Prerequisites for building a Computer Security Incident Response capability

Computer Security Incident Response Teams (CSIRTs) provide information security incident response services to communities. The South African Cybersecurity Hub (SACH) acts as a national point of contact for the coordination of cybersecurity incidents in South Africa, but to date has only been successful in assisting with the establishment of a finance sector CSIRT. No mention of a transport or critical infrastructure sector CSIRT, under which an aviation CSIRT can report aviation sector cyber-attacks is made. The aviation community is mandated to sustain safety and security of operations and passengers in Southern Africa. Acknowledging the urgency and importance of protecting civil aviation’s critical infrastructure, information and communication technology systems and data against cyber threats this research identifies that there is a need for a CSIRT framework for the Sub-Saharan aviation community. An aviation CSIRT should implement frameworks, programs and international information security standards, and aviation communities need to share cyber information with the CSIRT. To achieve such a framework, globally established CSIRTs are reviewed. Since the aviation sector is complex to manage, there is a need to establish an integrated CSIRT approach that include stakeholders within the ecosystem. A proposed aviation CSIRT requires the adoption of best practice cyber security incident response standards as a practical solution to manage aviation cyberattacks.

Cyber attacks are one of the genuine threats that have emerged due to the evolution of a more dynamic and complex global strategic environment. In Indonesia, several cyber attacks target various government infrastructure sectors. The National Cyber and Crypto Agency (BSSN) predicts Indonesia will face approximately 370.02 million cyber attacks in 2022. The majority of cyber attacks target the government administration sector. The National Cyber and Crypto Agency (BSSN) officially formed a Computer Security Incident Response Team (CSIRT) to tackle the rampant cybercrime cases. CSIRT is an organization or team that provides services and support to prevent, handle, and respond to computer security incidents. The current CSIRT does not have a data storage process and forensic preparation. CSIRT will repeat the procedure, and so on. This is a repeating procedure; the attack will occur once, and only a technical problem will arise. Therefore, the research entitled "Analysis of Knowledge Management Strategies for Handling Cyber Attacks with the Computer Security Incident Response Team (CSIRT)" is expected to implement this Knowledge Management Strategy to manage existing knowledge so that it can make it easier for the CSIRT team to handle cyber attacks that occur.

This article proposes a message format for sharing information between Computer Security Incident Response Team (CSIRT) and Intrusion Detection Systems (IDS), aiming the achievement of an automatic update of the response action data base in IDSs, based on restrictive short-term measures suggested in security alerts issued by CSIRTs. This model is based on Web services and Extensible Markup Language (XML) technologies. It is also presented a data format to these security alerts as an extension of the Common Alerting Protocol.. Intrusion Detection Systems (IDS) are systems composed of software or hardware which automate the monitoring process of events that occur in a computing system or network, with the aim of identifying signs of security problems (1). Mechanisms which allow exchanging information between an IDS and a Computer Security Incident Response Team (CSIRT) are necessary. Thus, a better understanding of events surrounding the protected domain allowing the prevention and response measures are taken. In this work, it is proposed a model for sharing information between CSIRT and IDS, aiming to make it possible for an IDS to update automatically its response action data base, based on short-term restrictive measures suggested in security alerts issued by CSIRT, using Web services (10) and XML (9) technologies.

When a computer security attack on an organization occurs, an intrusion is recognized, or some other kind of computer security incident occurs, it is critical for the organization to have a fast and effective means of responding. One method of addressing this need is to establish a formal incident response capability or a Computer Security Incident Response Team (CSIRT). When an incident occurs, the goal of the CSIRT is to control and minimize any damage, preserve evidence, provide quick and efficient recovery, prevent similar future events, and gain insight into threats against the organization. This handbook describes different organizational models for implementing incident handling capabilities, including each model's advantages and disadvantages and the kinds of incident management services that best fit with it. An earlier SEI publication, the Handbook for Computer Security Incident Response Teams (CSIRTs) (CMU/SEI-2003-HB-002), provided the baselines for establishing incident response capabilities. This new handbook builds on that coverage by enabling organizations to compare and evaluate CSIRT models. Based on this review they can then identify a model for implementation that addresses their needs and requirements.

At present, the Colombian government shares information on threats or vulnerabilities in the area of cybersecurity and cyberdefense, from other government agencies or departments, on an ad-hoc basis but not in real time, with the surveillance entities of the Government of the Republic of Colombia such as the Joint Command of Cybernetic Operations (CCOCI) and the Cybernetic Emergencies Response Team of Colombia (ColCERT). This research presents the MS-CSIRT (Management System Computer Security Incident Response Teams) methodology, that is used to unify the guidelines of a CSIRT towards a joint communication command in cybersecurity for the surveillance of Information Technology (IT), Technological Operations (TO), Internet Connection Sharing (ICS) or Internet of Things (IoT) infrastructures. This methodology evaluates the level of maturity, by means of a roadmap, to establish a CSIRT as a reference framework for government entities and as a guide for the areas of information security, IT and TO to strengthen the growth of the industry 4.0. This allows the organizations to draw a line of cybersecurity policy with scope, objectives, controls, metrics, procedures and use cases for the correct coordination between ColCERT and CCOCI, as support entities in cybersecurity, and the different companies (ICS, IoT, gas and energy, mining, maritime, agro-industrial, among others) or government agencies that use this methodology.

When computer security incidents occur, it's critical that organizations be able to handle them in a timely manner. The speed with which an organization can recognize, analyze, and respond to an incident will affect the damage and lower recovery costs. Organized incident management requires defined, repeatable processes and the ability to learn from incidents that threaten the confidentiality, availability, and integrity of critical systems and data. Some organizations assign responsibility for incident management to a defined group of people or a designated unit, such as a computer security incident response team. This article looks at the development, purpose, and evolution of such specialized teams; the evolving nature of attacks they must deal with; and methods to evaluate the performance of such teams as well as the emergence of information sharing as a core service.

The article is devoted to the study of the Italian cybersecurity architecture, the strategy and organizational principles of protecting the country’s critical infrastructure, and the logic of technical, legal, and institutional innovations in the field of cyber defense of the Italian Republic. It has been established that Italy took its first regulatory steps on cybersecurity relatively late compared to other European countries – in 2013 (‘Monti Decree’). The second Italian cybersecurity strategy (‘Gentiloni Decree’) aimed to streamline the institutional cybersecurity ecosystem in accordance with the requirements of the European ‘Network and Information Security (NIS) Directive’. An analysis of the evolution of Italian cybersecurity suggests that between the 2013 and 2018 strategies, most of the changes concerned the institutional framework (reduction of the number of actors with overlapping functions; centralization of the structure) rather than the formulation of cybersecurity policy. In accordance with the ‘NIS Directive’, a national team was established to respond to computer incidents (‘Computer Security Incident Response Team’, CSIRT). It was noted that the further development of a consistent and comprehensive legal framework in the field of cybersecurity was facilitated by the creation of the so-called ‘national cybersecurity perimeter’ (‘Perimetro di Sicurezza Nazionale Cibernetica’). Lawmakers have clearly defined ‘critical technologies’: artificial intelligence, robotics, semiconductors, cybersecurity, aerospace, defense, energy storage, quantum, nuclear, nano- and bio-technologies. It was noted that in recent years, Italy has strengthened its cyber defense capabilities by creating the National Cyber Security Agency (ACN), which was tasked with implementing the new (third) National Cyber Security Strategy for 2022–2026. The authors believe that the wide range of measures provided for by Italian legislation largely complies with the cybersecurity requirements developed by EU institutions. It is concluded that flexible national legislation based on government decrees avoids excessive regulatory framework, as it can be amended easily and relatively quickly.

Cybersecurity in the Energy sector and relevant information sharing is at the foremost of European strategy towards the digital decade targeted by the EC for the years to come. The proposed Pan-European Incidents Information Sharing Platform (I2SP) offers a cyber-shield armour to European Electrical Power and Energy Systems (EPES) enabling cooperative detection of large scale, cyber-human security and privacy incidents and attacks. Via Incidents Information Sharing Platform, early detection and appropriate mitigation, guarantees the continuity of operations and minimization of cascading effects in the infrastructure itself, the environment, the citizens and the end-users.The Incidents’ Information Sharing Platform (I2SP) constitutes the software package which enables secure Cyber-Threat Intelligence (CTI) information sharing among EPES participants, as well as with trusted nominated entities, such as Information Sharing and Analysis Centers (ISACs), Computer Security Incident Response Teams (CSIRTs) and Security Operations Centers (SOC). I2SP facilitates technical information sharing in view of a warning system and incident reporting across the EU, aligning with the pillars of the new Network Code on Cybersecurity.

A problem shared is a problem halved: A survey on the dimensions of collective cyber defense through security information sharing

Computer security incident response teams typically rely on threat intelligence platforms for information about sightings of cyber threat events and indicators of compromise. Other security building blocks, such as Network Intrusion Detection Systems, can leverage the information to prevent malicious adversaries from spreading malware across critical infrastructures. The effectiveness of threat intelligence platforms heavily depends on the willingness to share among organizations and the responsible use of sensitive information that may potentially harm the reputation of the reporting organization. The challenge that we address is the lack of trust in the source providing the threat intelligence and the information itself. We enhance our security framework TATIS—offering fine-grained protection for threat intelligence platform APIs—with distributed ledger capabilities to enable reliable and trustworthy threat intelligence sharing with the ability to audit the provenance of threat intelligence. We have implemented and evaluated the feasibility of our distributed framework on top of the Malware Information Sharing Platform (MISP) solution, and we evaluate the performance impact using real-world open-source threat intelligence feeds.

Although the Czech Republic belongs to the most “internetised” countries in the world, its information and communication security policy (as well as the protection of the critical information infrastructure) lagged behind for a relatively long time, when compared to most of the remaining European countries. Building the hierarchy regarding the umbrella teams of the Cybernetic Emergency Response Teams (CERT) and Computer Security Incident Response Teams (CSIRT) type (regardless of whether we call them governmental, national or otherwise) was unthinkable without the contribution of the private sector that substituted many functions of the state in this field. The whole process can be understood as an interaction of international and national pressures appealing to the solution of the situation.

This article introduces the importance of process during the investigation and the acquisition phases of logical/physical artifacts which may be required during the course of such professional engagement. The article then focuses on the necessity to have a robust supportive framework in a state of preparedness to facilitate the First Responders and CSIRT (Computer Security Incident Response Team) with the necessary underpin to support such investigative engagements – considering effective and pragmatic Policies, Case Management, operational Security Protocols (Run-Books) and all other necessary attributes to underpin a professional, prepared posture from which a team may effectively, and robustly engage an investigation/incident. To elaborate on the importance of such an approach, we outline a number of real-world cases where ineffective processes and controls were applied. Finally, we review the essential elements of securely managing case-related data, and the absolute need to apply security mechanisms such as Certified Standards of FIPS-140-2 encryption to secure sensitive case related assets to assure they are robustly protected at all stages of their life cycle when they are in physical transit, or when they are at rest, associated with a desk-bound PC. The end objective to the entire article is to stress an absolute need to apply process to, as far as is practicable, to achieve positive conclusions from any investigation or incident which has been engaged.

Incident response (IR) is an integral part of today’s computer security infrastructure both at the public and private sectors. The process involves identification of the critical resources, proposing plans for responding to potential breaches and executing effective containment and recovery procedures. The current practices emphasize establishing careful response plans, building technical capabilities and following disciplined procedures for plan execution. This research builds on the above by adding another dimension to the process, namely performance evaluation. Proposing a framework for the performance analysis of computer security incident response (CSIR) capabilities is the main focus of this research. The various design considerations and challenges to performance analysis of CSIR are investigated. A multidisciplinary survey is conducted to derive lessons learnt and best practices for the design of performance systems. The outcomes of the survey are integrated to the CSIR discipline to produce a development process for constructing performance evaluation models. For each development step, the various design possibilities are investigated to ensure flexibility and applicability to the wide spectrum of CSIR environments. Expert feedback is used as a method of design validation to ensure conformance to current CSIR best practices. Issues pertaining to how performance evaluation could be incorporated into the current industry practices are also explored. As a notable contribution, the study produces the definition and design considerations for fifty performance indicators that cover the diverse performance aspects of computer security incident response systems.

Medical–Legal Considerations in the Medical Spa Environment

With the rapid growth and adoption of web-based technologies, more and more service providers offer various services on the web. This can facilitate the organizations to develop business applications using web services composition over the Internet according to their business requirements. The primary requirement for developing composite web service is to discover the most relevant web service for realizing each function of the required composite web service. Finding the most relevant web service is still a challenging task. In this paper, we propose web service discovery approach that incorporates web services clustering. Clustering technique combines latent Dirichlet allocation(LDA) and k-Medoids and reduces search space for web service discovery. Web service discovery uses a match-making algorithm that utilizes WordNet database and Hungarian method to compute the semantic similarity score for a web service based on the requested query. Experimental results show that the proposed approach performs better than LDA-based approach.