1 PLANNING Although others may be identified, the main stakeholders5 in Cyber Security activities are: modifications to Internet networks, contingency planning, or identifying threats and vulnerabilities are needed. Executive Power of the State Law Enforcement The government participates as a stakeholder in several roles. It processes highly sensitive information for the country: of its citizens and of the financial, public security, defense, health, and education sectors, among others. Due to the importance of the information it manages, government needs to keep its systems secure, and is usually the main “client” for a National CSIRT, since it may be the victim of an attack that would have potentially serious consequences. Law enforcement should ensure that cybercrime legislation is implemented in a country. The police conducts cybercrime investigations and often liaise with a National CSIRT in this regard. They can provide valuable information from malicious cyber activity and cooperate with counterparts from other nations’ law enforcement agencies. Law enforcement bodies often maintain a specialized cybercrime unit with procedures and tools needed to collect evidence from cyberattacks. At the same time, governments are responsible for regulation and generating laws, standards, and other initiatives of national importance. In this sense the government is an extremely important instrument for regulatory activities and norms for the prevention of cyber security incidents. Government has the responsibility of determining acceptable risk levels in the aforementioned sectors, including those associated with computer incidents. As such, government acts as a both a CSIRT sponsor and promoter. Ministry of Defense National and international specialized groups Private Sector The private sector is involved from two points of view. On one side are the private companies operating in sectors critical to the state. Their compromise would result in negative consequences to the economy, public safety, and/or national security. On the other side are the many enterprises that manufacture and develop technologies used in IT and information security. Companies that operate critical infrastructures will be key customers, often becoming trusted partners with whom incident response will be closely coordinated. Meanwhile, technology manufacturers collaborate on training, support, updates and vulnerability patching. In both cases interaction with them is essential. In many countries, the Ministry of Defense administers the country’s most valuable or sensitive information. Furthermore, it oversees cyber defense issues, making it a key partner in incident response and CSIRT operations. Financial Sector Legislative Power of the State Besides being a client – in that the National CSIRT may safeguard its networks and information – the legislature creates laws promoting information security, establishes limits for a CSIRT, and is also a key strategic partner. Academia The academic community has much to contribute to a CSIRT. For one, it is often the de facto sector that leads efforts to develop human resources and train young people in various facets of information and computer security. It can also conduct research in the same areas. It is a key partner throughout the lifecycle of a National CSIRT. Judicial Power of the State In addition to strengthening the legal aspects for the criminalization of cybercrime, judicial institutions provide clarity in the areas of law that may affect the operations of the CSIRT. In this sense it is a key stakeholder. Internet Service Providers ISPs allow governments, businesses and citizens to connect to and use the internet. As such, they have a wide range of responsibilities related to internet use and web hosting. They are critical assets in maintaining information security and responding to cyber security incidents. ISP cooperation is key to CSIRT operation, especially where 18 A B C D Definition The financial sector can be subdivided into several subgroups, including: Banks, Central Banks (or regulators), brokerage firms and exchanges. Each of these sectors has particular requirements as partners, customers, and even sponsors. Civil Society Civil society includes professional associations, nonprofit organizations and user groups, among others. These groups not only bring together specific profiles of technicians and professionals but also provide training and guidance and can help with awareness-raising efforts. They are often influential strategic partners. Specialized groups may exist as private or specific CSIRTs at the local and international level, international forums such as FIRST, or multilateral organizations performing cyber security activities like the OAS. All stakeholders will play slightly different roles in the creation, development, and operation of a National CSIRT. They can be roughly grouped according to their contributions: Sponsors or promoters Persons or organizations that promote the existence of a National CSIRT, and will support it either politically or financially. Clients Organizations that will use the services of the National CSIRT. Providers Organizations that provide products and/or services to the national CSIRT, such as tools, professional services, training, etc. Strategic Partners Personnel or organizations that are strategic to the proper development of the CSIRT. In general, these allies execute activities of interest to the CSIRT that it cannot perform on its own. An example might be academia or sector-specific regulators. Influential Individuals or organizations that informally influence different sectors. An example would be civil society actors such as user groups or with nonprofit organizations. The role of each interested party is important to identify, considering that it will define the way in which a CSIRT engages with it. The relationship between the CSIRT and each of its stakeholders will be different and thus imply a different style of interaction. For example, collaboration with an ISP or law enforcement will likely be guided by contracts or official agreements. Partnerships with civil society or government institutions, on the other hand, may be more informal, though no less important. Indeed, they likely require their own type of nuanced interaction. 19