Cjcsm 6510.01B, Defense-In-Depth: Information Assurance (Ia) And Computer Network Defense (Cnd)

Front 1

DoD Cyber Incident and Reportable
Cyber Event

Category 0

Back 1

Training and Exercises

Front 2

DoD Cyber Incident and Reportable
Cyber Event

Category 1

Back 2

Root-Level Intrusions

Front 3

DoD Cyber Incident and Reportable
Cyber Event

Category 2

Back 3

User-Level Intrusions

Front 4

DoD Cyber Incident and Reportable
Cyber Event

Category 3

Back 4

Unsuccessful Activity Attempt

Front 5

DoD Cyber Incident and Reportable
Cyber Event

Category 4

Back 5

Denial of Service

Front 6

DoD Cyber Incident and Reportable
Cyber Event

Category 5

Back 6

Non-Compliance Activity

Front 7

DoD Cyber Incident and Reportable
Cyber Event

Category 6

Back 7

Reconnaissance

Front 8

DoD Cyber Incident and Reportable
Cyber Event

Category 7

Back 8

Malicious Code

Front 9

DoD Cyber Incident and Reportable
Cyber Event

Category 8

Back 9

Investigating

Front 10

DoD Cyber Incident and Reportable
Cyber Event

Category 9

Back 10

Explained Anomaly

Front 11

CYBER INCIDENT AND REPORTABLE CYBER EVENT CATEGORIZATION Definition

Category 0: Training and Exercises

Back 11

Operations performed for training purposes and support to exercises.

Front 12

CYBER INCIDENT AND REPORTABLE CYBER EVENT CATEGORIZATION Definition

Category 1: Root Level Intrusion (Incident)

Back 12

Unauthorized privileged access to an IS. Privileged access, often referred to as administrative or root access, provides unrestricted access to the IS. This category
includes unauthorized access to information or unauthorized access to account credentials that could be used to perform administrative functions (e.g., domain administrator). If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

Front 13

CYBER INCIDENT AND REPORTABLE CYBER EVENT CATEGORIZATION Definition

Category 2: User Level Intrusion (Incident)

Back 13

Unauthorized non-privileged access to an IS. Non-privileged access, often referred to as user-level access, provides restricted access to the IS based on the privileges granted to the user. This includes unauthorized access to information or unauthorized access to account credentials that could be used to perform user functions such as accessing Web applications, Web portals, or other similar information resources. If the IS is compromised with malicious code that provides remote

interactive control, it will be reported in this category.

Front 14

CYBER INCIDENT AND REPORTABLE CYBER EVENT CATEGORIZATION Definition

Category 3: Unsuccessful Activity Attempt (Event)

Back 14

Deliberate attempts to gain unauthorized access to an IS that are defeated by normal
defensive mechanisms. Attacker fails to gain access to the IS (i.e., attacker attempts valid or potentially valid username and password
combinations) and the activity cannot be characterized as exploratory scanning. Reporting of these events is critical for the
gathering of useful effects-based metrics for commanders.
Note the above CAT 3 explanation does not cover the “run-of-themill” virus that is defeated/deleted by AV software. “Run-of-themill” viruses that are defeated/deleted by AV software are not reportable events or incidents and should not be annotated in
JIMS.

Front 15

CYBER INCIDENT AND REPORTABLE CYBER EVENT CATEGORIZATION Definition

Category 4: Denial of Service (Incident)

Back 15

Activity that denies, degrades, or disrupts normal functionality of an IS or DoD information network.

Front 16

CYBER INCIDENT AND REPORTABLE CYBER EVENT CATEGORIZATION Definition

Category 5: Non-Compliance Activity (Event)

Back 16

Activity that potentially exposes ISs to increased risk as a result of the action or inaction of authorized users. This includes administrative and user actions such as failure to apply security patches, connections across security domains, installation of vulnerable applications, and other breaches of existing DoD policy. Reporting of these events is critical for the gathering of useful effects-based metrics for commanders.

Front 17

CYBER INCIDENT AND REPORTABLE CYBER EVENT CATEGORIZATION Definition

Category 6: Reconnaissance (Event)

Back 17

Activity that seeks to gather information
used to characterize ISs, applications, DoD information networks, and users that may be useful in formulating an attack. This includes activity such as mapping DoD information networks, IS devices and applications, interconnectivity, and their users or
reporting structure. This activity does not directly result in a compromise.

Front 18

CYBER INCIDENT AND REPORTABLE CYBER EVENT CATEGORIZATION Definition

Category 7: Malicious Logic (Incident)

Back 18

Installation of software designed and/or deployed by adversaries with malicious intentions for the purpose of gaining access to resources or information without the
consent or knowledge of the user. This only includes malicious code that does not provide remote interactive control of the compromised IS. Malicious code that has allowed interactive access should be categorized as Category 1 or Category 2 incidents, not Category 7. Interactive active access may include automated tools that establish an open channel of communications to and/or from
an IS.

Front 19

CYBER INCIDENT AND REPORTABLE CYBER EVENT CATEGORIZATION Definition

Category 8: Investigating (Event)

Back 19

Events that are potentially malicious or
anomalous activity deemed suspicious and warrant, or are undergoing, further review. No event will be closed out as a Category 8. Category 8 will be recategorized to appropriate Category 1-7 or 9 prior to closure.

Front 20

CYBER INCIDENT AND REPORTABLE CYBER EVENT CATEGORIZATION Definition

Category 9: Explained Anomaly (Event)

Back 20

Suspicious events that after further investigation are determined to be non-malicious activity and do not fit the criteria for any other categories. This includes events such as IS malfunctions and false alarms. When reporting these events, the reason for which it cannot be otherwise categorized must be clearly specified.