1 Proactive Services These services aim to improve the infrastructure and security processes of the target community to prevent security incidents or reduce their impact when they occur. The main types of proactive services are performing monitoring, distributing alerts, and offering research and development services. Reactive services are the most important services provided by a CSIRT. In essence, “reactive services” respond to cyber security incidents occurring within the CSIRT’s community or within its own infrastructure. A response can be launched based either on a request for assistance or from monitoring and sensor networks maintained by the team. The principle types of reactive services are incident management, vulnerability response, and artifact response. Incident management Vulnerability response Incident management service consists of several phases: notification and receipt of an incident, classification or triage, response, analysis and resolution. The CSIRT must first determine the type, potential impact, and severity of an incident, followed closely by designating a response team to devise a plan of action that will restore services or systems to normal operation or otherwise mitigate the impact of a cyber-security event. In certain cases, this will necessitate that CSIRT personnel visit the site of the security event. This comprises a variety of vulnerability management processes, including patching, implementation of countermeasures, and other mitigation strategies. As new patches become available for detected vulnerabilities, the CSIRT must notify all stakeholders and distribute patches or describe techniques for implementing countermeasures while coordinating and confirming that adequate measures are taken. Many actors are typically involved in cyber-incident response, including ISPs, other CSIRTs, technology providers, law enforcement agencies, international actors, legal teams, press departments, and different areas of an affected organization. The CSIRT coordinates response activities and communications of the various stakeholders to optimize efforts and reduce incident resolution times. To accomplish this, the CSIRT should know the requirements and procedures of each of the stakeholders in order to positively manage interaction between them. Response to malicious artifacts A malicious artifact is a file or object in a system that is involved in an attack on a network or system, or used to evade security controls or measures. Managing malicious artifacts requires removing them from an affected system or informing stakeholders of how to do the same. Monitoring and alert services 1 First Level One of the most basic services offered by a CSIRT, monitoring and alerting involve the implementation of systems that detect security events, perform event and incident correlation, produce automated reports, and scan for vulnerabilities within the target community. To perform these functions, the CSIRT can either develop its own in-house solutions or employ third party commercial or open source tools and sensors. Information produced by monitoring and alert initiatives will inform strategic decision making and improve incident response processes. 2 Second Level A more developed CSIRT will offer more advanced monitoring and alert services. These track target community infrastructure and systems in much more depth, but generally provide similar types of alerts and incident correlation as first level monitoring and alerts. More closely monitoring client systems allows for earlier detection of security events, vulnerabilities, or malicious artifacts. To perform this kind of in-depth monitoring, system interconnection or installation of safety sensors in community infrastructure is generally needed. As a coordinator and collaborator, the CSIRT generates knowledge of the systems, processes, and infrastructure of the target community. Accordingly, the response team can develop strategies, specific tools, and plug-ins from existing systems to analyze, monitor and protect the particular infrastructure of the community it serves. 42 A B C D Scope PLANNING Reactive Services Research and Development 1 First Level These services allow the CSIRT and its community to stay abreast of developments in the field of information security and incident response. Specifically, it will allow them to stay up to date on alerts, evolving threats, emerging attack vectors, best practices and new norms in services and device maintenance and operation, defense strategies, and a host of other topics. 2 Second Level As a CSIRT matures, it will develop more robust R&D capabilities. With the information it gathers and generates, the CSIRT can carry out security audits and assessments on its own systems or those of the target community. This may include application or infrastructure analysis, review of security policies, vulnerability scanning, penetration testing, and compliance with market standards or norms. As technology evolves, threats and vulnerabilities change. The CSIRT must be able to detect emerging threats or vulnerabilities inherent to new technologies and distribute information relevant to them that can improve security levels. 3 Third Level The most advanced CSIRTs will continue to develop R&D capabilities, for example, malicious code analysis, so as to be able to determine the nature, behavior and purpose of a specific artifact. 43