Tag: Cybercrime Statistics

Enttarnt – Rainer von Holsts Cyberwaffe – Pierre Gersoene

Become a Patron!
True Information is the most valuable resource and we ask you to give back.

Image result for pierre gersöne

Pierre Gersöne

Rainer von Holst veröffentlicht anonyme Blogs im Internet.

Dafür bedient er sich des Ostberliners Pierre Gersöne, der bislang aus guten Grünen anonym blieb und es sicher gerne auch weiter wäre.

Für alle Fans von Rainer von Holst und seinem Webmaster.

u.a. gomopacrime, investigoo, etc. pp

Hier die Kontaktdetails:

Pierre Gersöne

Medienhaus Gersöne UG
Fanningerstraße 54
D-10365 Berlin-Lichtenberg

Telefon: +49 (0)30 531 674 60
Telefax: +49 (0)30 531 674 65

http://www.medienhaus-gersoene.de

Registergericht: Amtsgericht Berlin-Charlottenburg
Registernummer: HRB 160218 B
Umsatzsteuer-Identifikationsnummer gem. § 27a UStG: DE295777375

Rainer Von Holst Firmenwelten, Rainer Von Holst Gerlachreport, Rainer Von Holst Usa, Rainer Von Holst Gerlach, Rainer Von Holst Gomopa, Rainer Von Holst Iserlohn, Rainer Von Holst, Rainer Von Holst Bank, Rainer Von Holst Politico, Rainer Von Holst Augsburg, Rainer Von Holst Augsburg, Rainer Von Holst Bank, Rainer Von Holst Firmenwelten, Rainer Von Holst Gerlachreport, Rainer Von Holst Gerlach, Rainer Von Holst Gomopa, Rainer Von Holst Iserlohn, Rainer Von Holst Politico, Rainer Von Holst Princeton, Rainer Von Holst Usa, Rainer Von Holst Werther, Medienhaus Gersoene, Gersoene, Cyberwaffe Regin, Cyberwaffe Regin, Cyberwaffen Wiki, Cybercrime Definition, Cybercrime Statistics, Cybercrime Prevention, Cybercrime Articles, Cybercrime Jobs, Cybercrime Law, Cybercrime Statistics 2017, Cyber Crime Cases, Cyber Crime News, Cybercrime Topics, Cybercrime Articles, Cybercrime And Security, Cybercrime As A Service, Cybercrime And Digital Forensics An Introduction, Cybercrime And Digital Forensics, Cybercrime And Society, Cybercrime And Terrorism, Cybercrime Attacks, Cybercrime Act, Cybercrime Against Businesses, Cyber Crime Batman, Cyber Crime Book, Cybercrime Blog, Cybercrime Bill, Cybercrime Banks, Cybercrime Background, Cyber Crime By Country, Cybercrime Bangalore, Cybercrime Billion Dollar Industry, Cybercrime Background Information, Cyber Crime Cases, Cybercrime Certification, Cybercrime Convention, Cybercrime Careers, Cybercrime Cost, Cybercrime Cafe, Cybercrime Cost 2016, Cybercrime China, Cybercrime Conference, Cybercrime Conclusion, Cybercrime Definition, Cybercrime Definition Computer, Cybercrime Definition Fbi, Cyber Crime Data, Cybercrime Degrees, Cybercrime Definition Pdf, Cybercrime Database, Cyber Crime Detective, Cyber Crime Documentary, Cyber Crime Department, Cybercrime Example, Cyber Crime Essay, Cybercrime Effects, Cybercrime Events, Cybercrime Enforcement, Cybercrime Economy, Cyber Crime Ethics, Cybercrime Effects On Business, Cybercrime Ecosystem, Cybercrime Enforcement Training Assistance Act, Cybercrime Facts, Cybercrime Fbi, Cybercrime Forensics, Cybercrime Forum, Cybercrime Forensics Training Center, Cybercrime Federal Laws, Cyber Crime Fiction, Cybercrime Financial Services, Cybercrime Future Trends, Cybercrime Fiji, Cybercrime Gets Personal Money Magazine, Cybercrime Gets Personal, Cybercrime Growth, Cyber Crime Graph, Cybercrime Groups, Cybercrime Government, Cybercrime Global Statistics, Cyber Crime Gov, Cyber Crime Games, Cybercrime Gif, Cybercrime Hacking, Cyber Crime History, Cybercrime Help, Cybercrime Healthcare, Cybercrime Hyderabad, Cybercrime How To Report, Cyber Crime Hotline, Cybercrime Hacking News, Cyber Crime Head Office India, Cybercrime Hacking And Cracking, Cybercrime Identity Theft, Cybercrime In The Us, Cyber Crime Investigation, Cybercrime Images, Cyber Crime Insurance, Cybercrime Is Also Known As, Cybercrime Investigating High-technology Computer Crime, Cybercrime Infographic, Cybercrime Information, Cyber Crime In Russia, Cybercrime Jobs, Cybercrime Jurisdiction, Cybercrime Journal Articles, Cybercrime Job Description, Cybercrime Jobs Salary, Cybercrime Job Openings, Cybercrime Jobs In Chennai, Cybercrime Job Qualification, Cybercrime Journal Articles Pdf, Cyber Crime Jamaica, Cybercrime Kenya, Cybercrime Key Issues And Debates, Cybercrime Kuwait, Cybercrime Ki Dhara, Cybercrime Key Issues And Debates Pdf, Cybercrime Kasus, Cyber Crime Karnataka, Cybercrime Kartu Kredit, Cybercrime Kolkata, Cyber Crime Karachi, Cybercrime Law, Cybercrime Laws In Usa, Cybercrime Law Enforcement, Cybercrime Laws Of The United States, Cybercrime List, Cybercrime Legislation Us, Cybercrime Laws In Florida, Cybercrime Legal Issues, Cybercrime Law Outline, Cyber Crime Lesson Plans, Cybercrime Meaning, Cyber Crime Movies, Cybercrime Methods, Cybercrime Methodology, Cyber Crime Money, Cybercrime Markets, Cyber Crime Magazine, Cyber Crime Most Wanted, Cybercrime Meaning In Tamil, Cybercrime Masters Degree, Cyber Crime News, Cyber Crime News Articles, Cyber Crime News Articles 2017, Cyber Crime Netflix, Cybercrime Nigeria, Cyber Crime Novels, Cybercrime Number, Cybercrime Nhs, Cyber Crime News Philippines, Cybercrime Nbi, Cybercrime Or Cyber Crime, Cybercrime Organizations, Cybercrime On The Rise, Cybercrime On The High Seas, Cybercrime Offenses, Cyber Crime Outline, Cybercrime Office, Cybercrime Office In Ahmedabad, Cybercrime Office In Patna, Cybercrime Office In Nashik, Cybercrime Quotes, Cyber Crime Quizlet, Cybercrime Questions, Cyber Crime Quiz, Cybercrime Questionnaire, Cybercrime Question Paper, Cybercrime Qatar, Cybercrime Question And Answers, Cybercrime Report, Cybercrime Research Paper, Cyber Crime Rates, Cyber Crime Recent, Cybercrime Research Topics, Cybercrime Research, Cybercrime Reported To The Ic3, Cybercrime Resources, Cybercrime Riding Tax Season Tides, Cyber Crime Report 2016, Cybercrime Statistics, Cybercrime Statistics 2017, Cyber Crime Stories, Cybercrime Spyware, Cybercrime Statistics 2015, Cybercrime Security, Cybercrime Solutions, Cybercrime Salary, Cybercrime Small Business, Cyber Crime Synonym, Cybercrime Topics, Cybercrime Trends, Cybercrime Tracker, Cybercrime Treaty, Cyber Crime Types, Cybercrime Training, Cybercrime Threats, Cybercrime Tools, Cybercrime Terms, Cybercrime The Transformation Of Crime In The Information Age, Cyber Crime Unit, Cybercrime Us, Cybercrime Uk, Cybercrime Uae, Cybercrime University, Cybercrime Un, Cyber Crime Unit Mauritius, Cyber Crime Unit Malta, Cybercrime Uc, Cybercrime Unodc, Cybercrime Victims, Cybercrime Vs Traditional Crime, Cybercrime Videos, Cybercrime Vs Traditional Crime Statistics, Cybercrime Virus, Cyber Crime Vocabulary, Cybercrime Vs Traditional Crime Punishment, Cybercrime Vs Computer Crime, Cybercrime Vs Cyber Warfare, Cybercrime Vs Cyber Espionage, Cybercrime Wiki, Cybercrime Worm, Cybercrime World Wide War 3.0, Cyber Crime Websites, Cyber Crime Worksheet, Cybercrime Wallpaper, Cyber Crime Worldwide, Cybercrime Working Group, Cyber Crime What Is It, Cybercrime Wikipedia Indonesia, Cybercrime X-remote Download, Tedx Cybercrime, Cyber Crime Youtube, Cyber Crime Yahoo, Cyber Crime Yahoo Answers, Cyber Crime Yesterday, Cyber Crime Youth, Cybercrime Yang Menyerang Hak Cipta, Cybercrime Yar, Youth Cyber Crime, Cyber Crime Yogyakarta, Cybercrime Yang Menyerang Pemerintah, Cybercrime Zimbabwe, Cybercrime Zeus, Cybercrime Zimbra, Zurich Cyber Crime, Zimbabwe Cybercrime Bill, Cyber Crime In Zambia, New Zealand Cyber Crime, Los Zetas Cybercrime, Cybercrime Law In Zambia, Cyber Crime Cases In Zambia

“Persistent” Cyber Targeting of Police, Emergency Services

Become a Patron!
True Information is the most valuable resource and we ask you to give back.

A clip from a local television station in Montana shows an emergency alert that was generated by “unknown attackers” in February 2013. The attackers used default credentials to broadcast false emergency messages stating that the “bodies of the dead are rising from their graves and attacking the living.” Similar messages aired in several other states where similar systems were compromised by the attackers.

Cyber attacks against law enforcement, fire departments and other emergency services have become increasingly common and are likely to increase according to a recent intelligence assessment prepared by the Department of Homeland Security and the Multi-State Information Sharing and Analysis Center (MS-ISAC).  The assessment, which was distributed to law enforcement in September 2015 and was obtained by Public Intelligence, reviewed a number of “cyber attacks against the [emergency services sector or ESS] between February 2012 and May 2015,” finding that “targeting of the ESS will likely increase as ESS systems and networks become more interconnected and the ESS becomes more dependent on information technology for the conduct of daily operations—creating a wider array of attack vectors for cyber targeting.”  Recent incidents involving the use of telephony-denial-of-service (TDoS) attacks, ransomware as well as the exploitation of “critical hardware and software” including call-center communications-management software, closed-circuit TV camera systems, interactive voice response systems, and emergency alert systems are detailed in the assessment.

DHS and MS-ISAC assess that the “most prominent cyber actors targeting the ESS” are “criminal hackers” who have engaged in “numerous attacks against state and local networks, particularly law enforcement, in response to perceived social and legal injustices” and are “prone to announcing attacks to increase visibility and support for their cause.”  The assessment defines “criminal hackers” as “individuals or groups that commit a crime by illegally accessing or altering systems, often in furtherance of an ideological goal.”  The use of the term “criminal hackers” marks a departure from previous law enforcement bulletins which have used the terms “hacktivists” or “hacker groups” to describe ideologically-motivated cyber actors.  The term is also used in an FBI bulletin released in May 2015 titled “Criminal Hackers Target Police to Protest Perceived Injustices.”  The assessment distinguishes between these criminal hackers and “cybercriminals” who “carry out illegal activities on computer networks, such as carding schemes, ransom and extortion, theft of personally identifiable information, and account information to facilitate fraud.”

Criminal hackers “gain support for their political agenda—or to exact retribution for perceived social or legal injustices—have shown repeated interest in targeting the ESS” as is “evidenced by the numerous attacks against state and local networks, particularly law enforcement, in response to perceived social and legal injustices.”  However, DHS and MS-ISAC assess that their capabilities are not particularly sophisticated, limiting them to “low-level cyber operations, such as [denial of service or DoS] attacks, website defacements, and doxing (publishing of personally identifiable information), often attacking targets of opportunity.”  These low-level operations have proliferated in recent years, particularly in response to increased political controversy surrounding police brutality and excessive use of force.  The assessment also discusses several examples of these operations, often involving DoS attacks or doxing, including a series of DoS attacks conducted by the hacker collective Anonymous against the City of Madison, Wisconsin in 2014 to protest an officer-involved shooting.  The attack reportedly “affected some police, fire, and medical dispatch services; as well as city government Internet and e-mail communications, and online payment services.”

Though so-called “criminal hackers” are the most prominent cyber actors in DHS and MS-ISAC’s assessment, cybercriminals working for financial gain pose a “persistent threat” and have launched attacks significantly impacting ESS operations.

  • In May 2015, a Nevada county sheriff’s department and a Wisconsin police department were victims of a ransomware attack that encrypted both departments’ shared folders.  MS-ISAC later determined that the intrusions occurred as a result of visits to a legitimate website which had been compromised.
  • A city in Southern California and several local public-safety agencies were hit by ransomware in June 2014.  The compromise affected 100 computers and 10 servers.
  • A fire department in Northern California and a law enforcement agency in Southern California were infected by ransomware resulting in the compromise of one computer and one server in each location, making vital information unavailable.
  • In 2013, telephony denial of service (TDoS) attacks affected approximately 600 critical government phone systems nationwide, including 200 public-safety answering points (PSAPs).  After several days, the attackers reportedly requested $5,000 to cease the attacks.

 

 

 

Cybercrime Definition, Cybercrime Statistics, Cybercrime Prevention, Cybercrime Articles, Cybercrime Jobs, Cybercrime Law, Cybercrime Statistics 2017, Cyber Crime Cases, Cyber Crime News, Cybercrime Topics, Cybercrime Articles, Cybercrime And Security, Cybercrime As A Service, Cybercrime And Digital Forensics An Introduction, Cybercrime And Digital Forensics, Cybercrime And Society, Cybercrime And Terrorism, Cybercrime Attacks, Cybercrime Act, Cybercrime Against Businesses, Cyber Crime Batman, Cyber Crime Book, Cybercrime Blog, Cybercrime Bill, Cybercrime Banks, Cybercrime Background, Cyber Crime By Country, Cybercrime Bangalore, Cybercrime Billion Dollar Industry, Cybercrime Background Information, Cyber Crime Cases, Cybercrime Certification, Cybercrime Convention, Cybercrime Careers, Cybercrime Cost, Cybercrime Cafe, Cybercrime Cost 2016, Cybercrime China, Cybercrime Conference, Cybercrime Conclusion, Cybercrime Definition, Cybercrime Definition Computer, Cybercrime Definition Fbi, Cyber Crime Data, Cybercrime Degrees, Cybercrime Definition Pdf, Cybercrime Database, Cyber Crime Detective, Cyber Crime Documentary, Cyber Crime Department, Cybercrime Example, Cyber Crime Essay, Cybercrime Effects, Cybercrime Events, Cybercrime Enforcement, Cybercrime Economy, Cyber Crime Ethics, Cybercrime Effects On Business, Cybercrime Ecosystem, Cybercrime Enforcement Training Assistance Act, Cybercrime Facts, Cybercrime Fbi, Cybercrime Forensics, Cybercrime Forum, Cybercrime Forensics Training Center, Cybercrime Federal Laws, Cyber Crime Fiction, Cybercrime Financial Services, Cybercrime Future Trends, Cybercrime Fiji, Cybercrime Gets Personal Money Magazine, Cybercrime Gets Personal, Cybercrime Growth, Cyber Crime Graph, Cybercrime Groups, Cybercrime Government, Cybercrime Global Statistics, Cyber Crime Gov, Cyber Crime Games, Cybercrime Gif, Cybercrime Hacking, Cyber Crime History, Cybercrime Help, Cybercrime Healthcare, Cybercrime Hyderabad, Cybercrime How To Report, Cyber Crime Hotline, Cybercrime Hacking News, Cyber Crime Head Office India, Cybercrime Hacking And Cracking, Cybercrime Identity Theft, Cybercrime In The Us, Cyber Crime Investigation, Cybercrime Images, Cyber Crime Insurance, Cybercrime Is Also Known As, Cybercrime Investigating High-technology Computer Crime, Cybercrime Infographic, Cybercrime Information, Cyber Crime In Russia, Cybercrime Jobs, Cybercrime Jurisdiction, Cybercrime Journal Articles, Cybercrime Job Description, Cybercrime Jobs Salary, Cybercrime Job Openings, Cybercrime Jobs In Chennai, Cybercrime Job Qualification, Cybercrime Journal Articles Pdf, Cyber Crime Jamaica, Cybercrime Kenya, Cybercrime Key Issues And Debates, Cybercrime Kuwait, Cybercrime Ki Dhara, Cybercrime Key Issues And Debates Pdf, Cybercrime Kasus, Cyber Crime Karnataka, Cybercrime Kartu Kredit, Cybercrime Kolkata, Cyber Crime Karachi, Cybercrime Law, Cybercrime Laws In Usa, Cybercrime Law Enforcement, Cybercrime Laws Of The United States, Cybercrime List, Cybercrime Legislation Us, Cybercrime Laws In Florida, Cybercrime Legal Issues, Cybercrime Law Outline, Cyber Crime Lesson Plans, Cybercrime Meaning, Cyber Crime Movies, Cybercrime Methods, Cybercrime Methodology, Cyber Crime Money, Cybercrime Markets, Cyber Crime Magazine, Cyber Crime Most Wanted, Cybercrime Meaning In Tamil, Cybercrime Masters Degree, Cyber Crime News, Cyber Crime News Articles, Cyber Crime News Articles 2017, Cyber Crime Netflix, Cybercrime Nigeria, Cyber Crime Novels, Cybercrime Number, Cybercrime Nhs, Cyber Crime News Philippines, Cybercrime Nbi, Cybercrime Or Cyber Crime, Cybercrime Organizations, Cybercrime On The Rise, Cybercrime On The High Seas, Cybercrime Offenses, Cyber Crime Outline, Cybercrime Office, Cybercrime Office In Ahmedabad, Cybercrime Office In Patna, Cybercrime Office In Nashik, Cybercrime Quotes, Cyber Crime Quizlet, Cybercrime Questions, Cyber Crime Quiz, Cybercrime Questionnaire, Cybercrime Question Paper, Cybercrime Qatar, Cybercrime Question And Answers, Cybercrime Report, Cybercrime Research Paper, Cyber Crime Rates, Cyber Crime Recent, Cybercrime Research Topics, Cybercrime Research, Cybercrime Reported To The Ic3, Cybercrime Resources, Cybercrime Riding Tax Season Tides, Cyber Crime Report 2016, Cybercrime Statistics, Cybercrime Statistics 2017, Cyber Crime Stories, Cybercrime Spyware, Cybercrime Statistics 2015, Cybercrime Security, Cybercrime Solutions, Cybercrime Salary, Cybercrime Small Business, Cyber Crime Synonym, Cybercrime Topics, Cybercrime Trends, Cybercrime Tracker, Cybercrime Treaty, Cyber Crime Types, Cybercrime Training, Cybercrime Threats, Cybercrime Tools, Cybercrime Terms, Cybercrime The Transformation Of Crime In The Information Age, Cyber Crime Unit, Cybercrime Us, Cybercrime Uk, Cybercrime Uae, Cybercrime University, Cybercrime Un, Cyber Crime Unit Mauritius, Cyber Crime Unit Malta, Cybercrime Uc, Cybercrime Unodc, Cybercrime Victims, Cybercrime Vs Traditional Crime, Cybercrime Videos, Cybercrime Vs Traditional Crime Statistics, Cybercrime Virus, Cyber Crime Vocabulary, Cybercrime Vs Traditional Crime Punishment, Cybercrime Vs Computer Crime, Cybercrime Vs Cyber Warfare, Cybercrime Vs Cyber Espionage, Cybercrime Wiki, Cybercrime Worm, Cybercrime World Wide War 3.0, Cyber Crime Websites, Cyber Crime Worksheet, Cybercrime Wallpaper, Cyber Crime Worldwide, Cybercrime Working Group, Cyber Crime What Is It, Cybercrime Wikipedia Indonesia, Cybercrime X-remote Download, Tedx Cybercrime, Cyber Crime Youtube, Cyber Crime Yahoo, Cyber Crime Yahoo Answers, Cyber Crime Yesterday, Cyber Crime Youth, Cybercrime Yang Menyerang Hak Cipta, Cybercrime Yar, Youth Cyber Crime, Cyber Crime Yogyakarta, Cybercrime Yang Menyerang Pemerintah, Cybercrime Zimbabwe, Cybercrime Zeus, Cybercrime Zimbra, Zurich Cyber Crime, Zimbabwe Cybercrime Bill, Cyber Crime In Zambia, New Zealand Cyber Crime, Los Zetas Cybercrime, Cybercrime Law In Zambia, Cyber Crime Cases In Zambia

Presidential Policy Directive PPD-41 on United States Cyber Incident Coordination

Become a Patron!
True Information is the most valuable resource and we ask you to give back.

FACT SHEET: Presidential Policy Directive on United States Cyber Incident Coordination

The new directive spells out how the Federal government will coordinate its incident response activities in the event of a large-scale cyber incidentToday, the President approved a Presidential Policy Directive (PPD) on United States Cyber Incident Coordination.  This new PPD marks a major milestone in codifying the policy that governs the Federal government’s response to significant cyber incidents.

Since the beginning of his Administration, President Obama has emphasized that malicious cyber activity poses a serious threat to the national and economic security of the United States.  As set forth in the Cybersecurity National Action Plan, over the last seven and a half years the Administration’s cyber policy has been based on three strategic pillars:  raising the level of cybersecurity in our public, private, and consumer sectors, in both the short and the long-term; taking steps to deter, disrupt, and interfere with malicious cyber activity aimed at the United States or its allies; and responding effectively to and recovering from cyber incidents.

 

Even as we have made progress on all three pillars, the United States has been faced with managing increasingly significant cyber incidents affecting both the private sector and Federal government.  We have applied the lessons learned from these events, as well as our experience in other areas such as counterterrorism and disaster response. That experience has allowed us to hone our approach but also demonstrated that significant cyber incidents demand a more coordinated, integrated, and structured response.  We have also heard from the private sector the need to provide clarity and guidance about the Federal government’s roles and responsibilities.   The PPD builds on these lessons and institutionalizes our cyber incident coordination efforts in numerous respects, including:

  • Establishing clear principles that will govern the Federal government’s activities in cyber incident response;
  • Differentiating between significant cyber incidents and steady-state incidents and applying the PPD’s guidance primarily to significant incidents;
  • Categorizing the government’s activities into specific lines of effort and designating a lead agency for each line of effort in the event of a significant cyber incident;
  • Creating mechanisms to coordinate the Federal government’s response to significant cyber incidents, including a Cyber Unified Coordination Group similar in concept to what is used for incidents with physical effects, and enhanced coordination procedures within individual agencies;
  • Applying these policies and procedures to incidents where a Federal department or agency is the victim; and,
  • Ensuring that our cyber response activities are consistent and integrated with broader national preparedness and incident response policies, such as those implemented through Presidential Policy Directive 8-National Preparedness, so that our response to a cyber incident can seamlessly integrate with actions taken to address physical consequences caused by malicious cyber activity.

 

We also are releasing today a cyber incident severity schema that establishes a common framework within the Federal government for evaluating and assessing the severity of cyber incidents and will help identify significant cyber incidents to which the PPD’s coordination procedures would apply.

 

Incident Response Principles

The PPD outlines five principles that will guide the Federal government during any cyber incident response:

  • Shared Responsibility – Individuals, the private sector, and government agencies have a shared vital interest and complementary roles and responsibilities in protecting the Nation from malicious cyber activity and managing cyber incidents and their consequences.
  • Risk-Based Response – The Federal government will determine its response actions and  resource needs based on an assessment of the risks posed to an entity, national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the American people.
  • Respecting Affected Entities – Federal government responders will safeguard details of the incident, as well as privacy and civil liberties, and sensitive private sector information.
  • Unity of Effort – Whichever Federal agency first becomes aware of a cyber incident will rapidly notify other relevant Federal agencies in order to facilitate a unified Federal response and ensure that the right combination of agencies responds to a particular incident.
  • Enabling Restoration and Recovery – Federal response activities will be conducted in a manner to facilitate restoration and recovery of an entity that has experienced a cyber incident, balancing investigative and national security requirements with the need to return to normal operations as quickly as possible.

 

Significant Cyber Incidents

While the Federal government will adhere to the five principles in responding to any cyber incident, the PPD’s policies and procedures are aimed at a particular class of cyber incident: significant cyber incidents.  A significant cyber incident is one that either singularly or as part of a group of related incidents is likely to result in demonstrable harm to the national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the American people.

When a cyber incident occurs, determining its potential severity is critical to ensuring the incident receives the appropriate level of attention.  No two incidents are the same and, particularly at the initial stages, important information, including the nature of the perpetrator, may be unknown.

Therefore, as part of the process of developing the incident response policy, the Administration also developed a common schema for describing the severity of cyber incidents, which can include credible reporting of a cyber threat, observed malicious cyber activity, or both.  The schema establishes a common framework for evaluating and assessing cyber incidents to ensure that all Federal departments and agencies have a common view of the severity of a given incident, the consequent urgency of response efforts, and the need for escalation to senior levels.

The schema describes a cyber incident’s severity from a national perspective, defining six levels, zero through five, in ascending order of severity.  Each level describes the incident’s potential to affect public health or safety, national security, economic security, foreign relations, civil liberties, or public confidence.  An incident that ranks at a level 3 or above on this schema is considered “significant” and will trigger application of the PPD’s coordination mechanisms.

 

Lines of Effort and Lead Agencies

To establish accountability and enhance clarity, the PPD organizes Federal response activities into three lines of effort and establishes a Federal lead agency for each:

  • Threat response activities include the law enforcement and national security investigation of a cyber incident, including collecting evidence, linking related incidents, gathering intelligence, identifying opportunities for threat pursuit and disruption, and providing attribution.   The Department of Justice, acting through the Federal Bureau of Investigation (FBI) and the National Cyber Investigative Joint Task Force (NCIJTF), will be the Federal lead agency for threat response activities.
  • Asset response activities include providing technical assets and assistance to mitigate vulnerabilities and reducing the impact of the incident, identifying and assessing the risk posed to other entities and mitigating those risks, and providing guidance on how to leverage Federal resources and capabilities.   The Department of Homeland Security (DHS), acting through the National Cybersecurity and Communications Integration Center (NCCIC), will be the Federal lead agency for asset response activities.  The PPD directs DHS to coordinate closely with the relevant Sector-Specific Agency, which will depend on what kind of organization is affected by the incident.
  • Intelligence Support and related activities include intelligence collection in support of investigative activities, and integrated analysis of threat trends and events to build situational awareness and to identify knowledge gaps, as well as the ability to degrade or mitigate adversary threat capabilities.  The Office of the Director of National Intelligence, through the Cyber Threat Intelligence Integration Center, will be the Federal lead agency for intelligence support and related activities.

In addition to these lines of effort, a victim will undertake a wide variety of response activities in order to maintain business or operational continuity in the event of a cyber incident.  We recognize that for the victim, these activities may well be the most important.  Such efforts can include communications with customers and the workforce; engagement with stakeholders, regulators, or oversight bodies; and recovery and reconstitution efforts.   When a Federal agency is a victim of a significant cyber incident, that agency will be the lead for this fourth line of effort.  In the case of a private victim, the Federal government typically will not play a role in this line of effort, but will remain cognizant of the victim’s response activities consistent with these principles and coordinate with the victim.

 

Coordination Architecture

In order to facilitate the more coordinated, integrated response demanded by significant cyber incidents, the PPD establishes a three-tiered coordination architecture for handling those incidents:

National Policy Level:  The PPD institutionalizes the National Security Council-chaired interagency Cyber Response Group (CRG).  The CRG will coordinate the development and implementation of United States Government policy and strategy with respect to significant cyber incidents affecting the United States or its interests abroad.

National Operational Level:  The PPD directs agencies to take two actions at the national operational level in the event of a significant cyber incident.

  • Activate enhanced internal coordination procedures.  The PPD instructs agencies that regularly participate in the Cyber Response Group to develop these procedures to ensure that they can surge effectively when confronted with an incident that exceeds their day-to-day operational capacity.
  • Create a Unified Coordination Group.  In the event of a significant cyber incident, the PPD provides that the lead agencies for each line of effort, along with relevant Sector-Specific Agencies (SSAs), state, local, tribal and territorial governments, international counterparts, and private sector entities, will form a Cyber Unified Coordination Group (UCG) to coordinate response activities.  The Cyber UCG shall coordinate the development, prioritization, and execution of cyber response efforts, facilitate rapid information sharing among UCG members, and coordinate communications with stakeholders, including the victim entity.

Field Level:  The PPD directs the lead agencies for each line of effort to coordinate their interaction with each other and with the affected entity.

 

Integration with Existing Response Policy

The PPD also integrates U.S. cyber incident coordination policy with key aspects of existing Federal preparedness policy to ensure that the Nation will be ready to manage incidents that include both cyber and physical effects, such as a significant power outage resulting from malicious cyber activity.  The PPD will be implemented by the Federal government consistent with existing preparedness and response efforts.

Implementation tasks

The PPD also directs several follow-on tasks in order to ensure its full implementation.  In particular, it requires that the Administration develop and finalize the National Cyber Incident Response Plan – in coordination with State, Local, Territorial, and Tribal governments, the private sector, and the public – to further detail how the government will manage cyber incidents affecting critical infrastructure.  It also directs DHS and DOJ to develop a concept of operations for how a Cyber UCG will operate and for the NSC to update the charter for the CRG.

https://www.whitehouse.gov/the-press-office/2016/07/26/presidential-policy-directive-united-states-cyber-incident

July 26, 2016

Presidential Policy Directive — United States Cyber Incident Coordination

July 26, 2016

PRESIDENTIAL POLICY DIRECTIVE/PPD-41

SUBJECT: United States Cyber Incident Coordination

The advent of networked technology has spurred innovation, cultivated knowledge, encouraged free expression, and increased the Nation’s economic prosperity. However, the same infrastructure that enables these benefits is vulnerable to malicious activity, malfunction, human error, and acts of nature, placing the Nation and its people at risk. Cyber incidents are a fact of contemporary life, and significant cyber incidents are occurring with increasing frequency, impacting public and private infrastructure located in the United States and abroad.

United States preparedness efforts have positioned the Nation to manage a broad range of threats and hazards effectively. Every day, Federal law enforcement and those agencies responsible for network defense in the United States manage, respond to, and investigate cyber incidents in order to ensure the security of our information and communications infrastructure. The private sector and government agencies have a shared vital interest in protecting the Nation from malicious cyber activity and managing cyber incidents and their consequences. The nature of cyberspace requires individuals, organizations, and the government to all play roles in incident response. Furthermore, effective incident response efforts will help support an open, interoperable, secure, and reliable information and communications infrastructure that promotes trade and commerce, strengthens international security, fosters free expression, and reinforces the privacy and security of our citizens.

While the vast majority of cyber incidents can be handled through existing policies, certain cyber incidents that have significant impacts on an entity, our national security, or the broader economy require a unique approach to response efforts. These significant cyber incidents demand unity of effort within the Federal Government and especially close coordination between the public and private sectors.

I. Scope

This Presidential Policy Directive (PPD) sets forth principles governing the Federal Government’s response to any cyber incident, whether involving government or private sector entities. For significant cyber incidents, this PPD also establishes lead Federal agencies and an architecture for coordinating the broader Federal Government response. This PPD also requires the Departments of Justice and Homeland Security to maintain updated contact information for public use to assist entities affected by cyber incidents in reporting those incidents to the proper authorities.

II. Definitions

  1. Cyber incident. An event occurring on or conducted through a computer network that actually or imminently jeopardizes the integrity, confidentiality, or availability of computers, information or communications systems or networks, physical or virtual infrastructure controlled by computers or information systems, or information resident thereon. For purposes of this directive, a cyber incident may include a vulnerability in an information system, system security procedures, internal controls, or implementation that could be exploited by a threat source.
  2. Significant cyber incident. A cyber incident that is (or group of related cyber incidents that together are) likely to result in demonstrable harm to the national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the American people.

III. Principles Guiding Incident Response

In carrying out incident response activities for any cyber incident, the Federal Government will be guided by the following principles:

  1. Shared Responsibility. Individuals, the private sector, and government agencies have a shared vital interest and complementary roles and responsibilities in protecting the Nation from malicious cyber activity and managing cyber incidents and their consequences.
  2. Risk-Based Response. The Federal Government will determine its response actions and the resources it brings to bear based on an assessment of the risks posed to an entity, our national security, foreign relations, the broader economy, public confidence, civil liberties, or the public health and safety of the American people.
  3. Respecting affected entities. To the extent permitted under law, Federal Government responders will safeguard details of the incident, as well as privacy and civil liberties, and sensitive private sector information, and generally will defer to affected entities in notifying other affected private sector entities and the public. In the event a significant Federal Government interest is served by issuing a public statement concerning an incident, Federal responders will coordinate their approach with the affected entities to the extent possible.
  4. Unity of Governmental Effort. Various government entities possess different roles, responsibilities, authorities, and capabilities that can all be brought to bear on cyber incidents. These efforts must be coordinated to achieve optimal results. Whichever Federal agency first becomes aware of a cyber incident will rapidly notify other relevant Federal agencies in order to facilitate a unified Federal response and ensure that the right combination of agencies responds to a particular incident. State, local, tribal, and territorial (SLTT) governments also have responsibilities, authorities, capabilities, and resources that can be used to respond to a cyber incident; therefore, the Federal Government must be prepared to partner with SLTT governments in its cyber incident response efforts. The transnational nature of the Internet and communications infrastructure requires the United States to coordinate with international partners, as appropriate, in managing cyber incidents.
  5. Enabling Restoration and Recovery. Federal response activities will be conducted in a manner to facilitate restoration and recovery of an entity that has experienced a cyber incident, balancing investigative and national security requirements, public health and safety, and the need to return to normal operations as quickly as possible.

IV. Concurrent Lines of Effort

In responding to any cyber incident, Federal agencies shall undertake three concurrent lines of effort: threat response; asset response; and intelligence support and related activities. In addition, when a Federal agency is an affected entity, it shall undertake a fourth concurrent line of effort to manage the effects of the cyber incident on its operations, customers, and workforce.

  1. Threat response activities include conducting appropriate law enforcement and national security investigative activity at the affected entity’s site; collecting evidence and gathering intelligence; providing attribution; linking related incidents; identifying additional affected entities; identifying threat pursuit and disruption opportunities; developing and executing courses of action to mitigate the immediate threat; and facilitating information sharing and operational coordination with asset response.
  2. Asset response activities include furnishing technical assistance to affected entities to protect their assets, mitigate vulnerabilities, and reduce impacts of cyber incidents; identifying other entities that may be at risk and assessing their risk to the same or similar vulnerabilities; assessing potential risks to the sector or region, including potential cascading effects, and developing courses of action to mitigate these risks; facilitating information sharing and operational coordination with threat response; and providing guidance on how best to utilize Federal resources and capabilities in a timely, effective manner to speed recovery.
  3. Threat and asset responders will share some responsibilities and activities, which may include communicating with affected entities to understand the nature of the cyber incident; providing guidance to affected entities on available Federal resources and capabilities; promptly disseminating through appropriate channels intelligence and information learned in the course of the response; and facilitating information sharing and operational coordination with other Federal Government entities.
  4. Intelligence support and related activities facilitate the building of situational threat awareness and sharing of related intelligence; the integrated analysis of threat trends and events; the identification of knowledge gaps; and the ability to degrade or mitigate adversary threat capabilities.
  5. An affected Federal agency shall engage in a variety of efforts to manage the impact of a cyber incident, which may include maintaining business or operational continuity; addressing adverse financial impacts; protection of privacy; managing liability risks; complying with legal and regulatory requirements (including disclosure and notification); engaging in communications with employees or other affected individuals; and dealing with external affairs (e.g., media and congressional inquiries). The affected Federal agency will have primary responsibility for this line of effort.
  6. When a cyber incident affects a private entity, the Federal Government typically will not play a role in this line of effort, but it will remain cognizant of the affected entity’s response activities, consistent with the principles above and in coordination with the affected entity. The relevant sector-specific agency (SSA) will generally coordinate the Federal Government’s efforts to understand the potential business or operational impact of a cyber incident on private sector critical infrastructure.

V. Architecture of Federal Government Response Coordination for Significant Cyber Incidents1

In order to respond effectively to significant cyber incidents, the Federal Government will coordinate its activities in three ways:

  1. National Policy Coordination2The Cyber Response Group (CRG), in support of the National Security Council (NSC) Deputies and Principals Committees, and accountable through the Assistant to the President for Homeland Security and Counterterrorism (APHSCT) to the NSC chaired by the President, shall coordinate the development and implementation of United States Government policy and strategy with respect to significant cyber incidents affecting the United States or its interests abroad.
  2. National Operational Coordination
    1. Agency Enhanced Coordination Procedures. Each Federal agency that regularly participates in the CRG, including SSAs, shall establish and follow enhanced coordination procedures as defined in the annex to this PPD in situations in which the demands of responding to a significant cyber incident exceed its standing capacity.
    2. Cyber Unified Coordination Group. A Cyber Unified Coordination Group (UCG) shall serve as the primary method for coordinating between and among Federal agencies in response to a significant cyber incident as well as for integrating private sector partners into incident response efforts, as appropriate. A Cyber UCG shall be formed at the direction of the NSC Principals Committee, Deputies Committee, or the CRG, or when two or more Federal agencies that generally participate in the CRG, including relevant SSAs, request its formation. A Cyber UCG shall also be formed when a significant cyber incident affects critical infrastructure owners and operators identified by the Secretary of Homeland Security as owning or operating critical infrastructure for which a cyber incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security.
    3. A Cyber UCG will normally consist of Federal lead agencies for threat response, asset response, and intelligence support, but will also include SSAs, if a cyber incident affects or is likely to affect sectors they represent. In addition, as required by the scope, nature, and facts of a particular significant cyber incident, a Cyber UCG may include participation from other Federal agencies, SLTT governments, nongovernmental organizations, international counterparts, or the private sector.
    4. Following the formation of a Cyber UCG, Federal agencies responding to the incident shall assign appropriate senior executives, staff, and resources to execute the agency’s responsibilities as part of a Cyber UCG. The Cyber UCG is intended to result in unity of effort and not to alter agency authorities or leadership, oversight, or command responsibilities. Unless mutually agreed upon between agency heads or their designees, and consistent with applicable legal authorities such as the Economy Act of 1932 (31 U.S.C. 1535), Federal departments and agencies will maintain operational control over their respective agency assets.
    5. Federal lead agencies. In order to ensure that the Cyber UCG achieves maximum effectiveness in coordinating responses to significant cyber incidents, the following agencies shall serve as Federal lead agencies for the specified line of effort:
      1. In view of the fact that significant cyber incidents will often involve at least the possibility of a nation-state actor or have some other national security nexus, the Department of Justice, acting through the Federal Bureau of Investigation and the National Cyber Investigative Joint Task Force, shall be the Federal lead agency for threat response activities.
      2. The Department of Homeland Security, acting through the National Cybersecurity and Communications Integration Center, shall be the Federal lead agency for asset response activities.
      3. The Office of the Director of National Intelligence, through the Cyber Threat Intelligence Integration Center, shall be the Federal lead agency for intelligence support and related activities.
    7. Drawing upon the resources and capabilities across the Federal Government, the Federal lead agencies are responsible for:
      1. Coordinating any multi-agency threat or asset response activities to provide unity of effort, to include coordinating with any agency providing support to the incident, to include SSAs in recognition of their unique expertise;
      2. Ensuring that their respective lines of effort are coordinated with other Cyber UCG participants and affected entities, as appropriate;
      3. Identifying and recommending to the CRG, if elevation is required, any additional Federal Government resources or actions necessary to appropriately respond to and recover from the incident; and
      4. Coordinating with affected entities on various aspects of threat, asset, and affected entity response activities through a Cyber UCG, as appropriate.
  3.  Field-Level CoordinationField-level representatives of the Federal asset or threat response lead agencies shall ensure that they effectively coordinate their activities within their respective lines of effort with each other and the affected entity. Such representatives may be co-located with the affected entity.

VI. Unified Public Communications

The Departments of Homeland Security and Justice shall maintain and update as necessary a fact sheet outlining how private individuals and organizations can contact relevant Federal agencies about a cyber incident.

VII. Relationship to Existing Policy

Nothing in this directive alters, supersedes, or limits the authorities of Federal agencies to carry out their functions and duties consistent with applicable legal authorities and other Presidential guidance and directives. This directive generally relies on and furthers the implementation of existing policies and explains how United States cyber incident response structures interact with those existing policies. In particular, this policy complements and builds upon PPD-8 on National Preparedness of March 30, 2011. By integrating cyber and traditional preparedness efforts, the Nation will be ready to manage incidents that include both cyber and physical effects.

BARACK OBAMA

1 Additional details regarding the Federal Government’s coordination architecture for significant cyber incidents are contained in an annex to this PPD.

2 This sub-section supersedes NSPD-54/HSPD-23, paragraph 13, concerning the National Cyber Response Coordination Group.

https://www.whitehouse.gov/the-press-office/2016/07/26/annex-presidential-policy-directive-united-states-cyber-incident

July 26, 2016

Annex for Presidential Policy Directive — United States Cyber Incident Coordination

SUBJECT:  Federal Government Coordination Architecture for Significant Cyber Incidents
I.   ScopeThis annex to PPD-41, United States Cyber Incident Coordination Policy, provides further details concerning the Federal Government coordination architecture for significant cyber incidents and prescribes certain implementation tasks.

II.  Coordination Architecture

A. National Policy Coordination

The Cyber Response Group (CRG) shall be chaired by the Special Assistant to the President and Cybersecurity Coordinator (Chair), or an equivalent successor, and shall convene on a regular basis and as needed at the request of the Assistant to the President for Homeland Security and Counterterrorism and Deputy National Security Advisor.  Federal departments and agencies, including relevant cyber centers, shall be invited to participate in the CRG, as appropriate, based on their respective roles, responsibilities, and expertise or in the circumstances of a given incident or grouping of incidents.  CRG participants shall generally include senior representatives from the Departments of State, the Treasury, Defense (DOD), Justice (DOJ), Commerce, Energy, Homeland Security (DHS) and its National Protection and Programs Directorate, and the United States Secret Service, the Joint Chiefs of Staff, Office of the Director of National Intelligence, the Federal Bureau of Investigation, the National Cyber Investigative Joint Task Force, the Central Intelligence Agency, and the National Security Agency.  The Federal Communications Commission shall be invited to participate should the Chair assess that its inclusion is warranted by the circumstances and to the extent the Commission determines such participation is consistent with its statutory authority and legal obligations.

The CRG shall:

  1. Coordinate the development and implementation of the Federal Government’s policies, strategies, and procedures for responding to significant cyber incidents;
  2. Receive regular updates from the Federal cybersecurity centers and agencies on significant cyber incidents and measures being taken to resolve or respond to those incidents;
  3. Resolve issues elevated to it by subordinate bodies as may be established, such as a Cyber Unified Coordination Group (UCG);
  4. Collaborate with the Counterterrorism Security Group and Domestic Resilience Group when a cross-disciplinary response to a significant cyber incident is required;
  5. Identify and consider options for responding to significant cyber incidents, and make recommendations to the Deputies Committee, where higher-level guidance is required, in accordance with PPD-1 on Organization of the National Security Council System of February 13, 2009, or any successor; and
  6. Consider the policy implications for public messaging in response to significant cyber incidents, and coordinate a communications strategy, as necessary, regarding a significant cyber incident.

B. National Operational Coordination

To promote unity of effort in response to a significant cyber incident, a Cyber UCG shall:

  1. Coordinate the cyber incident response in a manner consistent with the principles described in section III of this directive;
  2. Ensure all appropriate Federal agencies, including sector-specific agencies (SSAs), are incorporated into the incident response;
  3. Coordinate the development and execution of response and recovery tasks, priorities, and planning efforts, including international and cross-sector outreach, necessary to respond appropriately to the incident and to speed recovery;
  4. Facilitate the rapid and appropriate sharing of information and intelligence among Cyber UCG participants on the incident response and recovery activities;
  5. Coordinate consistent, accurate, and appropriate communications regarding the incident to affected parties and stakeholders, including the public as appropriate; and
  6. For incidents that include cyber and physical effects, form a combined UCG with the lead Federal agency or with any UCG established to manage the physical effects of the incident under the National Response Framework developed pursuant to PPD-8 on National Preparedness.

SSAs shall be members of the UCG for significant cyber incidents that affect or are likely to affect their respective sectors.  As set forth in Presidential Policy Directive 21, the SSAs for critical infrastructure sectors are as follows:  DHS (Chemical, Commercial Facilities, Communications, Critical Manufacturing, Dams, Emergency Services, Government Facilities, Information Technology, Nuclear Reactors, Materials, and Waste, and Transportation Systems); DOD (Defense Industrial Base); Department of Energy (Energy); Department of the Treasury (Financial Services); Department of Agriculture (Food and Agriculture); Department of Health and Human Services (Healthcare and Public Health, and Food and Agriculture); General Services Administration (Government Facilities); Department of Transportation (Transportation Systems); and the Environmental Protection Agency (Water and Wastewater Systems).

A Cyber UCG shall operate in a manner that is consistent with the need to protect intelligence and law enforcement sources, methods, operations, and investigations, the privacy of individuals, and sensitive private sector information.

A Cyber UCG shall dissolve when enhanced coordination procedures for threat and asset response are no longer required or the authorities, capabilities, or resources of more than one Federal agency are no longer required to manage the remaining facets of the Federal response to an incident.

III.  Federal Government Response to Incidents Affecting Federal Networks

Nothing in this directive alters an agency’s obligations to comply with the requirements of the Federal Information Security Modernization Act of 2014 (FISMA) or Office of Management and Budget (OMB) guidelines related to responding to an “incident,” “breach,” or “major incident” as defined in that statute and OMB guidance.  Federal agencies shall follow OMB guidance to determine whether an incident is considered a “major incident” pursuant to FISMA.  If the cyber incident meets the threshold for a “major incident,” it is also a “significant cyber incident” for purposes of this directive and shall be managed in accordance with this directive.

A. Civilian Federal Networks

The Director of OMB oversees Federal agency information security policies and practices.  The Secretary of Homeland Security, in consultation with the Director of OMB, administers the implementation of Federal agency information security policies and practices and operates the Federal information security incident center.  The National Institute of Standards and Technology (NIST) develops standards and guidelines for Federal information systems that are mandatory for Federal agencies to implement.

Federal agencies shall respond to significant cyber incidents in accordance with this directive and applicable policies and procedures, including the reporting of incidents to DHS as required by the U.S. Computer Emergency Readiness Team Federal incident notification guidelines.

Where the effects of a significant cyber incident are limited to the operational activities of an individual Federal agency, that affected agency shall maintain primary authority over the affected assets and be responsible for managing the restoration services and related networks, systems, and applications and making the decision to restart an affected system.  DHS and other Federal agencies shall provide support as appropriate.

Where a significant cyber incident has an impact on multiple Federal agencies or on the integrity, confidentiality, or availability of services to the public, the decision to restart an affected system rests with the owning Federal agency, but OMB and the Federal lead agencies for threat and asset response shall provide a consolidated, timely written recommendation, with appropriate caveats and conditions, to help inform that owning agency’s decision.

B. DOD Information Network

The Secretary of Defense shall be responsible for managing the threat and asset response to cyber incidents affecting the Department of Defense Information Network, including restoration activities, with support from other Federal agencies as appropriate.

C. Intelligence Community Networks

The Director of National Intelligence shall be responsible for managing the threat and asset response for the integrated defense of the Intelligence Community (IC) information environment through the Intelligence Community Security Coordination Center, in conjunction with IC mission partners and with support from other Federal agencies, as appropriate.

IV.  Implementation and Assessment

Federal agencies shall take the following actions to implement this directive:

A. Charter 

Within 90 days of the date of this directive, the National Security Council (NSC) staff shall update the CRG charter to account for and support the policy set forth herein, which shall be submitted to the President through the Assistant to the President for Homeland Security and Counterterrorism.

B. Enhanced Coordination Procedures

Each Federal agency that regularly participates in the CRG, including SSAs, shall ensure that it has the standing capacity to execute its role in cyber incident response.  To prepare for situations in which the demands of a significant cyber incident exceed its standing capacity, each such agency shall, within 90 days of the date of this directive, establish enhanced coordination procedures that, when activated, bring dedicated leadership, supporting personnel, facilities (physical and communications), and internal processes enabling it to manage a significant cyber incident under demands that would exceed its capacity to coordinate under normal operating conditions.

Within 90 days of the date of this directive, the SSAs shall develop or update sector-specific procedures, as needed and in consultation with the sector(s), for enhanced coordination to support response to a significant cyber incident, consistent with this directive.

Enhanced coordination procedures shall identify the appropriate pathways for communicating with other Federal agencies during a significant cyber incident, including the relevant agency points-of-contact, and for notifying the CRG that enhanced coordination procedures were activated or initiated; highlight internal communications and decisionmaking processes that are consistent with effective incident coordination; and outline processes for maintaining these procedures.

In addition, each Federal agency’s enhanced coordination procedures shall identify the agency’s processes and existing capabilities to coordinate cyber incident response activities in a manner consistent with this directive.  The procedures shall identify a trained senior executive to oversee that agency’s participation in a Cyber UCG.  SSAs shall have a trained senior executive for each of the sectors for which it is the designated SSA under Presidential Policy Directive 21.

Within 120 days of the date of this directive, the SSAs shall coordinate with critical infrastructure owners and operators to synchronize sector-specific planning consistent with this directive.

C. Training 

Within 150 days of the date of this directive, the Federal Emergency Management Agency shall make necessary updates to its existing Unified Coordination training to incorporate the tenets of this directive.

Within 150 days of the date of this directive, Federal agencies shall update cyber incident coordination training to incorporate the tenets of this directive.

Federal agencies shall identify and maintain a cadre of personnel qualified and trained in the National Incident Management System and Unified Coordination to manage and respond to a significant cyber incident.  These personnel will provide necessary expertise to support tasking and decisionmaking by a Cyber UCG.

D. Exercises 

Within 180 days of the date of this directive, Federal agencies shall incorporate the tenets of this policy in cyber incident response exercises.  This will include exercises conducted as part of the National Exercise Program.  Exercises shall be conducted at a frequency necessary to ensure Federal agencies are prepared to execute the plans and procedures called for under this directive.  When appropriate, exercises shall consider the effectiveness of the end-to-end information sharing process.

E. Cyber UCG Post-Incident Review 

Upon dissolution of each Cyber UCG, the Chair of the CRG shall direct a review of a Cyber UCG’s response to a significant cyber incident at issue and the preparation of a report based on that review to be provided to the CRG within 30 days.  Federal agencies shall modify any plans or procedures for which they are responsible under this directive as appropriate or necessary in light of that report.

F. National Cyber Incident Response Plan

Within 180 days of the date of this directive, DHS and DOJ, in coordination with the SSAs, shall submit a concept of operations for the Cyber UCG to the President, through the Assistant to the President for Homeland Security and Counterterrorism and the Director of OMB, that is consistent with the principles, policies, and coordination architecture set forth in this directive.  This concept of operations shall further develop how the Cyber UCG and field elements of the Federal coordination architecture will work in practice for significant cyber incidents, including mechanisms for coordinating with Federal agencies managing the physical effects of an incident that has both cyber and physical elements and for integration of private sector entities in response activities when appropriate.  The Secretary of Homeland Security shall, as appropriate, incorporate or reference this concept of operations in the Cyber Incident Annex required by section 205 of the Cybersecurity Act of 2015.

Within 180 days of the date of this directive, the Secretary of Homeland Security, in coordination with the Attorney General, the Secretary of Defense, and the SSAs, shall submit a national cyber incident response plan to address cybersecurity risks to critical infrastructure to the President, through the Assistant to the President for Homeland Security and Counterterrorism and the Director of OMB, that is consistent with the principles, policies, and coordination architecture set forth in this directive.  The Secretary of Homeland Security shall ensure that the plan satisfies section 7 of the National Cybersecurity Protection Act of 2014.  This plan shall be developed in consultation with SLTT governments, sector coordinating councils, information sharing and analysis organizations, owners and operators of critical infrastructure, and other appropriate entities and individuals.  The plan shall take into account how these stakeholders will coordinate with Federal agencies to mitigate, respond to, and recover from cyber incidents affecting critical infrastructure.

Presidential Directive 5, Presidential Directive 51, Presidential Directive 59, Presidential Directive 8, Presidential Directive 62, Presidential Directive 21, Presidential Directive Definition, Presidential Directive 58, Presidential Directive 40, Presidential Directive 25, Presidential Directive Active Shooter, Presidential Policy Directive Africa, Presidential Directive For Age Relaxation, Presidential Directive Mass Atrocities, Presidential Directive On Arctic Region Policy, Difference Between Presidential Directive And Executive Order, Is A Presidential Directive A Law, Presidential Study Directive 11 August 2010, Presidential Decision Directive 62 And 63, Afghanistan Presidential Directive 62, Presidential Directive Cyber Security, Presidential Directive Cyber Security Critical Infrastructure, Presidential Directive Cuba, Presidential Directive Critical Infrastructure, Presidential Directive Coal, Presidential Directive Christmas Eve, Presidential Directive Carrying The Force Of Law, Presidential Directive To Coal India, Presidential Directive 20 Cyber, Presidential Directive Data Center Consolidation, Presidential Directive Definition, Presidential Directive Data Center Consolidation, Presidential Directive Decision, Presidential Directive Decision 25, Presidential Directive Drones, Presidential Decision Directive 39, Presidential Decision Directive 63, Presidential Decision Directive 67, Presidential Decision Directive 62, Presidential Decision Directive 51, Presidential Directive Emergency Management, Presidential Directive Electronic Records, Presidential Directive Vs Executive Order, Presidential Directive Christmas Eve, Presidential Policy Directive Executive Order 13636, Presidential Directive For Records Management, Presidential Directive For Nims, Presidential Directive For Age Relaxation, Presidential Directive Fema, Presidential Flag Directive, Presidential Policy Directive For Sub-saharan Africa, Presidential Directive On Reservation For Obc In Pses, Presidential Directive Carrying The Force Of Law, Which Presidential Directive(s) Focused On Cyberspace Security, Presidential Policy Directive 21 Federal Register, Presidential Directive On Government Contracting, Presidential Directive Managing Government Records, Presidential Policy Directive Global Development, Presidential Policy Directive On Global Development (Ppd-6), Presidential Directive Hspd 12, Presidential Directive Hspd-5, Presidential Directive Hspd-7, Presidential Directive Homeland Security, Presidential Directive That Has The Force Of Law, National Security Presidential Directive Human Trafficking, Presidential Directive Nspd 51 Hspd 20, Presidential Directive Meaning In Hindi, Homeland Presidential Directive 8, Hs Presidential Directive 7, Presidential Directive Insider Threat, Presidential Directive Immigration, Presidential Directive India, Presidential Directive Ics, Presidential Directive Critical Infrastructure, Presidential Directive On Information Sharing, Presidential Policy Directive Immigration, Presidential Directive Meaning In Hindi, Presidential Directive To Coal India, Presidential Policy Directive 19 In October 2012, Presidential Directive List, Presidential Policy Directive List, Presidential Directive M-12-18, Presidential Directive Mass Atrocities, Presidential Directive Meaning In Hindi, Presidential Directive Emergency Management, Presidential Policy Directive 18 Maritime Security, Presidential Study Directive On Mass Atrocities, Presidential Directive Nims, Presidential Directive Nsc-63, Presidential Directive Not Requiring Congressional Approval, Presidential Directive Nspd 51 Hspd 20, Presidential Directive Number 54, Presidential Decision Directive Nsc-12, Presidential Decision Directive\/nsc-63, Presidential Directive Safeguarding National Security, Presidential Decision Directive Nstc-7, Presidential Policy Directive National Preparedness, Presidential Directive On Government Contracting, Presidential Directive On Cuba, Presidential Directive On Cyber Security, Presidential Directive On Managing Government Records, Presidential Directive On Information Sharing, Presidential Directive On Immigration, Presidential Directive Open Data, Presidential Directive On Reservation For Obc In Pses, Presidential Directive On Insider Threat, Presidential Directive On Climate Change, Presidential Directive Philippines, Presidential Directive Pdd-63, Presidential Directive Pdd 51, Presidential Directive Paperless, Presidential Directive Ppd-21, Presidential Directive Peacekeeping, Presidential Policy Directive 20, Presidential Policy Directive 8, Presidential Policy Directive, Presidential Policy Directive 28, Presidential Directive Records Management, Presidential Review Directive 5, Presidential Review Directive, Presidential Directive On Reservation For Obc In Pses, Presidential Directive Not Requiring Congressional Approval, Presidential Directive For Age Relaxation, Presidential Directive On Arctic Region Policy, Presidential Directive Safeguarding National Security, Presidential Study Directive 11, Presidential Study Directive, Presidential Study Directive-11 Or Psd-11, Presidential Study Directive 1, Presidential Study Directive 10, Presidential Study Directive 9, Presidential Study Directive-11 Pdf, Presidential Study Directive 11 August 2010, Presidential Study Directive 8, Presidential Directive Trump, Presidential Directive To Coal India, Presidential Directive Telework, Presidential Directive To Cil, Presidential Directive That Has The Force Of Law, A Presidential Directive To An Agency That Orders, Presidential Directive Insider Threat, Presidential Directive Carrying The Force Of Law, Presidential Directive 51 Text, Us Presidential Directive, Presidential Directive Vs Executive Order, Presidential Directive W199i, Presidential Directive Wmd, Presidential Decision Directive W199i, Presidential Policy Directive Wiki, Presidential Directive 59 Wiki, Presidential Policy Directive What Is, Which Presidential Directive(s) Focused On Cyberspace Security, Presidential Policy Directive 8 White House, Presidential Policy Directive 8 Wiki, Presidential Policy Directive 20 Washington Post, National Security Presidential Directive Zero Tolerance, Cybercrime Definition, Cybercrime Statistics, Cybercrime Prevention, Cybercrime Articles, Cybercrime Jobs, Cybercrime Law, Cybercrime Statistics 2017, Cyber Crime Cases, Cyber Crime News, Cybercrime Topics, Cybercrime Articles, Cybercrime And Security, Cybercrime As A Service, Cybercrime And Digital Forensics An Introduction, Cybercrime And Digital Forensics, Cybercrime And Society, Cybercrime And Terrorism, Cybercrime Attacks, Cybercrime Act, Cybercrime Against Businesses, Cyber Crime Batman, Cyber Crime Book, Cybercrime Blog, Cybercrime Bill, Cybercrime Banks, Cybercrime Background, Cyber Crime By Country, Cybercrime Bangalore, Cybercrime Billion Dollar Industry, Cybercrime Background Information, Cyber Crime Cases, Cybercrime Certification, Cybercrime Convention, Cybercrime Careers, Cybercrime Cost, Cybercrime Cafe, Cybercrime Cost 2016, Cybercrime China, Cybercrime Conference, Cybercrime Conclusion, Cybercrime Definition, Cybercrime Definition Computer, Cybercrime Definition Fbi, Cyber Crime Data, Cybercrime Degrees, Cybercrime Definition Pdf, Cybercrime Database, Cyber Crime Detective, Cyber Crime Documentary, Cyber Crime Department, Cybercrime Example, Cyber Crime Essay, Cybercrime Effects, Cybercrime Events, Cybercrime Enforcement, Cybercrime Economy, Cyber Crime Ethics, Cybercrime Effects On Business, Cybercrime Ecosystem, Cybercrime Enforcement Training Assistance Act, Cybercrime Facts, Cybercrime Fbi, Cybercrime Forensics, Cybercrime Forum, Cybercrime Forensics Training Center, Cybercrime Federal Laws, Cyber Crime Fiction, Cybercrime Financial Services, Cybercrime Future Trends, Cybercrime Fiji, Cybercrime Gets Personal Money Magazine, Cybercrime Gets Personal, Cybercrime Growth, Cyber Crime Graph, Cybercrime Groups, Cybercrime Government, Cybercrime Global Statistics, Cyber Crime Gov, Cyber Crime Games, Cybercrime Gif, Cybercrime Hacking, Cyber Crime History, Cybercrime Help, Cybercrime Healthcare, Cybercrime Hyderabad, Cybercrime How To Report, Cyber Crime Hotline, Cybercrime Hacking News, Cyber Crime Head Office India, Cybercrime Hacking And Cracking, Cybercrime Identity Theft, Cybercrime In The Us, Cyber Crime Investigation, Cybercrime Images, Cyber Crime Insurance, Cybercrime Is Also Known As, Cybercrime Investigating High-technology Computer Crime, Cybercrime Infographic, Cybercrime Information, Cyber Crime In Russia, Cybercrime Jobs, Cybercrime Jurisdiction, Cybercrime Journal Articles, Cybercrime Job Description, Cybercrime Jobs Salary, Cybercrime Job Openings, Cybercrime Jobs In Chennai, Cybercrime Job Qualification, Cybercrime Journal Articles Pdf, Cyber Crime Jamaica, Cybercrime Kenya, Cybercrime Key Issues And Debates, Cybercrime Kuwait, Cybercrime Ki Dhara, Cybercrime Key Issues And Debates Pdf, Cybercrime Kasus, Cyber Crime Karnataka, Cybercrime Kartu Kredit, Cybercrime Kolkata, Cyber Crime Karachi, Cybercrime Law, Cybercrime Laws In Usa, Cybercrime Law Enforcement, Cybercrime Laws Of The United States, Cybercrime List, Cybercrime Legislation Us, Cybercrime Laws In Florida, Cybercrime Legal Issues, Cybercrime Law Outline, Cyber Crime Lesson Plans, Cybercrime Meaning, Cyber Crime Movies, Cybercrime Methods, Cybercrime Methodology, Cyber Crime Money, Cybercrime Markets, Cyber Crime Magazine, Cyber Crime Most Wanted, Cybercrime Meaning In Tamil, Cybercrime Masters Degree, Cyber Crime News, Cyber Crime News Articles, Cyber Crime News Articles 2017, Cyber Crime Netflix, Cybercrime Nigeria, Cyber Crime Novels, Cybercrime Number, Cybercrime Nhs, Cyber Crime News Philippines, Cybercrime Nbi, Cybercrime Or Cyber Crime, Cybercrime Organizations, Cybercrime On The Rise, Cybercrime On The High Seas, Cybercrime Offenses, Cyber Crime Outline, Cybercrime Office, Cybercrime Office In Ahmedabad, Cybercrime Office In Patna, Cybercrime Office In Nashik, Cybercrime Quotes, Cyber Crime Quizlet, Cybercrime Questions, Cyber Crime Quiz, Cybercrime Questionnaire, Cybercrime Question Paper, Cybercrime Qatar, Cybercrime Question And Answers, Cybercrime Report, Cybercrime Research Paper, Cyber Crime Rates, Cyber Crime Recent, Cybercrime Research Topics, Cybercrime Research, Cybercrime Reported To The Ic3, Cybercrime Resources, Cybercrime Riding Tax Season Tides, Cyber Crime Report 2016, Cybercrime Statistics, Cybercrime Statistics 2017, Cyber Crime Stories, Cybercrime Spyware, Cybercrime Statistics 2015, Cybercrime Security, Cybercrime Solutions, Cybercrime Salary, Cybercrime Small Business, Cyber Crime Synonym, Cybercrime Topics, Cybercrime Trends, Cybercrime Tracker, Cybercrime Treaty, Cyber Crime Types, Cybercrime Training, Cybercrime Threats, Cybercrime Tools, Cybercrime Terms, Cybercrime The Transformation Of Crime In The Information Age, Cyber Crime Unit, Cybercrime Us, Cybercrime Uk, Cybercrime Uae, Cybercrime University, Cybercrime Un, Cyber Crime Unit Mauritius, Cyber Crime Unit Malta, Cybercrime Uc, Cybercrime Unodc, Cybercrime Victims, Cybercrime Vs Traditional Crime, Cybercrime Videos, Cybercrime Vs Traditional Crime Statistics, Cybercrime Virus, Cyber Crime Vocabulary, Cybercrime Vs Traditional Crime Punishment, Cybercrime Vs Computer Crime, Cybercrime Vs Cyber Warfare, Cybercrime Vs Cyber Espionage, Cybercrime Wiki, Cybercrime Worm, Cybercrime World Wide War 3.0, Cyber Crime Websites, Cyber Crime Worksheet, Cybercrime Wallpaper, Cyber Crime Worldwide, Cybercrime Working Group, Cyber Crime What Is It, Cybercrime Wikipedia Indonesia, Cybercrime X-remote Download, Tedx Cybercrime, Cyber Crime Youtube, Cyber Crime Yahoo, Cyber Crime Yahoo Answers, Cyber Crime Yesterday, Cyber Crime Youth, Cybercrime Yang Menyerang Hak Cipta, Cybercrime Yar, Youth Cyber Crime, Cyber Crime Yogyakarta, Cybercrime Yang Menyerang Pemerintah, Cybercrime Zimbabwe, Cybercrime Zeus, Cybercrime Zimbra, Zurich Cyber Crime, Zimbabwe Cybercrime Bill, Cyber Crime In Zambia, New Zealand Cyber Crime, Los Zetas Cybercrime, Cybercrime Law In Zambia, Cyber Crime Cases In Zambia, Cyber Espionage Definition, Cyber Espionage Cases, Cyber Espionage China, Cyber Espionage Prevention, Cyber Espionage Russia, Cyber Espionage Pdf, Cyber Espionage The Chinese Threat, Cyber Espionage History, Cyber Espionage International Law, Cyber Espionage Cases 2016, Cyber Espionage Act, Cyber Espionage Articles, Cyber Espionage Attacks, Cyber Espionage Adalah, Cyber Espionage And International Law, Cyber Espionage Australia, Cyber Espionage And Cyber Warfare, Cyber Espionage Attack Methods, Cyber Espionage Books, Cyber Espionage Beyond The Rule Of Law, Cyber Espionage Business, Cyber Espionage By China, Cyber Espionage Brazil, Cyber Espionage By Chinese Actors, Cyber Espionage Blog, Cyber Espionage By Country, Bagaimana Cyber Espionage Dapat Muncul, Best Cyber Espionage Books, Cyber Espionage Cases, Cyber Espionage China, Cyber Espionage Cases 2016, Cyber Espionage Case Study, Cyber Espionage Cases 2017, Cyber Espionage Cases In India, Cyber Espionage Campaign, Cyber Espionage China Us, Cyber Espionage Cost, Cyber Espionage Canada, Cyber Espionage Definition, Cyber Espionage Documentary, Cyber Espionage Def, Cyber Espionage Definition Pdf, Economic Cyber Espionage Definition, Bagaimana Cyber Espionage Dapat Muncul, Why Is Cyber Espionage Difficult To Prevent, Contoh Kasus Cyber Espionage Di Indonesia, How Is Cyber Espionage Done, Dragonfly Cyber Espionage, Cyber Espionage Examples, Cyber Espionage Edward Snowden, Cyber Espionage Effects, Cyber Espionage Essay, Cyber Economic Espionage, Cyber Economic Espionage Accountability Act, Cyber Espionage In Middle East, Economic Cyber Espionage And International Law, Economic Cyber Espionage Definition, Explain Cyber Espionage, Cyber Espionage Facts, Cyber Espionage Fiction, Cyber Espionage First Case, Cyber Espionage F 35, Cyber Espionage Law Firms, Fbi Cyber Espionage, France Cyber Espionage, A Theory Of Cyber Espionage For The Intelligence Community, French Cyber Espionage, Flame Cyber Espionage, Cyber Espionage Groups, Cyber Espionage Germany, Cyber Espionage Georgia, Cyber-espionage The Greatest Transfer Of Wealth In History, Cyber-espionage A Growing Threat To The American Economy, Cyber Espionage Against Georgia, Cyber Espionage Against Georgian Government, What Are Cyber Espionage Groups Stealing From The United States, Cyber Espionage To Splinter Internet Governance, Global Cyber Espionage, Cyber Espionage History, Huawei Cyber Espionage, Hellsing Cyber Espionage, Cyber Espionage International Law, Cyber Espionage Incidents, Cyber Espionage India, Cyber Espionage Is Alive And Well, South African Cyber Espionage, Cyber Espionage In China, Cyber Espionage In Middle East, Cyber Espionage Iran, Cyber Espionage In Canada, Cyber Espionage Impact, Cyber Espionage Jobs, Cyber Espionage Japan, Cyber Espionage Kenya, Kaspersky Cyber Espionage, Kasus Cyber Espionage, Kasus Cyber Espionage Di Indonesia, Kejahatan Cyber Espionage, Karakteristik Cyber Espionage, Cyber Espionage Law, Cyber Espionage Law Firms, Cyber Espionage International Law, Cyber Espionage Definition Law, Cyber Espionage Is Reaching Crisis Levels, Pengertian Dari Cyber Espionage Lengkap, Le Cyber Espionnage Definition, Cyber Espionage Meaning, Cyber Espionage Movies, Cyber Espionage Methods, Cyber-espionage Nightmare – Mit Technology Review, Cyber Espionage Attack Methods, Cyber Espionage In Middle East, Chinese Cyber Espionage Mandiant, Chinese Cyber Espionage Map, Bagaimana Cyber Espionage Dapat Muncul, Military Cyber Espionage, Cyber Espionage News, Cyber Espionage North Korea, Cyber-espionage Nightmare, Cyber Espionage National Security, Cyber Espionage Novels, Cyber Espionage Nato, Ghostnet Cyber Espionage Network, Nsa Cyber Espionage, Nortel Cyber Espionage, Cyber Espionage Operations, Cyber Espionage Red October, Cyber Espionage And Cyber Espionage, Cyber-espionage The Greatest Transfer Of Wealth In History, Cyber Espionage Prevention, Cyber Espionage Pdf, Cyber Espionage Ppt, Cyber Espionage Pronunciation, Cyber Espionage Presentation, Cyber Espionage Pictures, Cyber Espionage Problems, Cyber Espionage Purpose, Cyber Espionage Ppt Slideshare, Cyber Espionage Research Paper, Cyber Espionage Quotes, Cyber Espionage Research Questions, Cyber Espionage Russia, Cyber Espionage Research Paper, Cyber Espionage Rule Of Law, Cyber Espionage Report, Cyber Espionage Red October, Cyber Espionage Research Questions, Cyber Espionage Ring, Cyber Espionage Is Reaching Crisis Levels, Cyber Espionage Techrepublic, Russian Cyber Espionage, Cyber Espionage Statistics, Cyber Espionage Synonym, Cyber Espionage Simulator, Cyber Espionage Security Issues, Cyber Espionage Statistics 2015, Cybersecurity Espionage, Espionage In Cyberspace, Cyber Espionage Case Study, Cyber Espionage To Splinter Internet Governance, South African Cyber Espionage, Cyber Espionage The Chinese Threat, Cyber Espionage Threat, Cyber Espionage Tools, Cyber Espionage Trends, Cyber Espionage The Chinese Threat Case Study, Cyber Espionage To Splinter Internet Governance, Cyber-espionage The Greatest Transfer Of Wealth In History, Cyber Espionage Thesis, Cyber Espionage Training, Cyber Espionage Tactics, Cyber Espionage Uk, Us Cyber Espionage, Cyber Espionage Un, Cyber Espionage Us China, China’s Cyber Espionage Units, Russian Cyber Espionage Under The Microscope, China Cyber Espionage And U.s. National Security, Pla Cyber Espionage Unit, Cyber Espionage Vs Cyber Warfare, Cybercrime Vs Cyber Espionage, Cyber Espionage Vs Cyber Attack, Cyber Espionage Virus, Cyber Espionage Wiki, Cyber Espionage & Warfare, Cyber Weapons Espionage, Cyber Espionage Vs Cyber Warfare, Cyber Espionage And Cyber Warfare Definition, Cyber Espionage Youtube

SECRET – FBI Cyber Bulletin: Malicious Actors Targeting Protected Health Information

Become a Patron!
True Information is the most valuable resource and we ask you to give back.

FBI-TargetingHealthcare

FBI Liaison Alert System #A-000039-TT

  • 1 page
  • August 19, 2014

Download

The FBI is providing the following information with HIGH confidence. The FBI has observed malicious actors targeting healthcare related systems, perhaps for the purpose of obtaining Protected Healthcare Information (PHI) and/or Personally Identifiable Information (PII). These actors have also been seen targeting multiple companies in the healthcare and medical device industry typically targeting valuable intellectual property, such as medical device and equipment development data.

TECHNICAL DETAILS

The FBI has received the following information pertaining to a recent intrusion into a health care system that resulted in data exfiltration. Though the initial intrusion vector is unknown, we believe that a spear phish email message was used to deliver the initial malware. Typically, these actors use Information Technology themed spear-phishing messages which contain a malicious link that may connect to a new VPN site/service/client or a new Webmail site/software. Once access is obtained, the actors may collect and use legitimate account credentials to connect to the targeted system, usually through VPN.

The following are indicators of possible compromise:

Network-Based Indicator

Outgoing traffic through standard HTTP/HTTPS ports 80, 443 (and possibly others), but obfuscates traffic by XORing the traffic with 0×36. The below is a SNORT signature related to this activity:
alert tcp any any -> any any (content:”|6E|”; depth: 1; content:”|36 36 36 58 36 36 36|”; offset: 3; depth: 7; msg: “Beacon C2″; sid: 1000000001; rev:0)

Host-Based Indicator

The malware runs as a Windows service “RasWmi (Remote Access Service)” from the malicious .dll C:\Windows\system32\wbem\raswmi.dll. The implant is installed from an executable file (the file has been observed under a variety of names) which drops the raswmi.dll file into the same directory and sets it to run as a service.

Revealed by Cryptome – Cyber Warriors in the Middle East: Syrian E-Army

Become a Patron!
True Information is the most valuable resource and we ask you to give back.

Cybercrime – FBI Blackshades Remote Access Tool Private Sector Bulletins and Domain List

Become a Patron!
True Information is the most valuable resource and we ask you to give back.

FBI Private Industry Notification: FBI led takedown of “Blackshades Remote Access Tool” purchasers, developers Download
FBI Liaison Alert System #R-000029-MW Download
Blackshades Domain List Download XLSView TXT

(U) On 13 May 2014, FBI NY initiated a coordinated takedown focusing on individuals who purchased the Blackshades malware. Field offices across the United States, as well as foreign partners, engaged in subject interviews, searches, hardware seizures, and arrests. The FBI seized the primary domain utilized to purchase Blackshades products.

(U) Impact

(U) Blackshades has several products marketed for $5 to $40 USD, most of which are malware. These products include Blackshades Remote Access Tool (RAT), Blackshades Password Recovery, Blackshades Stealth, Blackshades Fusion, Blackshades Commander, Blackshades Crypter, and Blackshades Virtual Private Network (VPN). The most popular and versatile product sold by Blackshades is the Blackshades RAT. These are purchased as “off the shelf” products with a wide variety of features that allow a cyber criminal to use as they desire. Once the victim computer is infected, common uses for Blackshades include: access to victims’ computers; theft of passwords and credentials; key-logging ability; and Distributed Denial of Service attacks.

(U) Prior to the coordinated actions, two subjects associated with the Blackshades organization were arrested. Alex Yucel was identified as the developer of the Blackshades malware. Yucel not only wrote software code behind the malware, but also was responsible for improvements and updates to the malware and control of the Blackshades server. Yucel was arrested by Moldovan authorities in November 2013 and is currently awaiting extradition to the United States. Michael Hogue, a known seller and “customer service advisor” in the Blackshades organization was arrested in June 2012 and subsequently pled guilty to the charges against him.

…

(U) How Blackshades Connects to Victim’s Computers:

(U) In order for a connection to be established, the malware on a victim computer must know the IP address and listening port on the command and control computer. Given that many users have a dynamic IP address controlled and assigned by their Internet Service Provider, the malware is programmed to call to a unique domain names created by the Blackshades user. The Blackshades user associated this name with their IP address using any domain hosting service of their choice. In this manner, when the malware calls to the established domain, standard DNS protocols will route the malware to the Blackshades user’s IP address.

(U) The FBI is providing approximately 13,600 domains used by Blackshades users, which have been observed receiving status updates or have participated in previous attacks. These URLs are located within the United States and worldwide. The FBI is distributing these indicators to enable identification of Blackshades infections on their networks. The FBI has high confidence that these indicators were involved in past Blackshades related activity. The FBI recommends that your organization help victims identify and remove the malicious code.

Notes on Domain List: Computers infected with Blackshades may make DNS queries for these domains and attempt to connect to the corresponding IP addresses (usually on destination port 3080, 3333 or 4444). Disclaimer: these domains may be used for legit traffic.

…

FBI-BlackshadesAlert-1

Glenn Greenwald – Wie die Cyber-STASI das Internet zur Reputations-Zerstörung einsetzt

Become a Patron!
True Information is the most valuable resource and we ask you to give back.

How Covert Agents Infiltrate the Internet to Manipulate, Deceive, and Destroy Reputations

 

https://firstlook.org/theintercept/2014/02/24/jtrig-manipulation/