mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
49 lines
2.2 KiB
Markdown
49 lines
2.2 KiB
Markdown
# Standards & References - Ransomware Tabletop Exercise
|
|
|
|
## Exercise Standards
|
|
|
|
### FEMA HSEEP (Homeland Security Exercise and Evaluation Program)
|
|
- Standardized methodology for exercise design, conduct, and evaluation
|
|
- Defines exercise types: seminars, workshops, tabletops, drills, functional, full-scale
|
|
- Provides templates for exercise plans, evaluation guides, and AARs
|
|
- https://www.fema.gov/emergency-managers/national-preparedness/exercises/hseep
|
|
|
|
### NIST SP 800-84: Guide to Test, Training, and Exercise Programs
|
|
- Framework for developing IT plan test and exercise programs
|
|
- Section 4.3: Tabletop exercises for incident response testing
|
|
- Covers exercise scoping, objectives, scenario development, and evaluation
|
|
|
|
### CISA Tabletop Exercise Packages (CTEPs)
|
|
- Free downloadable exercise scenarios for critical infrastructure sectors
|
|
- Ransomware-specific scenarios updated to reflect current threat landscape
|
|
- https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages
|
|
|
|
## Ransomware-Specific Guidance
|
|
|
|
### CISA #StopRansomware Guide
|
|
- Ransomware response checklist that exercises should validate
|
|
- Decision tree for ransom payment considerations
|
|
- Recovery priority guidance
|
|
|
|
### NIST IR 8374: Ransomware Risk Management
|
|
- Identifies exercise testing as a key control in the Recover function
|
|
- Recommends annual tabletop exercises with escalating complexity
|
|
|
|
### FBI/CISA Joint Advisories
|
|
- AA24-131A: Black Basta Ransomware
|
|
- AA23-136A: BianLian Ransomware Group
|
|
- AA23-158A: CL0P Ransomware Gang Exploiting MOVEit
|
|
- Use these as source material for realistic exercise scenarios
|
|
|
|
## Regulatory Notification Requirements (for Scenario Design)
|
|
|
|
| Regulation | Notification Timeline | Authority |
|
|
|-----------|----------------------|-----------|
|
|
| GDPR (EU) | 72 hours | Supervisory Authority |
|
|
| HIPAA (US Healthcare) | 60 days (individuals), ASAP (HHS if >500) | HHS OCR |
|
|
| SEC (US Public Companies) | 4 business days (Form 8-K) | SEC |
|
|
| PCI DSS | 72 hours | Card brands/acquiring bank |
|
|
| NY DFS (23 NYCRR 500) | 72 hours | NY DFS |
|
|
| CCPA (California) | "Expedient time" | California AG |
|
|
| NIS2 (EU) | 24 hours (early warning), 72 hours (full) | National CSIRT |
|