2 IMPLEMENTATION CSIRT Facilities IT Facilities and Infrastructure C This section describes the basic facilities the CSIRT must maintain, including IT infrastructure, network architecture and diagrams. It is one of the many ways a CSIRT could structure its hardware. As a general rule, CSIRT facilities, their data networks and telecommunications will be designed with great care to not only protect sensitive information collected but also protect the CSIRT Staff. This means that information should be stored and managed by the CSIRT itself, as opposed to having it outsourced or stored off site or out of country. Owing to the sensitivity of the information with which it works, a CSIRT and its employees must be secured much in the same way an organization protects a datacenter. This means that a CSIRT cannot be in an open cubicle environment. Rather, it should have its own office space separated by walls and doors, thereby reducing the possibility of sensitive information being seen or heard. Access to CSIRT facilities should be restricted in order to prevent unauthorized access to resources and information. The building or the area where the main CSIRT facilities are located must have 24-hour surveillance to minimize the risk of improper access to facilities. Servers, communications equipment, logic safety devices and data repositories can stay in a datacenter or in the CSIRT facilities, but in all cases the physical and logical access to equipment shall be governed by strict access control that will ensure information access policies are upheld. In addition to securing electronic information, the CSIRT shall maintain a safe or deposit box to store sensitive non-digital information, tokens, hard disks and servers, among others. Access to CSIRT facilities should be restricted in order to prevent unauthorized access to resources and information. The following diagram gives an example of a blueprint for a CSIRT. The example should serve as a guideline for setting up a CSIRT facility; however, countries may adapt the model to fit their needs and logistical realities. General considerations Means of outfitting the space • Air conditioning and False-floors (primarily for the Data Center) • Detection systems and fire extinguishers in the common rooms and Data Center • Redundant systems (Uninterrupted Power Supply (UPS) source, air conditioner, etc.) • Locked, stationery cabinets ilustración Methods of restricting physical access & awareness to the zones • Controlled access to: • the building (doors and windows) • the floor • the common zones (Operations, IT support, R&D, etc.) • the Data Center • the Logistics area • the future projects (lab, monitoring room) Restricted visits (providers, etc.), accompanied all the time in all CSIRTs areas. Vigilance through CCTV 74 A B C D Definition 75