2 IMPLEMENTATION CSIRT Network Basic Design Basic Floor Plan Internet DMZ Ext. Future Projects ( SOC, Lab, crisis room... ) Internet CSIRT LAN Data center This segment will be exposed to the Internet. DMZ Ext. Investigation & Development CSIRT LAN Future Projects ( SOC, Lab, crisis room... ) Operations If the CSIRT opts for hosting public services (mail, web, etc.) in its facilities, services must be hosted on servers in this segment. This segment will publish services to the Internet. Training room Firewall Firewall DMZ Int. Testing IT Support Logistics area Workstations and equipment of the CSIRT office will be hosted here. Testing DMZ Int. The CSIRT should maintain Reception Management Coordination This segment will be used for testing software, malware, and potentially compromised or unreliable equipment. This area exists to perform tests on equipment or software without compromising the rest of the CSIRT infrastructure. 76 A B C D IT Facilities and Infraestructure zones: Internet, external DMZ, Internal DMZ, Testing and the CSIRT LAN. Five separate zones is a starting point; the complexity and number of security barriers will increase as the CSIRT grows and matures. In this segment the CSIRT will house internal services, systems, or tools for CSIRT use. This segment will not publish services to the Internet, but only to the CSIRT LAN. 77