MILITARY 1 PLANNING LEGESLATIVE Under this model, each area is responsible for the following tasks: CLOSELY Management Operations IT • • • • • • Research and development Support Services NICATION ORK NT DIANS • • Strategic management Monitoring of activities External linkage: other CSIRTs, organizations and advisory board Budget management Media/public liaison A B C • • Management of IT infrastructure Operations Support Support to R&D • • • • • • CSIRT Management primarily sets the course for the organization and conducts strategic planning. It also establishes cooperation agreements with other organizations and liaises with the CSIRT Steering Committee. The CSIRT director also acts as spokesperson to the press. 52 Incident Management Monitoring D The Operations area is the critical part of the CSIRT. This is where incident management, monitoring, and incident analysis is performed. It may take some time for the operations area to begin receiving large numbers of incidents as word spreads of the CSIRTs existence and the services it offers to constituents. Organization and HR The IT Section implements and manages all proprietary systems that control and administer the CSIRT’s email, webpage, file server, ticket management system, monitoring system, network and firewalls. Like the R&D department, the IT section will be busy from the outset deploying and adjusting the CSIRT’s architecture. Technological Observatory Statistical analysis of incidents and trends Development of systems and tools Training Special Research Support to Operations Research and Development is the area of the CSIRT that will implement the teams secondary functions such as the development of tools, carrying out trainings, and otherwise researching new cyber security trends and threats. R&D will be busy from the inception of the CSIRT since it will be in charge of the bulk of planning, training, and development of any necessary in-house solutions. This area will work closely with the IT area. • • • • Marketing/communications Legal Support Press Management Administration and Finance Support Services that oversee press management, legal considerations, and administration and finance are essential to the functioning of any CSIRT. These activities must be accounted for in a National CSIRT, although they can be subcontracted or provided externally. 53