About DC3MissionsDIB CybersecurityDCISE Resources
DCISE Resources
DC3 DCISE offers many Cybersecurity-as-a-Service (CaaS) products at no cost to DIB CS Partners:
- Cyber Resilience Analysis (CRA): evaluates processes and practices across 10-security domains that provides insight into an organization’s operational resilience and ability to manage cyber attacks
- DCISE3: deploys instantly and delivers enterprise-grade threat identification and real-time monitoring of your network
- Adversary Emulation (AE): conducts penetration testing, which includes network mapping, vulnerability scanning, phishing assessments, and web application testing. Adversary Emulation merges technical, process, and policy issues into a single, actionable framework
Download the DCISE Partner Brochure
DIBNet-U Portal:https://dibnet.dod.mil/ Navigate to the DIBNet-U splash page to learn more about:
The DIBNet-U Portal is DoD’s gateway for defense contractor cyber incident reporting and participation in the DoD-DIB CS Program. The DIBNet-U Portal’s splash page is home to various DC3/DCISE offerings.
- The Cyber Threat Roundup (CTR): a collection of recent open-source articles of interest for the DIB
- DCISE-Recommended Top Five Cybersecurity Practices for small and medium companies
- DIB-Reported Cyber Threats
DIBNet User Types (Company Representative, Technical POC, or Regular User):
Value of being the Company Representative:
- Responsible for nominating additional DIBNet users
- Responsible for keeping Company POC up to date
- Primary POC for DIB Communications
Value of being a Technical POC:
- Receives ALL DCISE encrypted communications, including Participant Reports
- Real-time awareness of DIB-reported activity
DIBNet Regular User:
- Access to DIBNet including:
- Reporting
- Forums
- Presentation Slides
- Time-sensitive Alerts & Warnings
- Designated to share cyber activity via ICF with DCISE
- Invitations to DCISE-led events
DC3 DCISE facilitates a number of events throughout the year. Registration for events is done through the Customer Portal (https://customerportal.dc3.
- Partner Familiarization Event: Introductory meeting between DC3 DCISE and newly onboarded DIB CS Program Partners. Meeting discussions include the role of DC3 DCISE and Partnership member participation, overview of offerings available, and cyber activity/incident reporting guidance.
- DC3 TechEx: Bi-annual meetings between DIB Partners and USG stakeholders to share best practices,
lessons learned, tools, and other industry insights. - RPEX: Provides an opportunity for local DIB Partners within the same geographic region to have a TechEx experience on a smaller scale. DC3 DCISE Leadership and analysts provide a tailored threat brief covering the current threat landscape, specific APT trends, and threat actor TTPs. Partners have the opportunity to network, discuss topics of concern, present briefs, chair panels and collaborate.
- DCISE F.I.R.E.: One day SANS-supported event led by DCISE (in-person or remote) for DIB CS Program
participants to test their skills at a variety of topics while earing CPEs for certs. - A2A: DIB Partner-driven and may address APT TTPs, technology targeting, and current threat reporting.
- B2B: Introduction to DCISE products and services to DIB POCs and their corporate leadership in addition to highlighting the positive business impact of network security and participation in the DIB CS Program.
- DIB Web Conference/DIB Teleconference: Enable DIB Partners and DCISE analysts to have unclassified, granular and technical discussions on adversary techniques and trends. DCISE schedules a recurring series of introductory web conferences called “Partner Essentials.” Partner Essentials web conferences are tailored to assist new Partners, new Partner POCs, and others to fully acclimate to the DIB CS Program. In addition, DCISE provides the Partnership with video presentations that are hosted online for training purposes. These offerings may or may not be monitored and offer the flexibility to view the latest educational recordings that DCISE has to offer.
DC3 DCISE produces products ranging from indicator-based to strategic cyber threat analyses
- DC3 DCISE Threat Reporting:
- TIP: Derived from USG reporting; includes relevant Indicators of Compromise (IOCs) to DIB/CDCs
and narrative context - CRF Rollup/Supplement:
- CRF Rollup – Derived from DIB reporting; includes relevant IOCs to DIB/CDCs and narrative context
- CRF Supplement – Produced when additional amplifying data becomes available after initially reported in CRF Rollup (i.e. malware samples)
- TIP: Derived from USG reporting; includes relevant Indicators of Compromise (IOCs) to DIB/CDCs
- CTAR: In-depth risk analysis product detailing adversarial cyber targeting of US DoD technology/ platforms/systems
- TAR: In-depth analysis of cyber threat actors’ TTPs against DIB targets
- DC3 DCISE Notifications:
- Alerts, Warnings, Advisories, TIPPERs
- Vehicles to notify DIB Partners of varying levels of cyber threats (critical through situational)
- DC3 DCISE Informational Reporting:
- WIR: Roundup of DCISE IOCs released in DCISE products for the given week
- Cyber Threat Round-Up: Compilation of relevant cyber news articles, posted to DIBNET splash page
- Slick Sheets (on varying topics)
Mandatory
- DFARS 252.204-7012 – Safeguarding Covered Defense Information (CDI) and Cyber Incident Reportinghttps://www.acq.osd.mil/dpap/dars/dfars/html/current/252204.htm#252.204-7012
- Cyber incident that affects:
- CDI and/or the systems it resides on, or
- Ability to provide operationally critical support
Voluntary
- Helps DIB with situational awareness and indicator sharing
- Crowdsourcing threat information
- Types of events vary
- No impact to DoD information
- DC3 DCISE is your point of contact for submitting malware and/or other relevant files to the DC3 Cyber Forensics Laboratory (CFL) for a quick triage or an in-depth examination - for free
- Can be submitted as part of a Voluntary or Mandatory ICF submission
- 32 Code of Federal Regulations (CFR) Part 236, DoD’s DIB Cybersecurity Activities
https://www.federalregister.gov/documents/2016/10/04/2016- 23968/department-of-defense- dods-defense-industrial-base- dib-cybersecurity-cs- activities - DFARS 252.204-7012 “Safeguarding Covered Defense Information (CDI) and Cyber Incident Reporting”https://www.acq.osd.mil/dpap/
dars/dfars/html/current/ 252204.htm#252.204-7012 - DFARS 252.239-7010 “Cloud Computing Services”https://www.acq.osd.mil/dpap/
dars/dfars/html/current/ 252239.htm#252.239-7010 - FAR 52.204-23 “Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities”https://www.acquisition.gov/
far/52.204-23 - FAR 52.204-25 “Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment”https://www.acquisition.gov/
far/52.204-25
- Advanced Persistent Threat (APT)
- Analyst-to-Analyst (A2A)
- Business-to-Business (B2B)
- Cyber Resilience Analysis (CRA)
- Customer Response Form (CRF)
- Cybersecurity (CS)
- Cyber Targeting Analysis Report (CTAR)
- DoD Cyber Crime Center (DC3)
- DoD-DIB Collaborative Information Sharing Environment (DCISE)
- Defense Industrial Base (DIB)
- Electronic Malware Submission (EMS)
- Government-to-Government (G2G)
- Incident Collection Format (ICF)
- Mandatory Incident Report (MIR)
- Partner Familiarization Event (PFE)
- Point of Contact (POC)
- Policy and Operations Working Group (POWG)
- Public Key Infrastructure (PKI)
- Regional Partner Exchange (RPEX)
- Request for Information (RFI)
- Threat Activity Report (TAR)
- Threat Information Product (TIP)
- Tactics, Techniques, and Procedures (TTP)
- Technical Exchange (TechEx)
- Technology and Architecture Working Group (TAWG)
- Virtual Industry-Based Partner Exchange (VIPEX)
- Weekly Indicator Round-Up (WIR)
Q: How do I reactivate my DIBNet account?
Q: How do I become a POC?
Q: How often should I login to DIBNet to keep my account active?
Q: My cert on file has expired. How can I update my DIBNet account?
Q: Can I follow DC3/DCISE on social media?
Q: How do I nominate other personnel from my company for a DIBNet account?
Q: How do I submit a Mandatory Report/Voluntary Report?
Q: I am departing my company and I am the only POC listed. What should I do?
Q: How do I register for a Customer Portal account?
Need additional help or have an unanswered question?
Reach out today! Our team is standing by to assist you:
DCISE Inbox: DC3.DCISE@us.af.mil
DCISE Hotline: 410-981-0104
DC3.DCISE@us.af.mil
DCISE Hotline (410) 981-0104
DIB CS Program Management Office:
OSD.DIBCSIA@mail.mil
- Traditional Mail
- DC3 Electronic Malware Submission (EMS) Portal (https://ems.dc3on.gov/)
- Can also be accessed directly through DIBNet-U
- DoD SAFE (Secure Access File Exchange)https://safe.apps.mil
- Please do not email malware to anyone at DC3/DCISE
Watch the DIB Tech Talk Interview Series for an in-depth overview of the DoD’s DIB CS Program & DC3:
- In-Depth Look at DoD’s DIB CS Program -https://www.youtube.com/watch?
v=kIsJph_szCY - Meet DoD’s DC3/DCISE -https://www.youtube.com/watch?
v=vb9fTKh5Cxg - Meet DoD’s Vulnerability Disclosure Program (VDP) -https://www.youtube.com/watch?
v=wMUREvjvZeA
- DCISE is your point of contact for submitting malware and/or other relevant files to the DC3 Cyber Forensics Laboratory (CFL) for a quick triage or an in-depth examination - for free
- Can be submitted as part of a Voluntary or Mandatory ICF submission
- The DC3 Electronic Malware Submission (EMS) portal provides an option for Automated Malware Response (AMR). This capability provides:
- Completes a quick, automated analysis of your submitted malware, phishing emails, email attachments, or other suspicious files
- Results ready in less than 15 minutes
- Results include antivirus engine checks, file attributes, notable strings, YARA signature matches, and more