2 IMPLEMENTATION Suggested Basic Equipment Computers and servers Computers CSIRT software systems include the following: CSIRT staff must have laptops that are used exclusively for work functions. Institutional Web Server Monitoring Server This server contains the institutional site where all public, non-sensitive information on CSIRT issues, including alerts, newsletters, contacts and incident reporting forms are located. Active monitoring of systems is implemented on this CSIRT server, including: monitoring of government portals, CSIRT proprietary monitoring and active vulnerability detection systems. It is recommended that monitoring consoles be visible for all CSIRT staff. Institutional Mail Server This server is in charge of communications via CSIRT email and stores the CSIRT e-mailboxes. Intranet Server The purpose of this server is to facilitate information exchange between CSIRT staff. It stores data relevant to the team and procedures, incident response techniques, best practices, operation manuals, incident documentation and other information of interest. File Server This server is used to store the team’s digital files, which should stay online and be published within the CSIRT facilities. Server backups This server is tasked with backing up information from all CERT systems and workstations. Offsite vault backups are generated from this computer. DNS Server This server is responsible for name resolution of CSIRT infrastructure. Telephones The CSIRT has direct access to telephone services, fixed line, IP telephony and mobile phones that allow it to make local and international calls as required to operate. Hub and events correlation The role of this server is to concentrate all CSIRT systems audit trails, implemented monitoring systems and sensor network deployed by it. This server performs event correlation and alerting. Log system and incident tracking This is perhaps the most important of the CSIRT’s servers and is committed to keeping records and tracking CSIRT incidents. It records reports of incidents received, communications flowing into and out of the CSIRT related to incident response, and is used to check the status of the technicians involved in an incident response. It also serves as a source of knowledge to the team. Each email sent to the incidents@ cert.xx box as well as the completed forms on the CSIRT website will automatically generate a ticket in the management system. The triage manager will use this system to assign incident handlers to a particular ticket and close incidents at the appropriate time. Fax It is recommended that the CSIRT have an exclusive-use FAX machine within the CSIRT facilities in order to prevent any fax with sensitive information from being seen by unauthorized personnel. Shredder The CSIRT must have a shredder that allows it to destroy sensitive printed and CD information. This shredder can be shared with other members of the organization outside of the CSIRT, but the destruction of materials should be performed by the CSIRT staff, or as indicated in the information destruction policy. Portable logical storage During incident response, it is often necessary to use external drives or flash drives to store information. The CSIRT should have at least four 2TB external drives and five 32GB flash drives. 78 A B C D IT Facilities and Infraestructure 79