Contact

Become a Member

ICS-CSIRT.io is a community effort to disseminate security information on Industrial Control Systems. ICS-CSIRT.io is not affiliated or linked with a governmental or commercial partner. Membership of ICS-CSIRT.io is free and grants you access to a MISP and OpenCVE instance. In return for membership we ask you to submit content, either to the website or to ICS-CSIRT.io MISP.

Access conditions

Send an e-mail to info@ics-csirt.io, describe how you can contribute and after a validation process you will get login credentials for MISP and OpenCVE. Use your professional or corporate email address and optionally attach your public PGP or S/MIME key. The MISP accounts require authentication with OTP. Accounts are setup for name-based addresses (your.name@company.com), and not for generic addresses (info@company.com).

If you already have a MISP instance installed (which is usually more convenient for automation), you can also already provide us the MISP UUID of your organization.

Events and information are shared under the conditions of the Traffic Light Protocol (TLP). Every participant is obliged to comply with the classification. Naturally, you are responsible for the information you share. Acknowledge via e-mail that you agree with the sharing and classification conditions, and educate the users of your (MISP) organisation. The acknowledgement is mandatory for processing the request.

MISP events

The MISP instance is bootstrapped with ICS relevant events shared under tlp:clear (tlp:white/tlp:clear). It is then up to the community to further add relevant events.

There is an automatic curation process for events synchronised from other MISP servers, this includes checks with MISP warninglists and the CIRCL Hashlookup service. Only events tagged with workflow:state=complete are considered complete and ready to be used.

Sharing and classification conditions

Introduction

This document outlines the terms of use for the MISP instance operated by ICS-CSIRT.io. All users must agree to these terms to access and use this platform.

1. Acceptance of Terms

By accessing or using the MISP instance, you agree to comply with these terms of use. If you do not agree to the terms, you should not access or use this MISP instance.

2. User Obligations and Conduct

2.1.Users must ensure the security of their credentials and should not share them with others.
2.2.Users are responsible for the accuracy and integrity of the information they contribute.
2.3.Users must respect the privacy and confidentiality of the information shared on the MISP platform.

3. Traffic Light Protocol (TLP) Compliance

3.1. All shared information within this MISP instance must adhere to the Traffic Light Protocol (TLP) classification system.
3.2. TLP Classifications:
TLP:RED- Information classified as TLP:RED is intended for the personal use of the recipient only, with no further dissemination allowed.
TLP:AMBER - TLP:AMBER information is restricted to participants' organizations, and only to those who need to know the information to protect their organization.
TLP:GREEN - TLP:GREEN information is limited to the community but may be shared with peers within the community.
TLP:CLEAR - TLP:CLEAR information can be distributed freely, without any restriction. (TLP:WHITE is a synonym).

3.3. Users must comply with the dissemination restrictions associated with each TLP level.
3.4. If a TLP classification is not set on an event, the default classification is TLP:AMBER.

4. Data Handling and Security

4.1. Users must take appropriate measures to ensure the security and integrity of information on the MISP platform.
4.2. Any breach of data security must be reported immediately to the MISP administrators to info@ics-csirt.io.

5. Violation of Terms

5.1. Violations of these terms may result in suspension or termination of access to the MISP platform.
5.2. Serious violations may lead to legal action, depending on the severity and impact of the breach.

6. Modification of Terms

6.1. ICS-CSIRT.io reserves the right to modify these terms at any time. Users will be notified of any changes.

7. Contact Information

For any questions or concerns regarding these terms, please contact info@ics-csirt.io

Public key info@ics-csirt.io