1 PLANNING CSIRT Action Areas There are hundreds of CSIRTs in the world that vary in mission and scope. One of the chief ways to classify CSIRTs is to group them by the sector or community they serve. Below are some of the main types of CSIRTs in operation: CRITICAL INFRASTRUCTURE CSIRTs ACADEMIC CSIRTs These response teams assist academic communities, universities, colleges, schools or institutes. Their size and facilities vary depending on the size of the community, and they frequently partner with other academic CSIRTs and may specialize in research. For a variety of reasons, including human resource limitations or a host of others, some companies elect to outsource CSIRT services instead of internally creating and managing incident response functions. This has spawned a robust market for commercial CSIRTs, which offer incident response services to paying customers. The relationship between a commercial CSIRT and its client is often governed by service level agreements (SLAs), which are necessary to establish incident response guidelines and to ensure information is handled according to the client’s needs. A B C In addition to serving a defined community, a country’s National CSIRT usually takes on the role of national coordinator for incident response, and is the contact point3 for national and international incidents. The role and target community of a national CSIRT varies depending on its roles and the existence of other response centers. For example, if there is no CSIRT designated for critical infrastructure, the national CSIRT could assume responsibilities normally assigned to a critical infrastructure response team.. It can be considered as a “last resort CSIRT,” or one which takes charge of incident response matters that are not under the purview of another body4. It is very common for various CSIRTs to be part of the community the National CSIRT serves. PROVIDER CSIRTs Provider CSIRTs render services relating to specific products from a manufacturer, developer or service provider. The purpose of this type of CSIRT is to mitigate the impact of vulnerabilities or security issues related to their products. Examples include HP CSIRT (Hewlett Packard), Banelco CSIRT (Banelco Bank), or Adobe PSIRT (Adobe) among others. GOVERNMENT CSIRTs COMMERCIAL CSIRTs 14 In some cases, there are CSIRTs specifically established for the protection of critical information assets and the critical infrastructure of a nation, regardless of whether it is operated by the public or private sector, or administering transport, power generation, communications or other processes. Since institutions reporting to of this type of CSIRT can pertain to more than one community (for example, both military and critical infrastructure), it is vital to establish protocols for interaction with other teams involved. NATIONAL CSIRTs D Definition Government CSIRTs serve state institutions in order to ensure that government IT infrastructure and the services it facilitates to citizens have an adequate level of security. Government CSIRTs adapt their structures to the Government. They can meet local, regional or sector-specific government communities. Government CSIRTs can operate independently or interact to combine strategies and efforts and share resources and knowledge. Within a country, for example, the Ministry of Education and the Ministry of Tourism might operate independent CSIRTs, but regularly collaborate and share information. MILITARY SECTOR CSIRTs SMALL/MEDIUM-SIZED ENTERPRISE (SME) SECTOR CSIRTs Military CSIRTs provide services to the military institutions of a country. Their activities are usually limited to the defense, or offensive cyber capabilities, of a nation. In addition to standard incident response technologies, they often have specific ICT knowledge for military use including, for example, weapons and radar systems. The size and nature of SMEs often do not allow them to implement individual incident response teams. Therefore, there is a need to create CSIRTs that understand and address the needs of this business community, such as the one implemented in Spain by the INTECO-CERT Corporation, which focuses on assisting SMEs and citizens. 15