Cjcsm 6510.01B, Defense-In-Depth: Information Assurance (Ia) And Computer Network Defense (Cnd)

Front 1

DoD Cyber Incident Category 0

Back 1

Training and Exercises

Front 2

DoD Cyber Incident Category 1

Back 2

Root–Level Intrusions

Front 3

DoD Cyber Incident Category 2

Back 3

User–Level Intrusions

Front 4

DoD Cyber Incident Category 3

Back 4

Unsuccessful Activity Attempt

Front 5

DoD Cyber Incident Category 4

Back 5

Denial of Service

Front 6

DoD Cyber Incident Category 5

Back 6

Non–Compliance Activity

Front 7

DoD Cyber Incident Category 6

Back 7

Reconnaissance

Front 8

DoD Cyber Incident Category 7

Back 8

Malicious Code

Front 9

DoD Cyber Incident Category 8

Back 9

Investigating

Front 10

DoD Cyber Incident Category 9

Back 10

Explained Anomaly

Front 11

Operations performed for training purposes and support to exercises.

Back 11

Cyber Incident Definition Category 0: Training and Exercises

Front 12

Unauthorized privileged access to an IS. Privileged access, often referred to as administrative or root access, provides unrestricted access to the IS. This category includes unauthorized access to information or unauthorized access to account credentials that could be used to perform administrative functions (e.g., domain administrator). If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

Back 12

Cyber Incident Definintion Category 1: Root Level Intrusion (Incident)

Front 13

Unauthorized non–privileged access to an IS. Non–privileged access, often referred to as user–level access, provides restricted access to the IS based on the privileges granted to the user. This includes unauthorized access to information or unauthorized access to account credentials that could be used to perform user functions such as accessing Web applications, Web portals, or other similar information resources. If the IS is compromised with malicious code that provides remote interactive control, it will be reported in this category.

Back 13

Cyber Incident Definition Category 2: User Level Intrusion (Incident)

Front 14

Deliberate attempts to gain unauthorized access to an IS that are defeated by normal defensive mechanisms. Attacker fails to gain access to the IS (i.e., attacker attempts valid or potentially valid username and password combinations) and the activity cannot be characterized as exploratory scanning. Reporting of these events is critical for the gathering of useful effects–based metrics for commanders.
Note the above CAT 3 explanation does not cover the “run–of–the-mill” virus that is defeated/deleted by AV software. “Run–of–the-mill” viruses that are defeated/deleted by AV software are not reportable events or incidents and should not be annotated in JIMS.

Back 14

Cyber Incident Definition Category 3: Unsuccessful Activity Attempt (Event)

Front 15

Activity that denies, degrades, or disrupts normal functionality of an IS or DoD information network.

Back 15

Cyber Incident Definition Category 4: Denial of Service (Incident)

Front 16

Activity that potentially exposes ISs to increased risk as a result of the action or inaction of authorized users. This includes administrative and user actions such as failure to apply security patches, connections across security domains, installation of vulnerable applications, and other breaches of existing DoD policy. Reporting of these events is critical for the gathering of useful effects–based metrics for commanders.

Back 16

Cyber Incident Definition Category 5: Non–Compliance Activity (Event)

Front 17

Activity that seeks to gather information used to characterize ISs, applications, DoD information networks, and users that may be useful in formulating an attack. This includes activity such as mapping DoD information networks, IS devices and applications, interconnectivity, and their users or reporting structure. This activity does not directly result in a compromise.

Back 17

Cyber Incident Definition Category 6: Reconnaissance (Event)

Front 18

Installation of software designed and/or deployed by adversaries with malicious intentions for the purpose of gaining access to resources or information without the consent or knowledge of the user. This only includes malicious code that does not provide remote interactive control of the compromised IS. Malicious code that has allowed interactive access should be categorized as Category 1 or Category 2 incidents, not this category. Interactive active access may include automated tools that establish an open channel of communications to and/or from an IS.

Back 18

Cyber Incident Definition Category 7: Malicious Logic (Incident)

Front 19

Events that are potentially malicious or anomalous activity deemed suspicious and warrant, or are undergoing, further review. No event will be closed out as this category. This category will be recategorized to Category 1–7 or 9 prior to closure.

Back 19

Cyber Incident Definition Category 8: Investigating (Event)

Front 20

Suspicious events that after further investigation are determined to be non–malicious activity and do not fit the criteria for any other categories. This includes events such as IS malfunctions and false alarms. When reporting these events, the reason for which it cannot be otherwise categorized must be clearly specified.

Back 20

Cyber Incident Definition Category 9: Explained Anomaly (Event)