1 PLANNING Roles and Responsibilities To define a CSIRT’s organizational structure, one must have a clear idea of the various roles and responsibilities within a response team.17 COMMUNICATIONS MANAGER • Develops and publishes CSIRT documents • Maintains the CSIRT website and social media profile MANAGEMENT TRIAGE MANAGER • Strategic management of the team/ response center • Supervises the entire team • Interviews and hires new team members • Attends meetings of the security advisory council MIDDLE MANAGEMENT • • • • • Supports leadership Leads the team in day-to-day activities Assigns duties and tasks Manages codes Authorizes information access permits EVENT CLASSIFIER • Provides initial incident response assistance • Classifies and prioritizes the information received from a case • Classifies and prioritizes events • Assigns cases to technical staff INCIDENT HANDLER • Analyzes incidents, monitoring, recording and response • Coordinates incident response • Collaborates with other response groups or technicians to solve an incident ANALYST / RESEARCHER • Conducts specific research • Develops technical material for internal use or training • Performs monitoring tasks • Develops tools NETWORK ADMINISTRATOR • Manages and maintains the CSIRT networks, IDS and ISP • Assists in responding to incidents when networking expertise is needed SYSTEMS ADMINISTRATOR • Manages and maintains CSIRT systems • Assists in responding to incidents when systems expertise is needed • Manages access to information REPRESENTATIVE • Represents the CSIRT at events • If instructed, the representative can train other actors SPEAKER • Authorized communication channel with the press RECORDS CUSTODIAN • Access to secure information repositories ASSISTANT • Assists staff in performing their assigned tasks as directed These roles will be distributed among different people and work areas. In most all CSIRTs, people will be in charge of multiple roles at once. In this case, it is essential that there is a policy and practice of separation of duties. Here is how these roles are assigned to different CSIRT areas. 48 A B C D Organization and HR 49