1 Organization Size There are four main CSIRT structures15,16: The organizational structure of a CSIRT, like any organization, depends on precisely what it will do and how it aims to accomplish its goals. Some of the questions the CSIRT Project Manager needs to answer that will help determine how the team will be organized are: Localized Security Team This is the least formal CSIRT structure. The theory behind the simple “security team” is that security events are resolved by existing staff in organizations. Security team members are not necessarily specialists in incident response or information security; they can be system administrators or database managers or have specialized knowledge in the various components or products involved in IT systems like firewalls and routers, among others. In most cases, the security team will not have all the expertise and experience necessary to perform robust security operations. For example, it may resolve an incident but not determine its cause, leaving the organization open to further exploitation. The nature of a “security team” usually precludes the implementation of best practices, research and development, monitoring, and security alert activities. Continued improvement in an organization’s information security posture with a security team is not likely. Centralized Incident Response Team In this structure there is a single team responsible for the management and response of security incidents across a number of locations that belong to one larger organization. This model would be appropriate, for example, in an enterprise. This structure is appropriate for organizations whose IT infrastructure is not dispersed geographically. Distributed Incident Response Teams Large organizations with geographically-distributed IT infrastructures or several distinct business units often adopt distributed incident response structures. These are made up of a comprehensive response center divided into several teams, one of which coordinates the activities of the others. Incident response duties are divided according to each team’s knowledge area, depending on the geographical location where incidents occur, or depending on the affected target community sector. The role of the coordinating team is essential to ensure effective and standardized of response procedures, to maintain statistics of incidents, increase synergy, and promote collaborative work through the sharing of best practices and lessons learned, and how to properly allocate security resources. Another vital function of the coordinating team is to facilitate interaction and cooperation between the teams. Coordinating Team This model is similar to the model of distributed response teams, but at the level of response centers. The difference is that the response center coordinator does not necessarily need to intervene in other coordinated teams’ efforts. This type of model arises from the response centers’ need to interact coordinatively to achieve a common goal, or generate synergy between centers of similar sectors or regions, corporations, or agencies of a same government. Its main function is to coordinate interaction and response effectiveness through coordination of efforts and collaboration, providing analysis of incidents and vulnerabilities, newsletters, statistics and documentation of best practices, among others. It is important to note that in order to define the CSIRT model to be implemented, it is essential to analyze the services they want to offer. Certain CSIRT models are not suitable for the provision of some of the above-mentioned services, particularly services that require permanent resources. For example, it is not suitable to implement monitoring services with Security Team models. PLANNING Organizational Structures • What services do I want to offer and at what times? • How big is the target community? • What is the geographical distribution of my target community? Where the CSIRT is housed will similarly play a part in determining how it will be structured. It also bears mentioning that its organizational model, along with the services offered, is subject to change over time. It is important to define the type of CSIRT model to be implemented, since this will have a direct implication on the size of the organization. In these structures, there is a defined response team and dedicated staff trained in managing information security and responding to security incidents. These teams interact with specialists on products or services. 46 A B C D Organization and HR 47