In establishing a regional network of cooperating National CSIRTs, a minimum set of standards and services would be expected. These would include: • • • • • designation of responsibility by the National CSIRT’s government; agreement to principles of information sharing among the cooperating teams; responsibility for receiving information from other National CSIRTs and disseminating that information to appropriate entities within the country; authorization to disseminate information to other National CSIRTs; and provide coordination assistance to other National CSIRTs for incidents and threats. Trust Issues Much of the information which CSIRTs need to exchange is proprietary or otherwise sensitive and there are few good models that promote the consistent sharing of information among CSIRTs. Trust – the essential ingredient in information sharing – when it exists, has developed among individuals who know and have worked with each other, rather than institutionally, among organizations. To establish trust, clear expectations on how information exchanged will be used or disseminated must be understood and followed by all parties. Principles of information sharing stating how information can be used or disseminated must be agreed to among all of the cooperating National CSIRTs. Vulnerability disclosure policies outline under what circumstances and to whom vulnerability information is disseminated. These policies must balance the need to disseminate actionable information to appropriate audiences with the need to minimize the potential that intruders will obtain the information before patches or workarounds are available. Some of the CSIRT attributes that are required to promote trust in communication and cooperation about sensitive security issues include: • • • • • • • a secure infrastructure for managing sensitive information; the ability to communicate securely with stakeholders; the ability to marshal experts and decision makers; an infrastructure to support advance notification to select audiences; procedures to guard against information leakage; a well-known public interface for dissemination of critical information; and the ability to reach a large audience quickly. Developing a regional CSIRT capability will require the development of a consensus on principles of information sharing including what information to share, with whom, and when. Financing CSIRT financing is not inexpensive. In addition to providing equipment and trained staff on a permanent basis, CSIRT administrators need to provide periodic technical assistance and develop regular exercises to keep their operations sharp. Member States and the Organization will have to carefully consider CSIRT funding mechanisms and may have to prioritize their coverage, or seek stable sources of outside funding. It should be noted that in October 2002, APEC leaders called for the development of a regional 24/7 CSIRT capability by October 2003. Both APEC and the Government of Australia agreed to fund CSIRT capacity-building projects in four member economies. In their most recent report on the project,