Source: Vulnerability Summary for the Week of November 30, 2015 | US-CERT

The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology(NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit theNVD, which contains historical vulnerability information.

The vulnerabilities are based on the CVE vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

• High - Vulnerabilities will be labeled High severity if they have a CVSS base score of 7.0 - 10.0
• Medium - Vulnerabilities will be labeled Medium severity if they have a CVSS base score of 4.0 - 6.9
• Low - Vulnerabilities will be labeled Low severity if they have a CVSS base score of 0.0 - 3.9

Entries may include additional information provided by organizations and efforts sponsored by US-CERT. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletins is compiled from external, open source reports and is not a direct result of US-CERT analysis.

High Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
cisco -- ios_xe	Cisco IOS XE 15.4(3)S on ASR 1000 devices improperly loads software packages, which allows local users to bypass license restrictions and obtain certain root privileges by using the CLI to enter crafted filenames, aka Bug ID CSCuv93130.	2015-12-02	7.2	CVE-2015-6383 CISCO(link is external)
cisco -- ios	The publish-event event-manager feature in Cisco IOS 15.5(2)S and 15.5(3)S on Cloud Services Router 1000V devices allows local users to execute arbitrary commands with root privileges by leveraging administrative access to enter crafted environment variables, aka Bug ID CSCux14943.	2015-12-01	7.2	CVE-2015-6385 CISCO(link is external)
cyrus -- imap	The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read.	2015-12-03	7.5	CVE-2015-8076 CONFIRM(link is external) CONFIRM(link is external) CONFIRM(link is external) CONFIRM(link is external) CONFIRM(link is external) MLIST(link is external) MLIST(link is external) MLIST(link is external) SUSE SUSE
cyrus -- imap	Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet variable. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.	2015-12-03	7.5	CVE-2015-8077 MLIST(link is external) CONFIRM(link is external) CONFIRM(link is external) MLIST(link is external) MLIST(link is external) SUSE
cyrus -- imap	Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the section_offset variable. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.	2015-12-03	7.5	CVE-2015-8078 CONFIRM(link is external) CONFIRM(link is external) MLIST(link is external) SUSE
debian -- debian_linux	The Debian build procedure for the smokeping package in wheezy before 2.6.8-2+deb7u1 and jessie before 2.6.9-1+deb8u1 does not properly configure the way Apache httpd passes arguments to smokeping_cgi, which allows remote attackers to execute arbitrary code via crafted CGI arguments.	2015-12-03	7.5	CVE-2015-0859 DEBIAN
debian -- dpkg	Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x before 1.16.17 and 1.17.x before 1.17.26 allows remote attackers to execute arbitrary code via the archive magic version number in an "old-style" Debian binary package, which triggers a stack-based buffer overflow.	2015-12-03	7.5	CVE-2015-0860 CONFIRM MISC CONFIRM UBUNTU(link is external) DEBIAN
mcafee -- mcafee_enterprise_security_manager	McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) 9.3.x before 9.3.2MR19, 9.4.x before 9.4.2MR9, and 9.5.x before 9.5.0MR8, when configured to use Active Directory or LDAP authentication sources, allow remote attackers to bypass authentication by logging in with the username "NGCP|NGCP|NGCP;" and any password.	2015-12-02	9.3	CVE-2015-8024 CONFIRM(link is external) MISC(link is external)
pcre -- perl_compatible_regular_expression_library	PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-2327 CONFIRM CONFIRM MLIST(link is external) MISC(link is external) CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-2328 CONFIRM CONFIRM MLIST(link is external) MISC(link is external) CONFIRM
pcre -- perl_compatible_regular_expression_library	The pcre_exec function in pcre_exec.c in PCRE before 8.38 mishandles a // pattern with a \01 string, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8380 CONFIRM MISC MLIST(link is external) CONFIRM
pcre -- perl_compatible_regular_expression_library	The compile_regex function in pcre_compile.c in PCRE before 8.38 and pcre2_compile.c in PCRE2 before 10.2x mishandles the /(?J:(?|(:(?|(?'R')(\k'R')|((?'R')))H'Rk'Rf)|s(?'R'))))/ and /(?J:(?|(:(?|(?'R')(\z(?|(?'R')(\k'R')|((?'R')))k'R')|((?'R')))H'Ak'Rf)|s(?'R')))/ patterns, and related patterns with certain group references, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8381 CONFIRM CONFIRM MLIST(link is external) CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8383 MLIST(link is external) CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles the /(?J)(?'d'(?'d'\g{d}))/ pattern and related patterns with certain recursive back references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8392 and CVE-2015-8395.	2015-12-01	7.5	CVE-2015-8384 MLIST(link is external) CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles the /(?|(\k'Pm')|(?'Pm'))/ pattern and related patterns with certain forward references, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8385 MLIST(link is external) CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8386 MLIST(link is external) CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8387 MLIST(link is external) CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8388 MLIST(link is external) CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, which allows remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8389 MLIST(link is external) CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8390 MLIST(link is external) CONFIRM
pcre -- perl_compatible_regular_expression_library	The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.	2015-12-01	9.0	CVE-2015-8391 MLIST(link is external) CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8395.	2015-12-01	7.5	CVE-2015-8392 MLIST(link is external) CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, which allows remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.	2015-12-01	7.5	CVE-2015-8394 MLIST(link is external) CONFIRM
pcre -- perl_compatible_regular_expression_library	PCRE before 8.38 mishandles certain references, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8392.	2015-12-01	7.5	CVE-2015-8395 MLIST(link is external) CONFIRM
siemens -- simatic_cp_343-1_firmware	Siemens SIMATIC CP 343-1 Advanced devices before 3.0.44, CP 343-1 Lean devices, CP 343-1 devices, TIM 3V-IE devices, TIM 3V-IE Advanced devices, TIM 3V-IE DNP3 devices, TIM 4R-IE devices, TIM 4R-IE DNP3 devices, CP 443-1 devices, and CP 443-1 Advanced devices might allow remote attackers to obtain administrative access via a session on TCP port 102.	2015-11-27	9.7	CVE-2015-8214 CONFIRM(link is external)

Back to top

Medium Vulnerabilities

Primary Vendor -- Product	Description	Published	CVSS Score	Source & Patch Info
cisco -- web_security_appliance	The passthrough FTP feature on Cisco Web Security Appliance (WSA) devices with software 8.0.7-142 and 8.5.1-021 allows remote attackers to cause a denial of service (CPU consumption) via FTP sessions in which the control connection is ended after data transfer, aka Bug ID CSCut94150.	2015-12-01	5.0	CVE-2015-6386 CISCO(link is external)
cisco -- unity_connection	Cross-site scripting (XSS) vulnerability in the management interface in Cisco Unity Connection 9.1(1.10) allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCup92741.	2015-12-02	4.3	CVE-2015-6390 CISCO(link is external)
pcre -- perl_compatible_regular_expression_library	The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.	2015-12-01	6.4	CVE-2015-8382 CONFIRM(link is external) CONFIRM MLIST(link is external) MLIST(link is external) CONFIRM CONFIRM CONFIRM(link is external)
pcre -- perl_compatible_regular_expression_library	pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a CGI script that sends stdout data to a client.	2015-12-01	5.0	CVE-2015-8393 MLIST(link is external) CONFIRM
redhat -- ceph	CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted bucket name.	2015-12-03	4.3	CVE-2015-5245 REDHAT(link is external) CONFIRM(link is external) MLIST(link is external)

Back to top

Source: Don’t Take the Bait; Avoid Phishing and Malware to Protect Your Personal Data

“Update your account now.”  “You just won a cruise!” “The IRS has a refund waiting for you.”

In the cyber world of phishing, the sentences are “bait” – lures from emails, telephone calls and texts all designed to separate you from your cash, your passwords, your social security number or your very identity.

The IRS has teamed up with state revenue departments and the tax industry to make sure you understand the dangers to your personal and financial data. Taxes. Security. Together. Working in partnership with you, we can make a difference.

No doubt you’ve heard that warning to beware of phishing many times. But, phishing remains a problem because it works. Cybercriminals on a daily basis concoct new ways to trick people into turning over cash or sensitive data that can affect your taxes.

When it comes to this type of crime, the main line of defense is not technology, it is you.

Criminals pose as a person or organization you trust and/or recognize. They may hack a friend’s email account and send mass emails under their name.  They may pose as your bank, credit card company or tax software provider. Or, they may pose as a state, local or federal agency such as the Internal Revenue Service or a state agency. Criminals go to great lengths to create websites that appear legitimate but contain phony log-in pages.

Just remember: No legitimate organization – not your bank, not your tax software company, not the IRS – will ever ask for sensitive information through unsecured methods such as emails. And the IRS never sends unsolicited emails or makes calls with threats of lawsuits or jail.

Scam emails and websites also can infect your computer with malware without you even knowing it. The malware can give the criminal access to your device, enabling them to access all your sensitive files or track your keyboard strokes, exposing login information.

Here are a few simple steps you can take to protect yourself:

• Avoid suspicious phishing emails that appear to be from the IRS or other companies; do not click on the links- go directly to their websites instead.
  
• Beware of phishing scams asking you to update or verify your accounts.
  
• To avoid malware, don’t open attachments in emails unless you know who sent it and what it contains.
  
• Download and install software only from websites you know and trust.
  
• Use security software to block pop-up ads, which can contain viruses.
  
• Ensure your family understands safe online and computer habits.

To learn additional steps you can take to protect your personal and financial data, visit Taxes. Security. Together. You also can read Publication 4524, Security Awareness for Taxpayers.

Each and every taxpayer has a set of fundamental rights they should be aware of when dealing with the IRS. These are your Taxpayer Bill of Rights. Explore your rights and our obligations to protect them on IRS.gov.

Source: China announces it arrested hackers connected to OPM breach - SC Magazine

China has arrested the individuals it says are responsible for the mega-breach of the Office of Personnel Management (OPM) in June, according to The Washington Post, citing anonymous U.S. officials.

Previously, in October, after U.S. officials named three Chinese state-owned companies they believe benefited from cybertheft of intellectual property, China arrested a group of hackers in connection with a 2014 cyberespionage campaign against U.S. companies. The hackers were arrested at the request of the U.S. government, the Post reported at the time.

China now says the same group hackers arrested for the campaign against U.S. companies also hacked the OPM. One of the U.S. officials told the Post, “We don't know that if the arrests the Chinese purported to have made are the guilty parties.”

The official China noted China's history “of people being arrested for things they didn't do” or politically-motivated “crimes against the state.”

Homeland Security Secretary Jeh Johnson and Attorney General Loretta Lynch met with senior Chinese officials on Tuesday and Wednesday to work out details of cyber coordination between the two countries. The talks are part of an ongoing dialogue on cyber issues that grew out of a pact between the U.S. and China to not engage in intellectual property theft.

During the talks this week, the two nations reached “guidelines for requesting assistance on cybercrime or other malicious cyber activities”, the Attorney General's office said, in a statement. However, the details of that document were not clear.

Discussions between China and the U.S. have been tenuous amidst reports that China had breached the agreement.

On Wednesday, Australia's Bureau of Meteorology fingered China as being responsible for a massive attack against the bureau's computer system that it says compromised sensitive national security information.

Earlier this week, China's state-owned Xinhua news agency said the OPM breach “turned out to be a criminal case rather than a state-sponsored cyberattack as the U.S. side has previously suspected.”

Source: Cup with no handle? Check out Netflix (NFLX). (December 03, 2015)

Cup with no handle? Check out Netflix (NFLX). (December 03, 2015)

by DAN

SP-500 DJ-30 DJ-20 UNP HA SAVE HA COMPQX XOIL.X USO XUE XOP OIH ULTA SBUX AMBA SBUX AMBA GPRO AMBA CBOE SWHC CALM NKE PAYC INTC MA V XLF OXY CVX XOM SLB HAL GILD BMY GILD IBB FISV 

Download Video
Download Fast Video

I want to get to Netflix ( NASDAQ:NFLX ). I think this is a pretty interesting pattern here. Even though so many stocks were down so much today look what Netflix ( NASDAQ:NFLX ) was actually poking at a new high earlier in the day before it fell back. Look at the daily pattern. Note over the last three days here’s your intraday high, here’s your intraday low. Then yesterday, a higher high and a higher low. Today, a higher intraday high and a higher intraday low. So even though so many stocks were getting whacked, Netflix ( NASDAQ:NFLX ), oh my gosh it’s down over a percent and a half, that’s horrible. Not really.

Now, if Netflix ( NASDAQ:NFLX ) falls further, and that’s fine, I’m not looking for this as a trade. I’ll tell you EXACTLY why I’m looking at this. I’m looking at this, this is a little cup here. This is a cup. Not a cup and handle; it’s just a cup. You’ve got a high and then a pullback and then a retest of that same high level with a little cup in between. This is a really, really nice SOLID base. It’s a high base, it’s a base within an uptrend. We like these, unless we’re short. So, when you look at Netflix ( NASDAQ:NFLX ) now, look at the possibilities. If the stock starts pulling back, that’s fine.

And again, I’m not talking about a trade, I’m talking about wanting to own Netflix ( NASDAQ:NFLX ). If the stock starts pulling back let it do that, that’s all good. Let it pullback like this, right into there. Hopefully volume will kind of be drying up a bit it won’t be super high. This would be known as a handle and THEN that sets up a move there, and that’s when you want to be long the stock. It’s not to say that you want to wait for the stock to breakout above there. No. Note that this is a cup. This is the 50-day moving average that has defined where support is.

So watch as this thing trickles up. If Netflix ( NASDAQ:NFLX ) trickles sideways long enough for the 50-day to catch up to it. Or if it just falls back to the 50-day moving average, that’s a great time to be buying this stock. But ultimately I think the path of least resistance on this stock is higher, you can see it in the weekly chart. You can see that this stock has been resolving to the upside on these consolidations. So Netflix ( NASDAQ:NFLX ) is one that I think you want to be buying on any kind of weakness.

Source: Industrial Control Systems Cyber Emergency Response Team (ICS-CERT)

The Industrial Control Systems Cyber Emergency Response Team (ICS-CERT)

The Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) works to reduce risks within and across all critical infrastructure sectors by partnering with law enforcement agencies and the intelligence community and coordinating efforts among Federal, state, local, and tribal governments and control systems owners, operators, and vendors. Additionally, ICS-CERT collaborates with international and private sector Computer Emergency Response Teams (CERTs) to share control systems-related security incidents and mitigation measures.   

About the Industrial Control Systems Cyber Emergency Response Team

The Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) operates within the National Cybersecurity and Integration Center (NCCIC), a division of the Department of Homeland Security's Office of Cybersecurity and Communications (DHS CS&C). NCCIC/ICS-CERT is a key component of the DHS Strategy for Securing Control Systems. The primary goal of the Strategy is to build a long-term common vision where effective risk management of control systems security can be realized through successful coordination efforts. ICS-CERT leads this effort by

• responding to and analyzing control systems-related incidents;
• conducting vulnerability, malware, and digital media analysis;
• providing onsite incident response services;
• providing situational awareness in the form of actionable intelligence;
• coordinating the responsible disclosure of vulnerabilities and associated mitigations; and
• sharing and coordinating vulnerability information and threat analysis through information products and alerts.

ICS-CERT coordinates control systems-related security incidents and information sharing with Federal, State, and local agencies and organizations, the intelligence community, and private sector constituents, including vendors, owners and operators, and international and private sector CERTs. The focus on control systems cybersecurity provides a direct path for coordination of activities among all members of the critical infrastructure stakeholder community.

As a functional component of the NCCIC, ICS-CERT provides focused operational capabilities for defense of control system environments against emerging cyber threats.

ICS-CERT provides efficient coordination of control-systems-related security incidents and information sharing with federal, state, and local agencies and organizations, the Intelligence Community, private sector constituents including vendors, owners, and operators, and international and private sector computer security incident response teams (CSIRTs). The focus on control systems cybersecurity provides a direct path for coordination of activities for all members of the stakeholder community.

Download the NCCIC/ICS-CERT Fact Sheet

Download the NCCIC/ICS-CERT Incident Handling Brochure

Download the NCCIC/ICS-CERT Acronyms List

Download the Common Cyber Language document

Control Systems Advisories and Reports

	Alerts Alerts provide timely notification to critical infrastructure owners and operators concerning threats to critical infrastructure networks.
	Advisories Advisories provide timely information about current security issues, vulnerabilities, and exploits.
	ICS-CERT Monitor We provide this newsletter as a service to personnel actively engaged in the protection of critical infrastructure assets.
	Joint Security Awareness Reports (JSARs) ICS-CERT coordinates with US-CERT and other partners to develop Joint Security Awareness Reports (JSARs) to provide situational awareness for the public on cybersecurity issues.
	Other Reports ICS-CERT Technical Information Papers (TIPs), Annual Reports (Year in Review), and 3rd-party products that ICS-CERT believes are of interest to persons engaged in protecting industrial control systems.

Onsite Incident Response

ICS-CERT provides onsite incident response, free of charge, to organizations that require immediate analysis and mitigations in response to a cyber attack. Upon notification of a cyber incident, ICS-CERT will perform a preliminary diagnosis to determine the extent of the compromise. At the customer's request, ICS-CERT can deploy an onsite support team to meet with the affected organization to review network topology, identify infected systems, image drives for analysis, and collect other data as needed to perform thorough follow-on analysis.  ICS-CERT can provide mitigation strategies and assist asset owners/operators with recommendations for improving overall network and control systems security.

Programs, Activities, and Partnerships

Advanced Analytic Lab. ICS-CERT operates an advanced analytic lab (AAL) that performs digital media and malware analysis on samples from infected systems.  The lab also hosts a representative sample of vendor equipment onsite to give analysts testing capabilities of malware in control system environments. The availability of onsite equipment and software allows ICS-CERT to assess the possible effects of malicious software and consequences a vulnerability may have on critical infrastructure.

Partnerships. ICS-CERT is a component of the National Cybersecurity and Communications Integration Center (NCCIC), bringing industrial control systems security technical and response capabilities to the partnership. The work is performed in conjunction with the NCCIC and furthers the overall mission to coordinate defense against and response to cyber attacks across the nation.

ICS-CERT works to reduce risk within and across all critical infrastructure sectors by coordinating efforts among federal, state, local and tribal governments, as well as control systems owners, operators, and vendors. In addition, ICS-CERT collaborates with international and private sector CERTs to share control systems related security incidents and mitigation measures.

ICS-CERT participates with many working groups including the Industrial Control Systems Joint Working Group and the Federal Control Systems Security Working Group. These trusted relationships are leveraged to increase and improve information sharing with the CIKR asset owner/operators and vendor community.

ICS-CERT also brings control systems and cybersecurity technical expertise and incident response capabilities to its partnership with the United States Computer Emergency Readiness Team (US-CERT). Both entities operate side-by-side within the NCCIC to provide a single source of support to critical infrastructure stakeholders.