1 Once the desired structure is defined, the CSIRT Project Manager will recruit and hire personnel with the skills required by the functions to be carried out. Regardless of what position they are hired for, personnel should have a breadth of skills so as to avoid single points of failure within INFRAESTRUCTURE ACADEMYstaff will not the CSIRT.19 Moreover, CSIRT be expected to devote 100% of their time to any singular activity, especialPROVIDER ly in the time immediately following itsENTERPRISE launch. In certain cases, successful teams may begin with three people, for JUDICIAL example one director, one IT manager SECURITY and one leader to cover multiple roles, including operations and R&D, that also supports the IT manager. phase of CSIRT deSATISFIEDIn the firstINFORMED velopment, (implementation), IT support takes priority. Incident-response capacity ALERT will grow as theRESEARCH CSIRT increases its staff size, secures funding and becomes fully operational. INFRAESTRUCTURE This will be particularly trueCOMMERCIAL in the operations GOVERMENT department. ACADEMY PROVIDER ENTERPRISE Management FINANCIAL SERVICE PROV. SATISFIED ALERT NFRAESTRUCTURE GOVERMENT COMMERCIAL SYSTEM LEGESLATIVE SERVICE PROV. FINANCIAL EVOLUTION CIVIL CLOSELY MONITOR MISSION VULNERABILITY IT Support NATIONAL MILITARY OUTPUT LEGESLATIVE CIVIL MANAGEMENT CLOSELY VULNERABILITY EVENT SYSTEM CLOSELY GOVERMENT TOOLS JUDICIAL SECURITY SERVICE PROV. FINANCIAL EVOLUTION EVENT ALERT RESEARCH SYSTEM COMMERCIAL server GOVERMENT INPUT TOOLS fax MIDDLE MANAGEMENT FINANCIAL EVOLUTION MANAGEMENT computer MONITOR B shredder MISSION NETWORK ASISTANT storage MILITARY SPEAKER CUSTODIANS OUTPUT LEGESLATIVE CIVIL MANAGEMENT CLOSELY COMUNICATION INCIDENT NETWORK ASISTANT ASISTANT SPEAKER CUSTODIANS 1 Leader 1 Leader 2 Technical Specialists 2 Technical Specialists (Network Administrator, Systems Administrator) Research and Development 1 Leader 1 Leader 1 Technical Specialists 2 Security specialists (Analyst/Researcher, Records Custodian) Operations 1 Leader 1 Leader NATIONAL MILITARY 1 Technical Specialists 3 Incident specialists (classification, triage, handling) OUTPUT LEGESLATIVE 1 Lawyer (Legal support) 1 Lawyer (Legal support) 1 Reporter (communications) 1 Reporter (communications) 1 Financial analyst 1 Financial analyst CUSTODIANS VALUE phone ASISTANT NATIONAL 1 Director CIVIL Notes CLOSELY VULNERABILITY • This table is based on experiences acquired through consultation with some CSIRTs in the region (no CSIRT is structured exactly the same; each CSIRT is different based on its particular needs and/or functions). • Some positions may be assumed by the same person. MANAGEMENT TRIAGE COMUNICATION EVENT INCIDENT NETWORK SYSTEM ASISTANT ASISTANT SPEAKER CUSTODIANS Support Services*1 shredder MISSION A COMUNICATION INCIDENT TRIAGE ASISTANT INPUT fax MONITOR 1 Director/Coordinator COMUNICATION ENTERPRISE INFORMED 2nd Phase | Operation 15 (12 employees + 3 support staff) NETWORK SPEAKER TRIAGEcomputer 1st Phase | Implementation 9 (6 employees + 3 support staff) LEGESLATIVE PROVIDER MANAGEMENT fax OUTPUT COMMERCIAL SATISFIED 56 TOOLS INFRAESTRUCTURE MIDDLE server MANAGEMENT VALUE phone INPUT ASISTANT MANAGEMENT SERVICE PROV. MILITARY MILITARYMANAGEMENT The table shown below provides an example of how a TOOLS OUTPUT INPUT CSIRT with a staff size of 10 may distribute its roles and MANAGEMENT functions.SERVICE Information was acquired through consultaFINANCIAL TRIAGE MANAGEMENT MANAGEMENT PROV. ECURITY CIVIL tions with CSIRTs from theEVOLUTION region, that, while varying in circumstances and experiences, all serve as models for EVENT INCIDENT NFORMED MISSION VULNERABILITY success. MONITOR VALUE ACADEMY NATIONAL MIDDLE NATIONAL NTERPRISE ESEARCH GOVERMENT VALUE SECURITY Regardless of what position they EVOLUTION are hired MANAGEMENT MANAGEMENT for, INFORMED personnel should have a breadth of MONITOR MISSION skills so as to avoid single points of failure RESEARCH VALUE within the CSIRT JUDICIAL COMMERCIAL Personnel 1 Coordinator TOOLS INPUT CSIRT Departments PLANNING Size and Quantity of Resources VULNERABILITY storage C D MIDDLE Organization and HR MANAGEMENT 57