1 Services Authority models are the types of powers a CSIRT can exercise. Several authority models connect the CSIRT with its ligations when facing an incident occurring in its community. The services of a CSIRT are strongly related to its mission, target community and the knowledge, skills, and abilities of the human resources at its disposal. There are four popular types of authority that a CSIRT can hold over its community:13 the assistance of stakeholders, or through other actors with whom the CSIRT has agreements, such as software or hardware companies. In each case the CSIRT should evaldepending on resource availability and specialization. PLANNING Authority Models with the Target Community Proactive Services Monitoring and alert services • • • • In each case the CSIRT should evaluate given situation, depending on resource availability and specialization Full Authority The CSIRT has authority to carry out all necessary actions relating to the management of an incident, and community members are required to implement the measures proposed by the CSIRT or, at most, allow members of the CSIRT to implement them. Shared Authority The services provided by the CSIRT are usually grouped into three types: Reactive Services, Proactive Services and Value-added Services. 14 External Monitoring Internal Monitoring Development of security tools Security alerts and Reports R&D Services • • • • • • Security Audits Vulnerability scanning Malicious artifact scanning Technology Monitoring Artifact analysis Forensic analysis The decision regarding an incident is made community and the CSIRT. The CSIRT supports the actors involved in an incident and collaborates with equipment and expertise. Reactive Services Incident management • • Post mortem analysis On-site assistance Vulnerability response Malicious artifact response Value-added Services Indirect Authority Null Authority The CSIRT has no authority over decisions regarding incidents. It provides advice, information and experience, but decisions 40 A B C D Scope The CSIRT has no authority over the community, however it can exert indirect pressure on it-- for example, through regulators or other organizations with which the CSIRT has established bonds of trust. Training and education Awareness raising Risk Analysis and business continuity Support to security undertakings 41