Cybersecurity Year In Review, Cybersecurity- You’re Already Compromised, Cybersecurity Year In Review 2015, Cyber Security Yahoo, Cyber Security Video Youtube, Year Up Cybersecurity, Yokogawa Cyber Security, Youtube Cyber Security Training, Zurich Cyber Security, Cyber Security Zero Day, Cyber Security Za, Cyber Security Zertifikat, Zenos Cybersecurity, Zenedge Cybersecurity, Zdnet Cyber Security, Zeus Cyber Security, Zimbabwe Cybersecurity, Cyber Security New Zealand, Israel News, Israel Map, Israel Flag, Israel Keyes, Israel Houghton, Israel Kamakawiwo’ole, Israel Palestine, Israel Population, Israel Houghton Kids, Israel Capital, Israel And Palestine, Israel Airlines, Israel Abbreviation, Israel Airport, Israel Apartheid, Israeli Army, Israel Anti Boycott Act, Israel Allies, Israel And Syria, Israel And New Breed, Israel Bonds, Israel Broussard, Israel Birthright, Israel Bombs Syria, Israel Borders, Israel Bombing, Israel Boone, Israel Beaches, Israel Baseball Hat, Israeli Border Wall, Israel Capital, Israel Continent, Israel Country Code, Israel Consulate Chicago, Israeli Couscous, Israel Climate, Israel Cities, Israel Conflict, Israel Capital City, Israel Coins, Israel Del Toro, Israel Definition, Israel Defense Forces, Israel Duffus, Israel Demographics, Israel Desert, Israel Diamonds, Israel Discount Bank, Israel Desalination, Israel Declares Independence, Israel Englander, Israel Egypt War, Israel Exports, Israel Established, Israel Experts, Israel Egypt, Israeli Embassy, Israel Etf, Israel Enemies, Israel Education, Israel Flag, Israel Facts, Israel Founded, Israel Flag Emoji, Israeli Food, Israel Fun Facts, Israel Flights, Israel Finkelstein, Israel Free Spirit, Israel Flag Meaning, Israel Government, Israel Gdp, Israel Geography, Israel Gdp Per Capita, Israel God, Israel Gutierrez, Israel Gross, Israel Gonzalez, Israel Gun Laws, Israel Gaza, Israel Houghton, Israel Houghton Kids, Israel History, Israel Hands, Israel Hayom, Israel Houghton Songs, Israel Holidays, Israel Hodish, Israel Houghton You Are Good, Israel Houghton Wedding, Israel Iz Kamakawiwo\u02bbole, Israel Independence Day, Israel Independence, Israel Iron Dome, Israel In Hebrew, Israel Isis, Israel In The Bible, Israel Iran, Israel India, Israel Idonije, Israel Jerusalem, Israel Jewish, Israel Jordan, Israel Jewish Population, Israel Jimenez, Israel Jesus, Israel Jobs, Israel Jacob, Israel Jewelry, Israel Juarbe, Israel Keyes, Israel Kamakawiwo’ole, Israel Kamakawiwo’ole Wife, Israel Kamakawiwo’ole Songs, Israel Kamakawiwo’ole Somewhere Over The Rainbow, Israel Kristal, Israel Kali A K, Israel Kibbutz, Israel Kamakawiwo’ole Over The Rainbow, Israel Kamakawiwo’ole Net Worth, Israel Language, Israel Location, Israel Local Time, Israel Leader, Israel Liberzon, Israel Landscape, Israel Life Expectancy, Israel Literacy Rate, Israel Lebanon, Israel Lebanon War, Israel Map, Israel Meaning, Israel Museum, Israel Money, Israel Movie, Israel Music, Israel Middle East, Israel My Glory, Israel Meme, Israeli Military, Israel News, Israel Name Meaning, Israel National News, Israel National Anthem, Israel News Live, Israel Nash, Israel News Today, Israel Natural Resources, Israel Nukes, Israel Name, Israel On Map, Israel Of God, Israel Outdoors, Israel On World Map, Israel Official Language, Israel On The House, Israel Oil, Israel Or Palestine, Israel Outline, Israel Outlet, Israel Palestine, Israel Population, Israel Palestine Map, Israel Putnam, Israel Post, Israeli Prime Ministers, Israel Palestine Conflict Timeline, Israel Pictures, Israel Population 2017, Israel Pakistan, Israel Quotes, Israel Quizlet, Israel Qatar, Israel Quest, Israel Qatar Relations, Israel Quiz, Israel Questions, Israel Queen, Israel Quality Of Life, Israel Quest Reviews, Israel Religion, Israel Russia, Israel Regardie, Israel Real Estate, Israel Rodriguez, Israel Rose, Israel Radio, Israel Region, Israel Resources, Israel Railways, Israel Syria, Israel Settlements, Israel Size, Israel Somewhere Over The Rainbow, Israel Six Day War, Israel Square Miles, Israel Supports Isis, Israel Saudi Arabia, Israel Symbols, Israel Shamir, Israel Time, Israel Time Now, Israel Tours, Israel Travel, Israel Today, Israel Tourism, Israel Trump, Israel Trip, Israel Third Temple, Israel Timeline, Israel United In Christ, Israel Us Relations, Israel Update, Israel United In Christ Videos, Israel Un, Israel Unlimited, Israel Unemployment Rate, Israel Us Embassy, Israel Universal Health Care, Israel University, Israel Vs Palestine, Israel Vibration, Israel Video Network, Israel Vacation, Israel Visa, Israel Vs Iran, Israel Vaccinations, Israel Visa Requirements, Israel Vs Syria, Israel Vs Judah, Israel Wall, Israel World Baseball Classic, Israel Weather, Israel War, Israeli Women, Israel World Baseball Classic Roster, Israel Wikipedia, Israel World Map, Israel West Bank, Israel Western Wall, Israel X Factor, Israel Xp, Israeli X95, Israel X Factor 2016, Israel X, Israel X Factor 2017, Israeli X, Israel X Factor Judges, Israel Xbmc, Israel X Band Radar, Israel Youtube, Israel Year Of Independence, Israel Year, Israel Y Palestina, Israel Yad Vashem, Israel Yemen, Israel Young, Israel Y Moises, Israel Youtube Channel, Israel Yearly Weather, Israel Zangwill, Israel Zip Code, Israel Zamora, Israel Zin River, Israel Zionist, Israel Zolli, Israel Z, Israel Zangwill Melting Pot, Israeli Zoo, Israel Zip Code Lookup
New Jersey Regional Operations Intelligence Center (NJ ROIC) Intelligence & Analysis Threat Unit
2 pages
For Official Use Only
April 18, 2013
(U//FOUO) Websites and emails referencing the Boston Marathon bombing should be viewed with caution, as malicious actors are using the incident to disseminate malware and conduct fraud. While other agencies investigate the frauds, the NJ ROIC provides this information for situational awareness.
Tactics, Techniques & Procedures
(U//FOUO) Cyber security experts have identified multiple fake websites and charity efforts taking advantage of the Boston Marathon bombing. Based on previous incidents, more scams will follow.
Within the hours of the bombings, actors with unknown intentions registered more than 125 domain names using a combination of “Boston,” “Marathon,” “2013,” “bomb,” “explosions,” “attack,” “victims,” and “donate” and should be viewed with caution. More domains are likely to follow.
Malicious actors are using social networking sites to spread hoaxes, including information regarding the purported death of several child runners (children are not allowed to participate in the Boston Marathon), and injured runners purportedly running for a variety of charities and causes.
Phishing emails may provide links to malicious websites purporting to contain information, pictures, and video, or may contain attachments with embedded malware. Clicking on the links or opening the attachments can infect the victim’s computer to further malicious activity.
Multiple fake charities were created on social networking websites within minutes of the explosions, purporting to collect funds for victims. Traditionally, these websites are scams.
…
Recommendations
Internet users should conduct due diligence before clicking links, visiting sites, or making donations.
Be cautious of emails/websites that claim to provide information because they may contain viruses.
Do not open unsolicited emails, or click on the links/attachments contained in those messages.
Never reveal personal or financial information in email.
Do not go to unfamiliar websites to view the event or information regarding it.
Never send sensitive information over the Internet before checking a site’s security and confirming its legitimacy. Malicious websites often look identical to a legitimate site, but the URL may use a variation in spelling or a different domain (e.g., .com vs. .net).
Search email systems for the subject lines noted above and delete them from inboxes.
You must be logged in to post a comment.