Source: https://www.whitecase.com/publications/alert/cisa-guidance-clarifies-how-share-cyber-threat-information-issues-remain
Timestamp: 2018-11-16 06:15:10
Document Index: 504198043

Matched Legal Cases: ['§ 102', '§ 102', '§ 106', '§ 105', '§ 106', '§ 102']

CISA Guidance Clarifies How to Share Cyber Threat Information… but Issues Remain | White & Case LLP International Law Firm, Global Law Practice
[1] - Consolidated Appropriations Act, 2016, Pub. L. 114-113 (2015). As of April 8, 2016, the Government Printing Office has not published the public law version. For textual references, see H.R. 2029 – Consolidated Appropriations Act, 2016
[2] - Sharing of Cyber Threat Indicators and Defensive Measures by the Federal Government under the Cybersecurity Information Sharing Act of 2015; Interim Procedures Related to the Receipt of Cyber Threat Indicators and Defensive Measures by the Federal Government; and Privacy and Civil Liberties Interim Guidelines: Cybersecurity Information Sharing Act of 2015
[3] - Privacy Impact Assessment for the Automated Indicator Sharing (AIS) Update ("Privacy Impact Assessment"), U.S. Department of Homeland Security, DHS/NPPD/PIA-029(a), March 16, 2016
[4] - Joint Explanatory Statement to Accompany the Cybersecurity Act Of 2015, issued by the Senate Select Committee on Intelligence, House Permanent Select Committee on Intelligence, Senate Committee on Homeland Security and Governmental Affairs, and House Committee on Homeland Security, p. 1 (2015)
[5] - "Cybersecurity purpose" means protecting an information system or information that is stored on, processed by, or transiting an information system from a cybersecurity threat or security vulnerability. CISA § 102(4).
[6] - "Effectively, the only information that can be shared under [CISA] is information that is directly related to and necessary to identify or describe a cybersecurity threat. Information is not directly related to a cybersecurity threat if it is not necessary to assist others detect, prevent, or mitigate the cybersecurity threat." Guidance, p. 5.
[7] - Examples include:
A company could report that its web server log files show that a particular IP address has sent web traffic that appears to be testing whether the company’s content management system has a particular vulnerability.
A security researcher could report the discovery of a technique that permits unauthorized access to an industrial control system.
[8] - CISA § 102(7).
[9] - DMs "will generally consist principally of technical information that can be used to detect and counter a cybersecurity threat." Guidance, p. 6.
[10] - CISA § 106(b)(1).
[11] - Guidance, p. 12.
[12] - CISA § 105(c)(1)(B).
[13] - Guidance, p. 10.
[14] - Guidance, p. 12., (stating that the initiative "Anonymizes the identity of the submitter of the information, unless the submitter has consented to sharing its identity").
[15] - Privacy Impact Assessment p. 8.
[16] - CISA § 106(b).
[17] - Privacy Impact Assessment, p. 13.
[18] - Guidance, p. 6, n. 8.
[20] - CISA § 102(9).
[21] - 12 U.S.C. 3502(8).
[22] - See note 4.
[23] - Privacy Impact Assessment, p. 14.