1 PLANNING Value Added Services These services complement monitoring and alert warnings issued by the CSIRT. In general, value added services consist of security training courses and events, awareness-raising initiatives, skills analysis, and security labs. By conducting these types of events, the CSIRT also builds trust within the community, and creates awareness of the response team’s purpose and function, allowing it to operate more effectively. One of the most important aspects of efficient training activities is to identify the information gaps and needs of the target community. Much of this will be gleaned through the normal, day-to-day activity of the CSIRT and interaction with its clients. In delivering value added services, the CSIRT can partner with academic institutions or invite clients to share their experience and knowledge related to a security case study. D Organization and HR To put the institutional framework into practice and to perform the services required by the target community, the CSIRT needs a defined organizational structure, including detailed roles and responsibilities of its personnel. Evolution of CSIRT Services The services offered by a CSIRT will depend on its size, infrastructure and resources, and the abilities of its team members. They can be broadly broken down into basic, intermediate, and advanced, and likely will grow as a team matures over time. Advanced • Basic Services • Intermediate Services Intermediate • Basic Services Basic Services • Incident management • Vulnerability response • Artifact response • Monitoring and alert (first level) • R & D (first level) 44 A B C D Scope + • Monitoring and alert (second level) • R&D (second level) + • Evolution to SOC of monitoring and alerts services • Evolution to R&D lab • Incorporation of 3rd level R&D services Input - Mission - Vision - Target Community - Services Tools Analysis of CSIRT structures Available material resources Output Organizational chart HR 45