1 Stakeholders Input - Project team A CSIRT is a team of people whose job is to prevent and respond to computer security incidents. Of course, the level and type of response effected by a particular CSIRT will depend on many factors. A frequently referenced analogy, one first put forth by Carnegie Mellon University, draws comparison between CSIRTs and firefighters. As explained by CMU’s CSIRT Handbook, in the same way that a team of firefighters responds to a fire emergency, so must a CSIRT respond to and manage a computer incident. Going further, the analogy holds that in addition to their response duties, fire crews perform preventive activities such as education, risk analysis or the promotion of regulations. CSIRTs also carry out these types of preventative activities. Finally, fire crews often investigate how and why a fire occurred in order to prevent it from happening again. Almost all CSIRTs perform investigative functions, regardless of their classifications. As mentioned above, a CSIRT can have different organizational forms: it may be an independent institution, private or public, a department of another organization or just a group of people distributed in different organizations. Each CSIRT defines how it will perform its activities. It may need to go to the scene of an incident to perform a response, or otherwise can remotely oversee incident management by coordinating with other stakeholders and obtaining evidence and log files through means other than physical transfer. 16 A B C D Definition PLANNING The role of a National CSIRT As previously described, a National CSIRT acts as a country’s point of contact at the international level. For example, if a CSIRT from country “A” detects malicious traffic originating from a bank in country “B,” it would send a communication to the National CSIRT from country “B,” which would then work directly to address the source of the malicious traffic and resolve the issue. In this example, it is also important to note that in addition to receiving the request from CSIRT “A,” CSIRT “B” then coordinates the incident response process that takes place within its own stakeholder community. These are the two most important roles of a National CSIRT: to act as the country’s contact point internationally for cyber security matters and to coordinate and perform computer security incident response activities nationwide. In establishing a CSIRT, officials often focus solely on technical incident response capacities as opposed to broader organizational concerns. To ensure that both principal objectives of National CSIRTs are addressed, significant portions of this guide are dedicated to planning and developing a model in which the National CSIRT effectively partners with necessary stakeholders. Indeed, to lead, articulate and coordinate incident response actions and norms, a National CSIRT must first devise clear goals, objectives, and strategies, and subsequently inform all relevant parties of the same. Tools - Brainstorming - Mental maps - Analysis of stakeholders Output - List of stakeholders and their roles, interests, support and influence over the project To plan a National CSIRT, the first step a team must take is to identify stakeholders. As explained before, the main role of a national CSIRT is to coordinate with stakeholders in the country on cyber security incident the response activities. For this reason it is essential to clearly identify the stakeholders. Stakeholders are the people or organizations that will be affected in some way by the implementation of a National CSIRT. These parties will have different levels of interest in the project, a specific role in the lifecycle of the national CSIRT, and a given level of power over the project implementation and operation of the CSIRT. Once the stakeholders are identified, they can be classified according to their role, responsibilities and interest regarding the CSIRT initiative. Then, a strategy will be developed to engage with and manage them. Stakeholders are people or organizations that will be affected in some way by the implementation of a National CISRT 17