text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: https://www.enisa.europa.eu/publications#c8=CSIRTs 2 https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/

text: December 2020

text: https://www.enisa.europa.eu/publications/study-on-csirt-landscape-and-ir-capabilities-in-europe-2025 4 https://www.enisa.europa.eu/publications/eu-ms-incident-response-development-status-report 5 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.194.01.0001.01.ENG&toc=OJ:L:2016:194:TOC

text: December 2020

text: CERT, or computer emergency response team, is the oldest term and has been trademarked by the Software Engineering Institute (SEI) at Carnegie Mellon University (CMU). See CSIRT definition for example at “Baseline capabilities for national / governmental CERTs” https://www.enisa.europa.eu/publications/baseline-capabilities-for-national-governmental-certs 8 https://www.first.org/standards/frameworks/csirts/csirt_services_framework

text: December 2020

text: December 2020

text: December 2020

text: https://www.enisa.europa.eu/publications#c8=CSIRTs https://www.enisa.europa.eu/publications/csirt-setting-up-guide 11 https://www.enisa.europa.eu/publications/good-practice-guide-for-incident-management 12 https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/ 13 https://www.enisa.europa.eu/publications/national-governmental-certs-enisas-recommendations-on-baseline-capabilities 14 https://www.enisa.europa.eu/topics/csirts-in-europe/csirt-capabilities/csirt-maturity 15 https://www.enisa.europa.eu/publications/support-the-fight-against-cybercrime-roadmap-on-csirt-le-cooperation 16 https://www.enisa.europa.eu/publications/electronic-evidence-a-basic-guide-for-first-responders

text: December 2020

text: In this report ‘establishment’ refers to a CSIRT’s path from a conceptual idea to a strong and mature CSIRT several years later or to advancing an existing CSIRT into further development stages.

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: https://www.btcirt.bt/wp-content/uploads/2016/01/BtCIRT-Mandatep2.pdf 19 https://www.cirt.gov.bd/wp-content/uploads/2016/08/Government-Mandate-of-BGD-e-GOV-CIRT.pdf

text: December 2020

text: December 2020

text: When using Open source solutions CSIRT needs to take into consideration who is managing and updating particular solution

text: December 2020

text: https://www.enisa.europa.eu/topics/csirts-in-europe/csirt-capabilities/csirt-maturity/csirt-maturity-self-assessment-survey 22 https://sim3-check.opencsirt.org/ 23 https://tools.ietf.org/html/rfc2350

text: December 2020

text: An iSOC is an integrated SOC, for example in the energy sector, combining an operational technology (OT) SOC and an IT SOC. 25 A gSOC is a global or government SOC. 26 A PSIRT is a product security incident response team. 27 https://www.first.org/standards/frameworks/psirts/psirt_services_framework_v1.1 28 https://www.first.org/members/teams/ 29 https://www.trusted-introducer.org/directory/teams.html 30 https://www.enisa.europa.eu/topics/csirts-in-europe/csirt-inventory/certs-by-country-interactive-map 31 https://www.sei.cmu.edu/education-outreach/license-sei-materials/authorization-to-use-cert-mark/

text: December 2020

text: https://www.first.org/standards/frameworks/ 33 https://www.axelos.com/best-practice-solutions/itil

text: December 2020

text: https://www.enisa.europa.eu/topics/csirts-in-europe/csirt-capabilities/csirt-maturity 35 https://www.soc-cmm.com/

text: December 2020

text: Process name Security incident management

text: Description Security incident management covers incident report registration, triage, incident resolving and incident closing Process owner Security incident manager Purpose To ensure that every incident detected is handled according to defined quality requirements and that response activities are carried out to mitigate any incidents, followed by actions to improve security measures; and to increase the maturity of the constituent’s security processes so that it is more resilient to cyberthreats in the future Service input/triggers 1. Events detected by security monitoring service activities 2. Incident reports registered by:

text: December 2020

text: 2.1. Phone 2.2. E-mail 2.3. Online web form 2.4. Service desk self-service interface Service 1. Assistance to constituents to mitigate security incidents

text: Provision of guidelines for improving the security of the constituent’s infrastructure Service activities 1. Triage of the security incident 2. Analysis of the security incident 3. Guide the containment of the security incident 4. Guide eradication and recovery after the incident 5. Close the incident 6. Lessons learned

text: Process name Security monitoring

text: Description Event data from the security monitoring infrastructure are processed and analysed for incident detection Process owner Security monitoring manager Purpose To detect malicious and suspicious activities in a timely manner Service input/triggers 1. Events detected by the security monitoring infrastructure 2. Alerts from the threat intelligence platform Service 1. Provide alerts to constituents about security incidents

text: Register incidents in the security incident management process 3. Data for threat hunting process activities Service activities 1. Observe alerts 2. Register incidents 3. Escalate incidents to the incident handling team

text: December 2020

text: Containment guidelines Objective: Advise the constituency and coordinate its efforts and participate in investigations of critical incidents 1. Advise the constituency to involve law enforcement authorities in the investigation 2. For incidents with a high level of criticality, consider sending the CSIRT to conduct an investigation in place or ask for logs to be shared and conduct the investigation at the CSIRT’s premises. Share the findings with the constituency 3. Advise the constituency to: 3.1. Analyse logs 3.2. Find out the incident root cause 3.3. Assess for damage 3.4. Block malicious IP and DNS addresses 3.5. Implement quick workarounds 4. Evaluate the risk to other infrastructures and share anonymised incident details with the constituency 5. Look for recent similar incidents, evaluate the situation and, if necessary, raise the criticality level. Inform management about suspicious repeated intrusions Mitigation guidelines Objective: Help the constituency to find and fix the root cause of the incident, preserving any forensic evidence 1. Advise the constituency to: 1.1. Apply patches 1.2. Replace outdated and unsupported systems 1.3. Implement permanent workarounds 1.4. Implement best security practices 2. For high criticality incidents, request detailed investigation reports or offer resources to ensure proper incident analysis Recovery guidelines Objective: Support constituencies when returning to normal operations after the incident and lift temporary preventive measures 1. In the case of a high criticality incident, conduct a security assessment to evaluate the effectiveness of mitigation measures 2. Organise seminars for security personnel and explain common intrusion methods and mitigation strategies 3. Once a year conduct a technical cybersecurity exercise or training in a real-life environment

text: December 2020

text: https://niccs.us-cert.gov/workforce-development/cyber-security-workforceframework/workroles?name=Cyber+Defense+Incident+Responder 37 National Institute of Standards and Technology National Initiative for Cybersecurity Education https://www.nist.gov/itl/applied-cybersecurity/nice

text: December 2020

text: Networking Internet History, Technology, and Security Coursera with the University fundamentals (https://www.coursera.org/learn/internet-history) of Michigan

text: Networks, ICT CSX fundamentals and additional practice ISACA concepts, (https://www.isaca.org/credentialing/cybersecurity/csxcybersecurity fundamentals-certificate)

text: Security+ CompTIA (https://certification.comptia.org/certifications/security)

text: Systems Security Certified Practitioner (SSCP) (ISC)² (https://www.isc2.org/Certifications/SSCP)

text: Information Security Foundation (https://www.seco- SECO Institute institute.org/certifications/information-security-certificationtrack/information-security-foundation-online-course/)

text: IT Security Foundation (https://www.secoinstitute.org/certifications/it-security-certification-track/itsecurity-foundation-online-course/)

text: https://www.enisa.europa.eu/topics/trainings-for-cybersecurity-specialists/online-training-material 39 https://www.first.org/education/trainings 40 https://www.geant.org/Services/Trust_identity_and_security/Pages/TRANSITS_Training.aspx

text: December 2020

text: IT Security Practitioner (https://www.secoinstitute.org/certifications/it-security-certification-track/itsecurity-practitioner-online-course/)

text: SEC301: Introduction to Cyber Security SANS (http://www.sans.org/course/intro-information-security)

text: Incident handling TRANSITS I (https://tf-csirt.org/transits/transits- GEANT basics events/transits-i/)

text: Foundations of Incident Management Software Engineering (https://www.sei.cmu.edu/education- Institute outreach/courses/course.cfm?courseCode=P139)

text: Networking Cisco Certified Networking Associate (CCNA) Cisco fundamentals (https://learningnetwork.cisco.com/s/ccna)

text: Technical practice ISACA CSX Cybersecurity Practitioner (CSX-P) ISACA of cybersecurity (https://nexus.isaca.org/products/145)

text: Incident handling Certified Incident Handler (ECIH) EC-Council (https://www.eccouncil.org/Certification/ec-council-certifiedincident-handler; http://iclass.eccouncil.org/?p=728)

text: SOC Analyst (https://www.seco-institute.org/certifications/it- SECO Institute security-certification-track/soc-analyst-online-course/)

text: TRANSITS II (https://tf-csirt.org/transits/transits- GEANT events/transits-ii/)

text: SEC504: Hacker Tools, Techniques, Exploits and Incident SANS Handling (https://www.sans.org/course/hacker-techniquesexploits-incident-handling)

text: Penetration Certified Ethical Hacker (CEH) EC-Council testing (https://www.eccouncil.org/Certification/certified-ethicalhacker; http://iclass.eccouncil.org/?p=719)

text: SEC560: Network Penetration Testing and Ethical Hacking SANS (http://www.sans.org/course/network-penetration-testingethical-hacking)

text: Ethical Hacking Foundation (https://www.seco- SECO Institute institute.org/certifications/ethical-hacking-certificationtrack/ethical-hacking-foundation-online-course/)

text: Ethical Hacking Practitioner (https://www.secoinstitute.org/certifications/ethical-hacking-certificationtrack/ethical-hacking-practitioner-online-course/)

text: Security Certified Information Systems Security Professional (ISC)² architecture (https://www.isc2.org/cissp/default.aspx)

text: Advanced FOR508: Advanced Incident Response, Threat Hunting, SANS incident handling and Digital Forensics (https://www.sans.org/course/advanced-incident-responsedigital-forensics)

text: Advanced FOR572: Advanced Network Forensics: Threat Hunting, SANS incident response Analysis, and Incident Response (https://www.sans.org/course/advanced-network-forensicsanalysis)

text: December 2020

text: FOR578: Cyber Threat Intelligence SANS (https://www.sans.org/course/cyber-threat-intelligence)

text: Certified Threat Intelligence Analyst EC-Council (https://www.eccouncil.org/programs/certified-threatintelligence-analyst-ctia/)

text: Diamond Model of Intrusion Analysis Threat Intelligence Academy (https://school.threatintel.academy/collections)

text: iLabs CEH iLabs CEH provides virtual machines preconfigured with vulnerabilities, Senior analyst exploits, tools and scripts. This is a cloud-based subscription service from EC-Council designed to deliver hands-on practice to information security professionals. The iLabs CEH portal enables a course participant to launch an entire range of target machines and access them remotely. This product consists of 6 months’ access to the EC- Council virtual laboratory environment for certified ethical hackers. See https://store.eccouncil.org/product/ilabs-ceh and https://www.youtube.com/watch?v=iU_7zKypJZI for further information

text: iLabs CTIA See https://store.eccouncil.org/product/ilabs-ctia/ for further information Senior analyst

text: ISACA CSX Laboratory classes from ISACA on different technical topics. See Analyst laboratories https://nexus.isaca.org/products for further information

text: Damn Vulnerable DVWA is a PHP/MySQL web application that is vulnerable. Its main Analyst Web Application goals are to be an aid for security professionals to test their skills and (DVWA) tools in a legal environment, help web developers better understand the processes of securing web applications and help teachers/students to teach/learn web application security in a classroom environment. See http://www.dvwa.co.uk/ for further information

text: Investigation See https://www.networkdefense.io/library/the-analyst- Analyst Theory mindset/110302/about/ for further information

text: ELK for Security See https://www.networkdefense.co/courses/elk/ for further information Analyst

text: December 2020

text: Conflict KSAs that relate to managing and resolving conflicts, grievances, confrontations or management disagreements in a constructive manner to minimise negative personal impacts; collaborates with others to encourage cooperation and teamwork Critical thinking KSAs that relate to the objective analysis of facts to form a judgment Interpersonal KSAs that relate to developing and maintaining effective relationships with others, and skills relating well to people from varied backgrounds and different situations; considering and responding appropriately to the needs, feelings and capabilities of subordinates, peers and seniors Oral KSAs that relate to the process of expressing information or ideas by word of mouth

text: Presenting KSAs that relate to activities in which someone shows, describes or explains something to effectively an audience Written KSAs that relate to process of expressing information or ideas by word of mouth

text: Project KSAs that relate to the principles, methods or tools for developing, scheduling, coordinating management and managing projects and resources, including monitoring and inspecting costs, work and contractor performance Strategic planning KSAs that relate to formulating effective strategies consistent with the objective, vision and competitive strategy of the organisation and/or business unit Teaching others KSAs that relate to imparting knowledge of or giving information about or instruction in (a subject or skill) Workforce KSAs that relate to the activities needed to maintain a productive workforce

text: Business KSAs that relate to the planning and preparation carried out by a company to ensure it continuity overcomes serious incidents or disasters and resumes its normal operations within a reasonably short time period Client relationship KSAs that relate to the concepts, practices and techniques used to identify, engage in, management influence and monitor relationships with individuals and groups connected to a work effort, including those actively involved, those who exert influence over the process and its results, and those who have a vested interest in the outcome (positive or negative) Contracting/procu KSAs that relate to various types of contracts, techniques for contracting or procurement, rement and contract negotiation and administration

text: December 2020

text: Data privacy and KSAs that relate to the relationship between the collection, storage and dissemination of protection data while simultaneously protecting individuals’ privacy

text: External KSAs that relate to identifying and understanding how internal and external issues (e.g. awareness economic, political and social trends) impact the work of the organisation

text: Legal, KSAs that relate to laws, regulations, policies and ethics that can impact organisational government and activities

text: Organisational KSAs that relate to understanding an organisation’s mission and functions, its social and awareness political structure and how programmes, policies, procedures, rules and regulations drive and impact the work and objectives of the organisation

text: Policy KSAs that relate to the process of creating, communicating and maintaining policies and management procedures within an organisation

text: Process control KSAs that relate to the active changing of a process based on the results of process monitoring

text: Risk management KSAs that relate to the methods and tools used for risk assessment and mitigation of risk Third-party KSAs that relate to the process of analysing and controlling risks presented to your oversight/acquisit company, data, operations and finances by parties other than your own company

text: ion management

text: December 2020

text: https://www.iso.org/isoiec-27001-information-security.html 42 https://www.wbdg.org/FFC/ARMYCOE/FIELDMAN/fm31930.pdf

text: December 2020

text: https://tf-csirt.org/membership/why-listed/ 44 https://www.trusted-introducer.org/processes/registration.html 45 https://www.trusted-introducer.org/processes/accreditation.html 46 https://www.trusted-introducer.org/processes/certification.html 47 Information Sharing and Analysis Centres see https://www.enisa.europa.eu/topics/national-cyber-securitystrategies/information-sharing

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: CSIRT requires

text: Automation of automation of registration

text: incident 150 000 4 and routing of incidents Yes

text: detection from public sources and

text: internal networks

text: Honeypots provide

text: Honeypot visibility into who is 80 000 6 Yes initiative attacking networks and

text: Design, Constituency lacks timely

text: implementation and focused awareness of

text: and 1-year contextual information; 75 000 3 Yes operation of an thus, it has limited

text: awareness resilience to social and

text: service technical attacks

text: CSIRT handles sensitive

text: data and thus must ensure

text: ISO 27001

text: 000 8 that internal information Yes

text: security processes are

text: operating well

text: Postponed until the

text: following year as the

text: Required for a few number of cases DFIR laboratory 250 000 12 incidents requiring digital

text: forensic analysis is

text: Clear and detailed Postponed until the procedural instructions SOP following year 60 000 4 result in fewer errors in development because of lack of operations and faster resources learning for new personnel

text: Threat Postponed until the

text: intelligence following year; Improve quality with automation and unable to currently 60 000 3 regard to the detection commercial consume data and analysis of incidents provider of properly because of

text: information lack of staff

text: Increased maturity allows Attaining SIM3 Postponed until the the provision of better- ENISA/Global following year as quality services in a more CSIRT Maturity allocation of key streamlined and uniform Framework 40 000 5 internal expert way and a reduction in (GCMF) resources is defect rates, and intermediate required to carry out increases trust and the level the improvements reputation of the CSIRT

text: Figures for illustrative purpose only.

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020 49

text: December 2020 50

text: December 2020 51

text: December 2020 52

text: December 2020 53

text: December 2020 54

text: December 2020

text: Local Acronym Title of Publication

text: FRST Computer Security Incident Response Team (CSIRT) Services Framework, FIRST, 2019. A Step-By-Step Approach On How To Set Up a CSIRT, European Union Agency for

text: Network and Information Security, 2006. THAI Establishing a CSIRT, ThaiCERT, 2017. Best Practices for Establishing a National CSIRT, The Organization of American States,

text: 2016. National CSIRTs and Their Role in Computer Security Incident Response, New America

text: and GPPi, 2015. GPPI1 CSIRT Basics for Policy-Makers, New America and GPPi, 2015. GFCE Global Good Practices: National Computer Security Incident Response Teams

text: (CSIRTs), TNO, 2017. CMU1 Create a CSIRT, Carnegie Mellon University, 2016. MITRE Ten Strategies of a World-Class Cybersecurity Operations Center, MITRE, 2014. SIM3: Security Incident Management Maturity Model, S-CURE bv and PRESECURE

text: GmbH, 2015. NL1 CSIRT Maturity Kit, National Cyber Security Centre, The Netherlands, 2015. NL2 Building a SOC: start small, National Cyber Security Centre, The Netherlands, 2017. RFC RFC 2350 for CSIRT establishments, IETF, 1998. Common and Best Practices for Security Operations Centers: Results of the 2019 SOC

text: Survey, SANS, 2019. Best Practice Forum on Establishing and Supporting Computer Security Incident Response

text: Teams (CSIRT) for Internet Security, Internet Governance Forum, 2014. ITU ITU CIRT Framework, ITU-D, 2020.

identifier: How to set up CSIRT and SOC

amnesord: EU incident response and cyber crisis management

nummer: how-to-set-up-csirt-and-soc

title: How to set up CSIRT and SOC

text: HOW TO SETUP UP CSIRT AND SOC

text: GOOD PRACTICE GUIDE DECEMBER 2020 0 HOW TO SETUP UP CSIRT AND SOC

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

text: CONTACT

text: For queries in relation to this study, please use: csirt-relations@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu.

text: AUTHORS

text: Edgars Taurins, ENISA. Activities supporting this study were conducted under contract with NRD Cyber Security.

text: ACKNOWLEDGEMENTS

text: Study was performed with the input from Informal Expert Group on EU Member States Incident Response Development.

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 2019/881

text: . This publication does not necessarily represent state-of-the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: Copyright notice

text: © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged.

text: For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: ISBN 978-92-9204-410-7 - DOI 10.2824/056764

text: HOW TO SETUP UP CSIRT AND SOC

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 5

text: 1.1 CONTEXT OF THE WORK 5

text: 1.2 OBJECTIVES OF THE WORK 5

text: 1.3 OVERVIEW OF THE METHODOLOGY 6

text: 1.4 DEFINITIONS OF CSIRT AND SOC 6

text: 1.4.1 Computer security incident response teams 6 1.4.2 Security operations centres 7

text: 1.5 PREVIOUS ENISA WORK ON THE TOPIC OF CSIRTS 9

text: 2. GUIDELINES FOR ESTABLISHING CSIRTS 10

text: 2.1 ORGANIZATION OF THE GUIDELINES 10

text: 2.2 ASSESSMENT FOR READINESS 13

text: 2.2.1 Preliminary mandate 14 2.2.2 Governance structure 16 2.2.3 Identification of the CSIRT hosting organisation 16 2.2.4 High-level roadmap and budget 16 2.2.5 Detailed requirements for the design stage 18

text: 2.3 DESIGN 19

text: 2.3.1 Approved detailed mandate 19 2.3.2 CSIRT services plan 20 2.3.3 CSIRT processes and workflows plan 21 2.3.4 CSIRT organisation, skills and training structure plan 26 2.3.5 CSIRT facilities plan 31 2.3.6 CSIRT technologies and processes automation plan 32 2.3.7 CSIRT cooperation plan 33 2.3.8 CSIRT IT and information security management plan 34 2.3.9 Detailed requirements for the implementation stage 34

text: 2.4 IMPLEMENTATION 34

text: 2.4.1 Approval and implementation of the organisational structure 34 2.4.2 Hiring and appointing of staff 35 2.4.3 Execution of a training plan for different staff roles 35 2.4.4 Preparation of facilities 35 2.4.5 Development and implementation of detailed processes and procedures 35 2.4.6 Implementation of technology for the automation of processes 35 2.4.7 Implementation of IT and information security management procedures 35 2.4.8 Training of staff for CSIRT operations 36

text: HOW TO SETUP UP CSIRT AND SOC

text: 2.4.9 Signing of relevant agreements with the constituency, stakeholders and partners 36 2.4.10 Test run of CSIRT services and tuning of results 36 2.4.11 Launch of CSIRT communications and celebrations 36

text: 2.5 OPERATIONS 37

text: 2.5.1 Measurement of key performance indicators 37 2.5.2 Annual operations performance review 38 2.5.3 Annual stakeholder needs review 38 2.5.4 Approval of the annual budget 38 2.5.5 Collection of improvement initiatives 38

text: 2.6 IMPROVEMENT 38

text: 2.6.1 List of improvement initiatives 38 2.6.2 Detailed plans for improvement initiatives for the design stage 40 2.6.3 Preliminary budget for improvement initiatives 40

text: 3. CONCLUSIONS 41 4. GLOSSARY AND ACRONYMS 42 5. BIBLIOGRAPHY 43 A ANNEX: QUESTIONNAIRE 44 6. B ANNEX: METHODOLOGY MAPPING 48 HOW TO SETUP UP CSIRT AND SOC

text: EXECUTIVE SUMMARY

text: This publication provides results-driven guidance for those who are interested in establishing a computer security incident response team (CSIRT) or security operations centre (SOC), and guidance on possible improvements for different types of CSIRTs and SOCs that exist currently.

text: The content of this report is based on an analysis of current publications on the establishment of CSIRTs (the analysis is summarised in Annex B); a field questionnaire (Annex A), which was completed by 40 CSIRTs and SOCs; and the authors’ experiences in establishing and improving CSIRTs as part of numerous projects carried out in Europe, Asia, Africa and South America.

text: A results-driven approach is taken throughout the publication to provide guidance on the different stages involved in the establishment of a CSIRT or SOC organisation:

text:  Assessment for readiness  Design  Implementation  Operations  Improvement.

text: The reader will receive practical guidance on what to focus on during the individual phases of establishment and improvement.

text: Up to July 2020, ENISA had published 61 reports and 21 translated versions of reports 1 2 supporting CSIRTs on its website ( ). ENISA’s training package ( ) provides online training materials, training courses and exercise materials for cybersecurity specialists, based on the ‘Train the Trainer’ philosophy. This document aims to enhance ENISA’s existing body of knowledge on the establishment of CSIRTs.

text: HOW TO SETUP UP CSIRT AND SOC

text: 1. INTRODUCTION

text: 1.1 CONTEXT OF THE WORK

text: Cybersecurity threats are increasing and becoming more complex. One of the most effective ways to counter these threats is by creating a global ecosystem of computer security incident response teams (CSIRTs) and security operations centres (SOCs) that can communicate, share

text: A more mature

text: information and respond to cyberthreats effectively. This can be facilitated by providing relevant

text: ecosystem of

text: frameworks and increasing the number of CSIRTs and SOCs around the world and the maturity

text: CSIRTs and

text: of existing CSIRTs and SOCs.

text: SOCs enables

text: In Europe, ENISA is assisting Member States with their incident response capabilities by better providing them with various resources, such as documents, tools, materials and guidance. For cooperation and example, ENISA hosts a European CSIRT inventory – an interactive map on ENISA’s website collective actions that gives an overview of publicly listed CSIRTs in Europe. In addition, the Study on CSIRT

text: to respond to

text: landscape and IR capabilities in Europe 2025( ) looks at the overall status of CSIRTs’ incident

text: cyber security

text: handling and response capabilities, while the EU Member States incident response

text: 4 5 threats

text: development status report( ) provides an insight into the NIS Directive( ) (

text: Directive (EU) 2016/1148

text: on security of network and information systems) sectoral incident response capabilities. ENISA has also carried out work in the field of national and governmental CSIRTs’ capabilities and incident response capabilities, including providing training material covering some aspects of the development of CSIRTs.

text: To provide additional resources, a decision was made to publish guidelines and produce an interactive online information repository to guide the establishment of different types of CSIRTs and SOCs by building on the existing work of ENISA, especially in the areas of maturity and training.

text: 1.2 OBJECTIVES OF THE WORK

text: This publication provides results-driven guidance for those who are interested in establishing a CSIRT or SOC or modernising a CSIRT or SOC in a structured way.

text: A results-driven approach is taken throughout the publication to provide guidance on the different stages involved in the establishment of a CSIRT organisation: assessment for readiness, design, implementation, operation and improvement.

text: The expectation is that the reader will use this publication as a practical guide during the individual phases involved in the establishment of CSIRTs. Readers may be stakeholders of CSIRTs that are to be established.

text: This report aims to encourage the establishment of CSIRTs and SOCs and provide practical techniques to ensure that the establishment and improvement process is effective.

text: HOW TO SETUP UP CSIRT AND SOC 1.3 OVERVIEW OF THE METHODOLOGY

text: Existing documents on CSIRT establishment focus on activities to do, without elaborating much on the resulting outcome. This publication aims to build a recurring process of improvement and related deliverables during the growth and development of a CSIRT. It was designed in a way that provides guidance for all CSIRTs no matter what development stage they are in or their current maturity.

text: To achieve this result data gathering methods such as analysis of current publications on the establishment of CSIRTs (the analysis is summarised in Annex B); a field questionnaire aimed at established CSIRTs and SOCs (Annex A); and the authors’ and reviewers’ practical experience in establishing and improving CSIRTs, were used. The objective was to make this publication as close to real life as possible. For this reason citations from various CSIRT teams as well as realistic costing and timing were included.

text: FIRST.org CSIRT Services Framework, as well as SIM3 assessment model are referred to as companions in the process because they are widely respected when defining an initial service catalogue for new CSIRT teams and for the assessment and development of CSIRT maturity.

text: 1.4 DEFINITIONS OF CSIRT AND SOC

text: The most common terms used to describe the teams responsible for incident response handling are CSIRT, CERT( ), and SOC.

text: 1.4.1 Computer security incident response teams

text: The term CSIRT, or computer security incident response team, was established in the 1990s. CSIRTs are also known as CIRTs (Computer incident response teams), CERTs (Computer emergency response teams), SIRTs (Security incident response teams) among others. National teams may also be called national cyber security centres (NCSCs), which by law are usually assigned the CSIRT role as well as providing additional services for the nation (e.g. handling a country’s information classification schemes). Each team chooses its name based on the preference of the organisation.

text: CSIRT has become a generic name for a team that provides a set of services: information and cybersecurity incident handling (core service), security monitoring, vulnerability management, situational awareness and cybersecurity knowledge management.

text: In simpler terms, a CSIRT is a team that is assigned to handle computer security (thus, often, cybersecurity) incidents. Often this includes additional responsibilities, from detection to analysis, and even hands-on fixing, as well as different situational awareness, knowledge transfer and vulnerability management activities. Over the years, the role of a CSIRT has evolved from providing incident monitoring and handling services to coordinating and communicating with different stakeholders, countries and specific sectors.

text: Currently, FIRST.org hosts and continuously improves a CSIRT Services Framework ( ), which is a high-level document that describes the activities carried out by CSIRTs. These activities are organised into five main service areas, which are further split into services, functions and subfunctions. A CSIRT can choose which of the services and functions are relevant to their mandate and organise them into their own services structure. Although this framework does not define a SOC framework, services from some of the areas can also be applicable to SOC

text: HOW TO SETUP UP CSIRT AND SOC

text: teams. The CSIRT Services Framework is supported by ENISA, the International Telecommunications Union (ITU) and many other organisations.

text: Typically, a minimal set of services for CSIRTs usually includes those those in bold below in accordance with the FIRST services framework.

text: Figure 1: FIRST services framework – typical CSIRT services

text: 1.4.2 Security operations centres

text: A SOC, or security operations centre, provides an incident detection service by observing

text: ‘SOC is the first line,

text: technical events in networks and systems and can also be responsible for incident

text: they receive all alerts,

text: response and handling. In large enterprises, SOCs sometimes focus only on monitoring and detection services and then hand over incident handling to a separate CSIRT. In smaller whereas IRT would organisations, CSIRTs and SOCs are often considered to be synonymous. only receive escalated

text: alerts or be involved

text: Typically, SOC teams operate from SOC rooms, where analysts sit at their workstations in

text: in the coordination.

text: front of a video wall that projects a summary of the current situation (Figure 2). SOC teams

text: SOC is the

text: typically evolve from information technology (IT) security teams automating their work using

text: responsibility of our

text: security information and event management (SIEM) and other security automation and

text: members as we are a

text: orchestration technology for security monitoring. SOC teams usually focus their key performance indicators (KPIs) around quality indicators – detection speed, detection sector CERT’ breadth, coverage, false-positive rates – as well as incidents handled, the ratio of (sectorial CSIRT) alerts/events/incidents, number of escalations and workload per incident.

text: HOW TO SETUP UP CSIRT AND SOC

text: Figure 2: Multi-State Information Sharing & Analysis Center (MS-ISAC) SOC room. Source: MS-ISAC website (https://www.cisecurity.org/ms-isac/)

text: As well as operating physically, SOCs can consist of virtual and outsourced staff, or a hybrid model of internal and outsourced staff. It is common practice that, over time, SOCs alternate between outsourced and internal operations. As both CSIRT and SOC organisations adhere to the same CSIRT Services framework, both CSIRTs and SOCs are referred to this report as CSIRTs. Typically, a minimal set of services for SOCs usually includes those in bold below in accordance with the FIRST services framework. Figure 3: First service framework – Typical SOC services

text: HOW TO SETUP UP CSIRT AND SOC 1.5 PREVIOUS ENISA WORK ON THE TOPIC OF CSIRTS

text: Up to July 2020, ENISA had published 61 reports and 21 translated versions of reports about CSIRTs on its website ( ).

text: ‘ENISA has excellent

text: The foundational document on the establishment of a CSIRT is the CSIRT Setting up

text: 10 publications which

text: Guide ( ), published in 2006. It was translated into more than 20 languages, including Chinese and Hindi. This 86-page publication covers the step-by-step process of creating a are well organised CSIRT and is still valid today. and easy to read and

text: understand’

text: ENISA’s Good Practice Guide for Incident Management ( ), published in 2010, provides

text: (Unicom CSIRT)

text: guidelines for establishing incident handling management structures and capabilities; it can be used as a reference for establishment topics including incident handling processes and workflows.

text: ENISA’s training package ( ) provides online training materials, training courses and exercise materials for cybersecurity specialists, based on the ‘Train the Trainer’ philosophy.

text: ENISA has also published a body of knowledge for national and governmental CSIRTs on, for 13 14 example, baseline capabilities ( ) and maturity profiles ( ), as well as a self-assessment tool.

text: In the past few years, ENISA has published a guidance document on CSIRT and law

text: 15 ‘Most of the

text: enforcement partnerships ( ), including an analysis of partnership models, technical

text: 16 publications and

text: cooperation, electronic evidence analysis ( ) and training modules. In addition, further information on how to choose a CSIRT cooperation model and the technical implementation guidance from

text: of cooperation models is available from the ENISA website. ENISA is relevant to

text: our effective work.

text: This report aims to enhance ENISA’s existing body of knowledge on the establishment of

text: ENISA threat

text: CSIRTs. The content of this report is based on an analysis of previous publications on the

text: landscape is used

text: establishment of CSIRTs (the analysis is summarised in Annex B); a field questionnaire (Annex A), which was completed by 40 CSIRTs and SOCs; and the authors’ experiences in to set our threat establishing and improving CSIRTs as part of numerous projects carried out in Europe, baseline every year’

text: Asia, Africa and South America. (BGD e-GOV CIRT)

text: HOW TO SETUP UP CSIRT AND SOC

text: 2. GUIDELINES FOR ESTABLISHING CSIRTS

text: 2.1 ORGANIZATION OF THE GUIDELINES

text: The guidelines for establishing CSIRTs are organised according to the different phases of the CSIRT establishment ( ) process:

text: Figure 4: Lifecycle of CSIRT

text: The establishment of a new CSIRT starts with the ‘assessment for readiness’ phase, which begins with a discussion about the reasons and necessity for establishing a CSIRT and ends with the approval of an initial budget and shaping requirements for the design phase.

text: During the ‘design’ phase, detailed plans for the implementation phase are developed.

text: The ‘implementation’ phase covers organisational matters: governance, people, processes, services and technology.

text: In the ‘operations’ phase, a CSIRT delivers the CSIRT services.

text: Existing CSIRTs can follow the guidelines from the ‘improvement’ phase rather than from the ‘assessment for readiness’ phase.

text: During the ‘improvement’ phase, a CSIRT formulates requests for improvements, prioritises initiatives and receives an approved budged for following the ‘design–implementation– operation–improvement’ cycle.

text: HOW TO SETUP UP CSIRT AND SOC

text: These guidelines are organised based on the outcomes of each phase.

text: 1. Assessment for Readiness

text:  Preliminary Mandate  Governance Structure  Identification of the CSIRT hosting organisation  High-level roadmap and budget  Detailed Requirements for the Design Stage

text: 2. Design

text:  Approved Detailed Mandate  CSIRT Services Plan  CSIRT Processes and Workflows Plan  CSIRT Organisation, Skills and Training Structure Plan  CSIRT Facilities Plan  CSIRT Technologies and Processes Automation Plan  CSIRT Cooperation Plan  CSIRT IT and Information Security Management Plan  Detailed Requirements for the Implementation Stage

text: 3. Implementation

text:  Approved and implemented organisational structure  Hired and appointed people  Executed training plan for the staff roles  Prepared facilities  Developed and Implemented detailed processes and procedures  Implemented technology for the automation of processes  Implemented IT and information security management procedures  Trained people for CSIRT operations  Signed relevant agreements with the constituency, stakeholders and partners  CSIRT services Test run and Tuning of results  CSIRT Launch Communication and Celebrations

text: 4. Operation

text:  Measured KPIs  Annual Operations Performance Review  Annual Stakeholder Needs Review  Approval Annual Budget  Collected Requirements for Improvement

text: 5. Improvement

text:  List of chosen Initaitves for improvement  Detailed Requirements for Improvement for Design Stage  Preliminary budget for Improvement

text: HOW TO SETUP UP CSIRT AND SOC

text: Figure 5: Summary of CSIRT establishment outcomes

text: HOW TO SETUP UP CSIRT AND SOC

text: Figure 6: Sample of CSIRT establishment phases and required efforts

text: Figure 6 shows a timeline for CSIRT establishment, the expected internal and external resources needed, and the intensity of work required for the different roles involved in each phase.

text: The percentages in Figure 6 represent the workload/time required for the different roles. For example, ‘1 x Project manager 50 %’ means that one project manager is required and that the required tasks will take up to 50 % of their maximum workload/time.

text: 2.2 ASSESSMENT FOR READINESS

text: In the assessment for readiness phase, the following outcomes are expected.

text:  Preliminary mandate  Governance structure  Identification of the CSIRT hosting organisation  High-level roadmap and budget  Detailed requirements for the design stage

text: Figure 7: Implementation phases

text: HOW TO SETUP UP CSIRT AND SOC 2.2.1 Preliminary mandate

text: A CSIRT begins with a purpose – the initial idea and reasons why a CSIRT is needed. The establishment of a CSIRT must be justified.

text: The expectations of stakeholders and constituencies should be carefully considered before deciding to establish a CSIRT. In practice, this means considering the following aspects.

text: 1. Identifying all major stakeholders and understanding their needs and expectations of a CSIRT. Depending on the stakeholder, their needs can include identification of incidents, security awareness, resolution of incidents and compliance with certain standards. 2. Identifying constituencies. This could be a small group of companies for a sectorial CSIRT, the residents of a city or even a whole country. Evaluating and meeting the needs and expectations of a specific constituency are extremely important for the success of a CSIRT.

text: A series of workshops should be planned with the main stakeholders and representatives of constituencies in order to obtain their support for the establishment of a CSIRT and to start a conversation about the real value that a CSIRT could bring. This can then be used as input for justifying the establishment of a CSIRT and for its mandate and budgeting.

text: Common justifications for establishing a CSIRT include:

text: 1. The need to organise cybersecurity incident handing in a professional way to minimise the impact of incidents. 2. The need to have a professional team to respond to cybersecurity incidents using internationally accepted incident handling methods. 3. The need to be trusted by other CSIRTs around the world during incident investigations. 4. The need to have a coordinating team for cybersecurity incident handling, vulnerability handling, situational and security awareness rising and analysis of threats.

text: A team’s purpose is determined in a CSIRT mandate, which must include the authority and responsibilities given to the team.

text: A mandate usually includes:

text: 1. The authority given to a CSIRT to serve and act in a constituency. 2. The responsibilities of the CSIRT. 3. Requirements, objectives and tasks.

text: For a CSIRT with internal-only constituencies in an organisation or a managed security service provider (MSSP) set-up, the mandate is usually expressed in a single document of one of the following types:

text: 1. An office order (in a government agency). 2. A decision or resolution by the board or executive management (in a private enterprise).

text: HOW TO SETUP UP CSIRT AND SOC

text: For sectoral or national CSIRTs, the mandate is usually expressed in at least two documents, namely:

text: 1. A cybersecurity strategy, law or by-law, or government order assigning authority and overall responsibility (the only way to establish authority over a country’s different organisations). 2. An office order of the CSIRT hosting organisation, outlining the detailed requirements, objectives and tasks and a list of services.

text: The following additional guidance on the mandate should also be followed.

text: 1. The responsibilities of a CSIRT must be stated. Simply stating that a CSIRT is being established is not enough; the mandate should also indicate what its responsibilities are and why it is needed. 2. The responsibilities should indicate which overall constituency a CSIRT will serve, for example a CSIRT for the financial sector for cyberthreat management, threat information sharing and critical incident coordination, or a CSIRT for internal business divisions for cybersecurity monitoring and incident handling. 3. An authorised body must issue authority to a CSIRT. For sectoral or national CSIRTs this might be the national government, the parliament or a ministry. 4. An organisation or a business unit must be assigned to establish a CSIRT. Sometimes this might be a new organisation.

text: For national governments or sectoral regulators, the development of a mandate usually begins with drafting of a law, bill, cybersecurity strategy or cybersecurity plan.

text: For organisational CSIRTs, the development of a mandate usually begins after receiving approval to establish a CSIRT from the management board or C-level executives, starting with the purpose why it is being established.

text: An approved mandate of authority and responsibility usually indicates a person, unit or organisation that will lead the establishment of a CSIRT.

text: Examples of phrases typically used in mandate documents include the following.

text: 1. Cybersecurity has become very important; thus, a CSIRT is being established to increase the resilience of information systems to cyberattacks; manage cyberthreats; work on lowering the costs of the impact of incidents by establishing strong incident management controls; improve know-how; foster collaboration between stakeholders; and ensure cyber situational awareness and cyber situational visibility. 2. A sectoral (national, organisational) CSIRT is being established by modernising the current IT security unit to provide effective cyber resilience, organise incident responses, enable cyber situational awareness and establish cyber information exchange channels with partner organisations.

text: For EU Member States, NIS Directive Annexes I and II present the requirements, tasks and mandatory constituencies of national CSIRTs; the high-level responsibility of CSIRTs is described as follows: ‘responsible for risk and incident handling in accordance with a welldefined process’.

text: HOW TO SETUP UP CSIRT AND SOC

text: Examples of mandates for the establishment of a CSIRT include:

text:  btCIRT ( ) – national CIRT of Bhutan, established by government order.  BGD e-GOV CIRT ( ) – Bangladesh government sectorial CSIRT, established by office order.

text: Additional guidance on mandates and responsibilities can be found in ENISA’s Good Practice Guide for Incident Management (2010), Section 5.4.

text: 2.2.2 Governance structure

text: The governance structure defines the responsibilities of the CSIRT’s stakeholders. It can be presented as a planning document or even as part of the mandate.

text: The governance structure document should provide answers to a number of questions.

text: 1. Who will provide funding for the establishment and operations of a CSIRT and on what grounds? 2. Who will provide direction, monitoring and oversight of the CSIRT? 3. What types of agreements should the CSIRT have and with which stakeholders (e.g. law enforcement, intelligence agencies, international organisations, technology partners, academia)? 4. Who will the CSIRT report to, how often and in what form?

text: The owner of the CSIRT governance structure is usually the hosting organisation.

text: The governance structure is usually clarified during the workshops held to discuss the mandate with various stakeholders.

text: 2.2.3 Identification of the CSIRT hosting organisation

text: The CSIRT hosting organisation is usually mentioned in the preliminary mandate. The hosting organisation might already exist or might need to be set up.

text: If a new hosting organisation is being established, the CSIRT budget can be approved only after the organisation is functional in terms of setting up management and legal processes, meaning that additional time will be required at this stage.

text: When choosing an organisation to host a CSIRT, the organisation’s authority to deliver the services in accordance with the CSIRT’s mandate must be evaluated.

text: 2.2.4 High-level roadmap and budget

text: After the mandate is defined, a high-level roadmap and budget must be approved.

text: The roadmap should include an expected timeline for the CSIRT establishment phases – design, implementation and operations – and further improvement initiatives.

text: HOW TO SETUP UP CSIRT AND SOC

text: Figure 8: Roadmap example

text: Commonly, it takes 2–3 years from development of the preliminary mandate to initial mandate approval when a CSIRT becomes fully operational. This includes the following steps:

text: 1. Budget approval, setting up of facilities, organisation establishment and initial hiring can take up to 1 year. 2. Design and implementation usually take 1–2 years, especially if the assistance of external consultants and technology has to be acquired through public tenders.

text: The budget for the initial year, which is spent on the establishment of the CSIRT and initial services, should cover at least:

text: 1. Initial staff salaries – at least for the minimum required personnel (CSIRT manager, CSIRT establishment project manager, administrative assistant). 2. Facility establishment costs. 3. Salaries or consultancy service fees for creating the design stage results (legal processes, CSIRT-related expertise, technology deployment). 4. CSIRT skills acquisition recruitment and training. 5. Preliminary technology and licences.

text: ‘We operate 24/7’

text: The budget should be adjusted according to the roadmap, mandate, stakeholder (national CSIRT) commitment and requirements for how quickly the CSIRT should be established.

text: The budget should be adjusted again once the design phase has finished and when the detailed plans are prepared for the implementation and operations phases. For example, if the budget is insufficient, some aspects can be moved to the further improvement phase in the roadmap.

text: The following notes provide indicative costings for 2020. Cost estimates are done for illustrative purposes only and does not depict any particular country.

text: 1. In EU countries, a CSIRT staff member (including managers) costs on average EUR 40 000–60 000 per year. 2. Small CSIRT operations with three staff members (manager, two incident handlers) should budget around EUR 120 000–180 000 annually. 3. If a CSIRT is required to provide operations 24/7 for 365 days a year, it needs at least 12 additional employees (six teams of two staff members to cover 24/7, with each shift covering 8 hours). This will add EUR 480 000 annually to the budget. 4. CSIRTs typically employ the following numbers of staff: small – 3–7, medium – 10–15, large – 30–60, depending on the constituency size and mandate. 5. The cost of office rental is normally around EUR 3 000–4 000 per staff member per year.

text: HOW TO SETUP UP CSIRT AND SOC

text: 6. It is common to spend EUR 3 000–10 000 on staff training per person per year. Attending conferences is highly recommended (one event per person per year).

text: 7. Depending on the scope, consultancy services for the establishment of a CSIRT (design and implementation) can cost from EUR 75 000 to EUR 1 000 000 over a 1- to 3-year period.

text: 8. It is common to spend EUR 100 000–300 000 on technology: hardware (at least two servers with virtualisation, backup solutions, firewalls, computers, printers), networking and specialised equipment for performing specific CSIRT operations (digital forensics, reverse engineering, vulnerability assessment, etc.). Using cloud services can be an effective way to limit initial investments in hardware, by allowing spending only on what is actually being used.

text: 9. With regard to software components, CSIRTs might begin by using mostly opensource solutions, using commercial tools only if there are no comparative alternatives or for their better effectiveness. In this case, the budget for software and software services should start at EUR 50 000. If CSIRTs are focusing on commercial technology, the budget should be increased; however, focusing on commercial technology can result in higher productivity, i.e. fewer staff members are required.

text: The initial amounts in the budget and the time period over which the budget should be spent may change over time. Design phase activities will be bound by the approved budget available.

text: The approved budget will impact the final detailed mandate, as an organisation can achieve the anticipated results only when a sufficient budget is made available. The discrepancy between the detailed mandate and the budget is a common reason why CSIRTs do not fulfil their mandate.

text: It may take 3 years for a CSIRT to become operational, so the budget should reflect the expected intensity of the CSIRT establishment process.

text: 2.2.5 Detailed requirements for the design stage ‘We buy some

text: The design phase activities will be based on the requirements and constraints of the CSIRT,

text: such as: specific services from vendors on

text: 1. The agreed mandate. behalf of the 2. The roadmap and budget.

text: whole sector, e.g.

text: 3. The people, competences and resources allocated to the design phase.

text: TI for specific geographical

text: These must be validated and approved.

text: regions/actors;

text: When external consultancy work is involved, the detailed requirements are often expressed sandboxes, as the consultancy project terms of reference (ToR) for a competitive tender (request for takedown of information (RFI)/request for proposal (RFP)). domains, etc.’

text: (sectorial CSIRT)

text: When preparing the ToR for such work, it is relevant to include:

text: 1. The mandate definition of the CSIRT. 2. A clear statement of the expected results. 3. The expected delivery plan. 4. The experience required from the consultants from delivering similar activities.

text: HOW TO SETUP UP CSIRT AND SOC 2.3 DESIGN

text: The design phase prerequisites are all of the outcomes from the assessment for readiness phase.

text: The design phase recommendations are aligned with SIM3 (security incident management maturity model which estimates how well a team governs, documents, performs and measures their function), covering all four areas – organisation, human, tools and processes – in sequence, as presented below. This guidance does not provide specific advice on how to reach the maturity levels, as this information can be found in the SIM3 assessment tools from 21 22 ENISA ( ) or the Open CSIRT Foundation ( ).

text: In the design phase, the following outcomes are expected, in the form of either separate approved documents or one approved document.

text: 1. Approved detailed mandate 2. CSIRT services plan 3. CSIRT processes and workflows plan 4. CSIRT organisation, skills and training structure plan 5. CSIRT facilities plan 6. CSIRT technologies and processes automation plan 7. CSIRT cooperation plan 8. CSIRT IT and information security management plan 9. Detailed requirements for the implementation stage

text: In addition, the resulting design structure is often published in RFC 2350 format ( ) – this is the de facto format for the formal presentation of a CSIRT, covering the team name, contact information, the time zone, PGP (pretty good privacy) keys, the mandate (charter), policies and services, etc. It is good practice for a CSIRT to publish the RFC 2350 document on its own website.

text: 2.3.1 Approved detailed mandate

text: The design phase is based on the requirements of the CSIRT mandate, which might still be in final discussions or might include some broad overarching statements. In this phase it must be ensured that final approval has been granted (e.g. the mandate has been signed by the minister, or board of directors, or executive) and that the mandate is clear and easy to understand and sets out:

text: 1. The authority given to a CSIRT to serve and act in its constituency. 2. The responsibilities of the CSIRT. 3. The requirements, objectives and tasks.

text: The approval of the mandate, together with the budget constraints and the initial roadmap for establishment of the CSIRT, allows for successful preparation of the design.

text: A detailed mandate might indicate how to name a CSIRT, as described below.

text: 1. The name of the organisation should reflect the mandate, ensuring that it is clearly formulated and includes the role of the CSIRT. 2. The type of constituency covered is often reflected in the name; for example, national CSIRTs are often named using the two-letter country code and the CSIRT/CIRT/CERT

text: HOW TO SETUP UP CSIRT AND SOC

text: abbreviation, joined by a dash, a dot or some other symbol, e.g. CERT-LV, CERT-MU, SK-CERT. The sector is often included too in a shortened form; for example, the financial sector would be FinCIRT or FS-CSIRT, with the country additionally named using the two-letter country code, e.g. EG (EG-FinCIRT). 3. Often, a name is chosen based on a short company or organisation name and adding CSIRT, for example Adidas CSIRT, CSIRT BNP Paribas. 4. A CSIRT is often referred to as a CIRT, CERT or SIRT. Such organisations must provide an incident handling (response) service. 5. The SOC name is usually used for organisations that monitor operations for the security of networks and data centres, for example NestleSOC, TDC SOC. Recently, 24 25 names such as iSOC ( ) and gSOC ( ) have also been used. 6. When the primary function of an incident response team is to handle the vulnerabilities of the products of a certain company, it is usually referred to as a PSIRT ( ), for example Adobe PSIRT, NVIDIA PSIRT, Fujitsu PSIRT. Separate guidance on PSIRTs has been created by FIRST.org ( ). 7. Examples of existing team names are available on the FIRST.org ( ), Trusted 29 30 Introducer ( ) and ENISA CSIRTs Map . 8. If the chosen name includes the CERT abbreviation, a request for approval must be submitted to the CERT trademark owner SEI ( ) (the SEI policy may be amended in the future).

text: 2.3.2 CSIRT services plan

text: The CSIRT services plan explains which services a CSIRT organisation will provide to a constituency to fulfil the roles and responsibilities defined in the mandate and adhere to the roadmap and budget constraints.

text: Figure 9: FIRST services framework

text: HOW TO SETUP UP CSIRT AND SOC

text: The following guidelines are provided for preparation of the CSIRT services plan.

text: 1. CSIRT should take a look at the latest version of the FIRST.org CSIRT Services Framework ( ). This document is now available in several languages. This document presents the conceptual CSIRT services map, as presented below. 2. Choose which service areas (out of five) and which exact services the CSIRT should provide to fulfil the specific mandate stipulations. 3. Select and adjust the names of the service areas as the names provided in the CSIRT Services Framework may be too detailed initially. For example, when looking at the information security event management service area for SOCs, one might decide to consolidate both services (monitoring and detection and event analysis) into one entity and to rename the service area as security monitoring. Similarly, within the information security incident management service area, one might choose to include two services: incident handling service and artefact analysis. 4. Validate the list of resulting services to ensure that all of the mandate requirements are covered and that it does not include more services than the mandate requires. The resources of CSIRTs are limited; therefore, it is reasonable to concentrate on what is mandatory to ensure the provision of good-quality services for which proper authority has been provided.

text: The list of chosen CSIRT services should be listed in a CSIRT services catalogue. ITIL On activities: (information technology infrastructure library) methodology may be of value to organise the

text: ‘incident response,

text: delivery of services. It is important to clearly understand the distinction between the different

text: monitoring sensor

text: meanings of the word ‘incident’ – in CSIRTs, ‘incident handling’ is the name of the service,

text: network, dispatching

text: while in ITIL methodology ‘incident’ means a disturbance to service delivery, i.e. that the service cannot be delivered, with the ‘incident’ being closed when the service is recovered. notifications,

text: constituency

text: Realistically, CSIRTs must ensure that good-quality services are delivered and, if these building, awareness services are disrupted, they are rapidly recovered. For example, if a CSIRT IT system fails,

text: raising and

text: this could be recovered using an internal IT support process according to ITIL principles.

text: education, training and cyber exercises’ 2.3.3 CSIRT processes and workflows plan (national CSIRT)

text: CSIRT processes are needed to implement and support agreed CSIRT services.

text: Typically, each type of service delivery is implemented using at least one process. More than one process may be required to deliver a service if, for example, service provisioning requires several working groups to be involved, or specific intermediate goals must be reached.

text: Some processes may be established as supportive processes, for example, an IT support process for maintaining and updating CSIRT IT infrastructure. This process can be handled using ITIL methodology, using a separate IT services catalogue (not to be confused with a CSIRT services catalogue).

text: The interrelationships between the identified processes should be analysed and documented. For example, the output from the security monitoring process is an identified incident that is handed over to the incident handling process as input; the artefact analysis process can be initiated from the incident handling process when needed.

text: HOW TO SETUP UP CSIRT AND SOC

text: Each process consists of one or more workflows, represented by workflow diagrams, depicting each step from the start until the final phase of activity. In addition, it is common to provide a tabular description of each step.

text: An example of a security incident handling workflow diagram, taken from ENISA’s Good Practice Guide for Incident Management (2010), is provided below.

text: Figure 10: Incident handling workflow example

text: An example of an interrelationship diagram for different services and processes is presented in Figure 11.

text: When designing processes and workflows, the human parameters of SIM3, the ENISA CSIRT 34 35 maturity assessment model ( ) and the SOC capability and maturity model (SOC-CMM) ( ) might be relevant tools for validating their completeness and coverage.

text: HOW TO SETUP UP CSIRT AND SOC

text: Figure 11: Services/processes interrelationship diagram for an internal CSIRT

text: Examples of security incident handling and security monitoring processes, which are used for implementing security incident management and security monitoring services, are provided in Tables 1 and 2, respectively. Process definitions are adapted to the needs of CSIRTs.

text: Table 1: Examples of security incident handling processes

text: HOW TO SETUP UP CSIRT AND SOC

text: The process is then usually constructed as a workflow diagram.

text: Figure 12: A simple security incident management process workflow diagram

text: Table 2: Examples of security incident monitoring processes

text: HOW TO SETUP UP CSIRT AND SOC

text: Figure 13: A simple security monitoring process workflow diagram

text: Example guidelines for intrusion incident handling are presented in Table 3.

text: Table 3: Example guidelines for intrusion incident handling

text: Section Description

text: HOW TO SETUP UP CSIRT AND SOC 2.3.4 CSIRT organisation, skills and training structure plan

text: The CSIRT processes are run by CSIRT staff, who are organised into particular organisational structures.

text: Figure 14: Example of a small CSIRT structure

text: Smaller CSIRTs of up to five to seven people are mostly organised as one unit run by a unit Staff training: manager (Figure 15). In this case, staff roles may be based on the NIST NICE framework’s

text: ‘TRANSITS I and II

text: Cyber Defence Incident Responder work roles (PR-CIR-001) ( ).

text: for all plus internal policies/procedures

text: Figure 15: Example of organisational units for a bigger CSIRT

text: to use tools and communicate with rest of the team’ (ISP CSIRT)

text: For larger CSIRT organisations of over 10 people, the structural units should be designed according to the services structure or the activities run or other organisational practices (Figure 16). Again, the NIST NICE roles may serve as a starting point for defining staff roles.

text: HOW TO SETUP UP CSIRT AND SOC

text: It should be noted that 24/7 shift work can become very expensive, as six teams are required to cover the 8-hour shifts, including holidays. Thus, CSIRTs often use one of following operating procedures:

text: 1. Operate only during normal business hours. 2. Have someone on duty to monitor calls or emergency escalations. 3. Outsource night and weekend registration monitoring to an external party for initial triage. 4. Rely on existing 24/7 network operations centre operations to process initial calls according to typical basic standard operating procedures (SOPs) and call experts if needed if a duty phone is in operation.

text: ENISA has developed around 50 training courses on CSIRT-related topics, which are provided

text: ENISA has

text: for free on their website ( ). These training materials cover technical and operational aspects,

text: developed around

text: setting up a CSIRT, legal and cooperation aspects, and guidance on, for example, proactive

text: 50 free training

text: training for CSIRTs and training methodologies. All of the training materials are licensed under

text: courses on CSIRT

text: a Creative Commons BY-NC-SA 4.0 license, i.e. they are open for use by anyone under attribution to ENISA. However, the training materials are non-commercial and thus are most topics, which are useful for internal training delivered by CSIRT senior staff members. available at ENISA

text: Trainings for

text: Similarly, FIRST.org provides an increasing number of training courses on its website

text: Cybersecurity

text: education pages ( ), under the same licence terms. Also GEANT provides training for CSIRTs

text: Specialists, see:

text: TRANSITS I and TRANSITS II

text: ENISA - Online

text: Suggested technical training courses and laboratories for incident handlers are provided in

text: training material

text: Tables 4 and 5.

text: Table 4: Suggested training courses for CSIRT incident handlers

text: Role/skills Training course Provider

text: Duty officer, incident handler

text: HOW TO SETUP UP CSIRT AND SOC

text: Role/skills Training course Provider

text: Senior incident handler

text: Incident handling manager

text: HOW TO SETUP UP CSIRT AND SOC

text: Role/skills Training course Provider

text: Table 5: Suggested training laboratories for CSIRT incident handlers

text: Title Description Target group

text: The training suggested for developing technical skills is not sufficient to enable the successful operation of a CSIRT. In addition, each CSIRT must develop comprehensive professional, leadership and operational skills during the implementation phase using the following means.

text: 1. Knowledge transfer by implementation experts in the form of workshops, training, mentoring and post-implementation support. 2. Visits to other CSIRTs to learn about their operations. At least two to three visits to When hiring: CSIRTs in other countries should be planned. Visits usually last for a few hours and ‘Typically we

text: are focused on sharing operational experience. Some CSIRTs carry out staff

text: ask for CISSP’

text: exchanges to build knowledge.

text: (CSIRT)

text: All CSIRT staff members must develop professional competences, as described in the NIST NICE framework (where KSA stands for knowledge, skills, and abilities) (Table 6).

text: HOW TO SETUP UP CSIRT AND SOC

text: Table 6: Essential professional competences for CSIRT staff members

text: Competency Description

text: CSIRT management and administrative staff must develop their leadership and operational competences, for example as indicated in the NIST NICE framework (Tables 7 and 8).

text: Table 7: Essential leadership competences for CSIRT management and administrative staff

text: Competency Description

text: Table 8: Essential operational competences for CSIRT management and administrative staff

text: Competency Description

text: HOW TO SETUP UP CSIRT AND SOC

text: Competency Description

text: All of these competences can be acquired through participation in locally provided academic or online courses or integrated programmes. For example, Coursera.org provides more than 1 000 courses on leadership.

text: 2.3.5 CSIRT facilities plan

text: Secure facilities with separate workspaces and clear physical rules and regulations are essential for the efficient functioning of CSIRTs.

text: At a minimum the CSIRT facilities should include a data room to house any technology, an office room for incident handling staff, and a guest reception or meeting room.

text: To enable business continuity, the continuity of the CSIRT infrastructure should be ensured. To this end, redundant systems and backup working space should be available.

text: The following must be taken into consideration when planning facilities.

text: 1. Physical security should be considered and proper access control and monitoring should be established. In addition, a risk assessment should be performed based on neighbouring facilities. 2. The data room must provide a level of physical and environmental security that is appropriate to the data that the CSIRT will possess and manage. 3. The office room for incident handling staff must provide an appropriate, convenient and secure working environment by ensuring the ‘least required privilege’ access for personnel.

text: CSIRTs must implement appropriate physical security measures, such as ensuring perimeter control of the premises and providing access controls for entry into the different rooms for reasons of confidentiality.

text: HOW TO SETUP UP CSIRT AND SOC

text: Additional sources of information on physical security requirements are the ISO 27001 standard from the International Organization for Standardization, Field Manual FM 3-19.30 and national regulations. Organisations should refer to their internal safety or physical security teams for further advice on implementation of security measures.

text: Larger CSIRTs may have separate zones for a digital forensics and incident response (DFIR) laboratory, security monitoring (a SOC room), a crisis room and a visitors’ room.

text: Figure 16: Example layout of the internal rooms for a CSIRT On tools:

text: ‘MISP for threat information sharing. Elastic to analyze data. matrix.org as internal communications platform. Gitlab for internal projects management. BBB for video conferencing. Commercial feeds and tools for specific tasks if no viable open source alternative exists.’ (national CSIRT) 2.3.6 CSIRT technologies and processes automation plan

text: A CSIRT’s success depends heavily on the automation of its processes. Generic IT automation processes are used for workplaces and office work. There are also specific CSIRT processes related to automation.

text: A typical CSIRT should adhere to the following practices with regard to its technical infrastructure.

text: 1. As an on-premises data centre solution, a CSIRT must have at least two virtualisation servers to ensure high availability and recovery. In case one fails, backups are performed on a third server using tapes or an alternative solution, located in a different room. 2. Network segmentation must ensure that data centre production systems, the LAN (local area network), the guest network, the laboratory and the DMZ (demilitarised zone) are separated accordingly via firewall rules. 3. CSIRTs and SOCs are often cautious about using cloud systems extensively, as shown by the survey responses. Cloud services are mandatory at least for SaaS (software-as-a-service) services, for example data feeds from external dataset providers or websites used for interaction. Use of cloud services often results in availability, cost and operational efficiencies, with less data governance. Depending on a CSIRT’s data security needs and risk appetite, different cloud services may be utilised.

text: HOW TO SETUP UP CSIRT AND SOC

text: Often, automation needs fall into the following areas:

text: ‘Automation makes the analysis of a big

text: 1. ticketing systems for incident report registration and handling – typically, CSIRTs use

text: incident easier and

text: RTIR, OTRS, ServiceNow and Jira, among other ticketing technologies.

text: more efficient.

text: 2. data feed processing and routing – feed routers, threat intelligence platforms or dataset repositories are used. Automation helps 3. alert and awareness bulletin publishing platforms – these include website portals, with the daily tasks, publishing platforms and social media channels. allowing manpower

text: to concentrate on 2.3.7 CSIRT cooperation plan malware analysis,

text: A CSIRT’s success depends heavily on implementing effective working partnerships with

text: forensic analysis

text: different stakeholders and the international CSIRT community.

text: and more training.’

text: After establishment, a CSIRT might not be known by all stakeholders and constituencies; (CSIRT-CY) thus, it must actively approach stakeholders and constituencies and build cooperation arrangements. Some of these cooperation initiatives will result in the signing of formal memorandums of understanding (MoUs) or partnership agreements, or in formal and informal memberships of associations and information sharing communities.

text: ‘Anyrun for

text: Trust-based and long-lasting partnerships require planning, including clear objectives from each partnership and strategies for how to maintain the relationships. sandboxing,

text: Recorded Future

text: The guidelines set out below should be followed. for threat stream’

text: (MSSP SOC)

text: 1. A proactive approach to building partnerships with local and international law enforcement and intelligence agencies might help to handle cybercrime incidents or advanced persistent threats (APTs) more effectively in crisis situations. 2. Regional and national (if any) CSIRT initiatives for improving cooperation should be 43 44 , considered. The Trusted Introducer listed status ( ) ( ) is relatively easy to achieve for a CSIRT that is already operational and that has the support of other CSIRTs and participates in CSIRT-related events and conferences. CSIRTs should subsequently 45 46 focus on attaining accredited status ( ) or even certified status ( ), The Trusted Introducer scheme is the only certification scheme currently available for CSIRTs and Trusted Introducer services are more focused to CSIRTs operating in Europe. 3. It is strongly advised that CSIRTs join the FIRST.org association as this is the major global association for CSIRTs. 4. Proactively approaching different ISAC( )s for partnering and exploring the value of such partnerships is often a good way to determine what partnerships will be valuable. 5. The structure of MoUs and partnership agreements can usually be divided into three parts: a. the objectives of partnering – this can reflect the mandates of both parties; b. what each of the parties will be doing in relation to each other, for example invite each other to training sessions, share knowledge, participate in workshops and exercises, share indicators, respond to inquiries about collaboration on incidents; c. an initial action plan and timeline, to be executed after signing of the MoU or agreement, which includes a joint evaluation of the agreement and planning of the following year’s activities.

text: HOW TO SETUP UP CSIRT AND SOC

text: 6. For cooperation to work, related activities, for example organising, travel, hosting, workshops and informal socialising, must have a dedicated budget as part of the annual budget.

text: 2.3.8 CSIRT IT and information security management plan

text: CSIRTs should implement an IT and information security management plan or adopt and adapt the IT security framework from the hosting organisation.

text: It is recommended that CSIRTs adhere to industry good practices, for example ISO 27001-based information security management systems (ISMS).

text: The IT management plan might adhere to COBIT( ) (control objectives for information and related technology) and ITIL principles and methods.

text: 2.3.9 Detailed requirements for the implementation stage

text: The results of the design plans should be included in the requirements for implementation, explaining in more detail:

text: 1. What the requirements are and how they should be implemented. 2. What precise outcomes should be achieved.

text: The detailed requirements might be included as ToR.

text: 2.4 IMPLEMENTATION

text: The implementation phase focuses on rolling out all services, enabling processes, preparing detailed procedures and training staff members.

text: At the end of the implementation phase, the CSIRT is ready to deliver services to its constituency and start the operations phase.

text: In the implementation phase, the following outcomes are expected.

text: 1. Approval and implementation of the organisational structure. 2. Hiring and appointing of staff. 3. Execution of a training plan for different staff roles. 4. Preparation of facilities. 5. Development and implementation of detailed processes and procedures. 6. Implementation of technology for the automation of processes. 7. Implementation of IT and information security management procedures. 8. Training of staff for CSIRT operations. 9. Signing of relevant agreements with the constituency, stakeholders and partners.

text: 10. Test run of CSIRT services and tuning of results.

text: 11. Launch of CSIRT communications and celebrations.

text: 2.4.1 Approval and implementation of the organisational structure

text: For a CSIRT to become operational, the designed organisational structure must be approved and the different positions defined.

text: HOW TO SETUP UP CSIRT AND SOC

text: Sometimes this process can take months; thus, an organisation might begin work using an interim structure, to enable work to progress without it being dependent on the CSIRT establishment process.

text: For example, hiring can begin using an existing structure, with a clear plan of how resources will be moved later, or by adjusting the initial services plan if a smaller number of staff are available.

text: 2.4.2 Hiring and appointing of staff

text: The new structure must be filled with competent and skilled staff. It is highly likely that ‘SEI has a number of only a few positions will be filled with current staff; thus, additional staff members must

text: open source tools on its

text: be hired.

text: github site. These include SiLK,

text: Usually, there is a lot of interest from those wanting to work for a newly established

text: Cyberticket Studio,

text: CSIRT and gain professional experience; however, potential recruits often lack the

text: required competences. Cyobstract, and others. We have a network

text: As for other positions, it is important to hire staff showing a determination and

text: situational awareness

text: willingness to provide services in a professional manner.

text: suite of tools: https://tools.netsa.cert.o 2.4.3 Execution of a training plan for different staff roles rg/ We also use MISP’

text: All CSIRT staff must have the initial skills needed for their roles. To upskill staff, the designed training plan should support implementation of, and participation by staff (CERT/CC) members in, standard training sessions, conferences and workshops.

text: Additional training for CSIRT operations – processes, and SOPs – must also be run.

text: 2.4.4 Preparation of facilities

text: CSIRT facilities must be prepared according to the approved plan, taking into account physical security and appropriate accesss rights.

text: Some teams choose to brand their facilities with logos and recognisable marks, whereas other teams, especially if hosted in a national security area, do not provide any markings on their buildings; the CSIRT is visible only inside the premises.

text: 2.4.5 Development and implementation of detailed processes and procedures

text: Planned CSIRT processes are implemented in the form of established procedures.

text: Some of the typical activities that are repeated are defined in SOPs and automated using technology.

text: 2.4.6 Implementation of technology for the automation of processes

text: Technology implementation is carried out by installing, configuring, documenting and testing technologies.

text: CSIRTs use open-source software extensively, often written or contributed by other CSIRT members.

text: 2.4.7 Implementation of IT and information security management procedures

text: CSIRTs must define and implement detailed procedures for IT and information security management.

text: HOW TO SETUP UP CSIRT AND SOC

text: A common challenge is that core CSIRT services and processes are a priority in the implementation phase, while IT support and internal security management processes and procedures usually receive less attention initially. Thus, it is expected that these processes and procedures will require further improvements.

text: When a CSIRT is part of a larger organisation, the hosting organisation’s IT processes and information security management system can be adopted into practice.

text: 2.4.8 Training of staff for CSIRT operations

text: Extensive hands-on and theoretical knowledge transfer to CSIRT members with regard to implemented technologies and procedures is crucial for establishment success.

text: Knowledge transfer activities are usually run in the form of hands-on workshops, where all processes and procedures are explained and practised.

text: Further training can be carried out and identification of skills gaps achieved using crisis drills and blue–red–purple teaming exercises.

text: 2.4.9 Signing of relevant agreements with the constituency, stakeholders and partners

text: During the execution of a CSIRT partnership plan, there might be a need for the implementation of additional policies and procedures.

text: FIRST.org and Trusted Introducer membership applications should be submitted as soon as they are ready and the requirements for functional and operational readiness have been fulfilled. It may take a few months for the membership applications to be approved.

text: The building up and maintenance of partnerships require active participation and communication and should be overseen by the CSIRT manager or, in case of larger CSIRTs, the partnership manager.

text: 2.4.10 Test run of CSIRT services and tuning of results

text: Once the processes and technologies have been implemented it is important to run tests for at least a day and provide notifications of any deficiencies in processes and technologies in the test run report. Tuning actions should then be carried out, that is, adjustments should be made to processes, workflows and technology implementation as appropriate.

text: Irrespective of the initial preparations and planning, the results often reveal that some design presumptions were not correct and some implementation activities must be modified.

text: 2.4.11 Launch of CSIRT communications and celebrations

text: Once implementation has been completed, the CSIRT’s operations can begin. It is important to communicate properly about the new CSIRT services, the CSIRT’s mode of operations, the practical value it will provide and the responsibilities of the constituency and the CSIRT.

text: Typically, this communication is aligned with a CSIRT launch celebration and press release.

text: The launch celebration usually includes a small presentation, a visit to the facilities by the constituency, stakeholders and journalists, and printed materials.

text: A successful launch can inspire and give positive momentum to the entire CSIRT.

text: HOW TO SETUP UP CSIRT AND SOC

text: Similarly, other improvements are worth celebrating in order to draw positive stakeholder attention to the CSIRT, for example inauguration of a CSIRT laboratory or cyber gym facilities, launch of an annual report or any other major event in the life of the CSIRT.

text: 2.5 OPERATIONS

text: The operations phase focuses on effective and efficient delivery of services, i.e. executing the CSIRT mandate daily. On KPIs:

text: ‘incident statistics,

text: In the operations phase, the following outcomes are expected.

text: vulnerability management statistics

text: 1. Measurement of KPIs. 2. Annual operations performance review. (monthly and quarterly) 3. Annual stakeholder needs review. including number of 4. Approval of the annual budget. vulnerabilities detected 5. Collection of improvement initiatives.

text: and remediated (only critical and high for 2.5.1 Measurement of key performance indicators now)’

text: KPIs are used for management and governance purposes and quality monitoring. Not all

text: (university CSIRT)

text: CSIRTs are KPI driven. It has been observed that many CSIRTs are overburdened and run their overall operations without a sharp focus on the quality management of CSIRT services.

text: The following guidelines are provided for the use of KPIs.

text: 1. KPIs should be measured monthly. For mature organisations, weekly indicators might also be of relevance. Annual KPIs are usually the sum of monthly KPIs. 2. KPIs should be linked to service delivery, i.e. they should be linked to each service and should facilitate an understanding of whether or not a service is of a good quality and meets service objectives. 3. Some KPIs are used only for statistical analysis whereas others are used for implementing actions for improvement. For example, the number of incidents, analysed monthly, is useful for statistical analysis – bigger or smaller numbers rarely produce actions for improvement – whereas the number of visitors to the CSIRT website, where alerts and awareness information is shared, indicates trends of relevance, which might result in actions for improvement.

text: Examples of KPIs include:

text: On KPIs:

text: 1. The number of meetings with the constituency each month for awareness raising

text: ‘Time to respond and

text: (target: at least one).

text: mitigate ongoing DDoS

text: 2. Incident handling service-level agreement (SLA) breaches for critical incidents (target: less than 5 %). incidents via e-mail 3. Number of monthly visitors to a website (target: an increase from the previous (1.5 hours), respond

text: month). and mitigate ongoing

text: 4. Number of awareness-raising campaigns carried out (target: at least one every

text: DDoS incidents (45

text: second month).

text: minutes)’

text: 5. Trends in incident statistics (target: priority incidents must be handled according to

text: (ISP CSIRT)

text: SLAs).

text: HOW TO SETUP UP CSIRT AND SOC 2.5.2 Annual operations performance review

text: The management team of an operational CSIRT should conduct the annual CSIRT performance review, to identify successes to celebrate and areas for improvement.

text: During the internal phase of the review, staff skills and individual performances are assessed, CSIRT processes are checked, automation is evaluated and KPIs are analysed.

text: The review of operations is commonly presented in the CSIRT annual report..

text: 2.5.3 Annual stakeholder needs review

text: It is good practice to set up an annual workshop or meeting with CSIRT stakeholders where the performance of the CSIRT and stakeholders’ priorities for and expectations of the CSIRT are presented.

text: These priorities contribute to the planning of subsequent improvements for the CSIRT.

text: 2.5.4 Approval of the annual budget

text: As for any organisation, CSIRTs must develop and gain approval for their annual budget each year. The budget outlines which initiatives will receive additional funding.

text: The budget must be prepared in agreement with local laws, rules and regulations.

text: 2.5.5 Collection of improvement initiatives

text: The internal annual review, stakeholder needs analysis and daily operations allow identification of CSIRT requirements that may need to be improved. These are analysed as part of the improvement phase.

text: Ideas for improvements may also come from the operations review. All improvement initiatives should be presented in a table, including justifications and explanations of need.

text: 2.6 IMPROVEMENT

text: The improvement phase focuses on selecting and approving CSIRT enhancement initiatives. After approval, these initiatives are moved to the design, implementation and operations phases. Improvement process should be continuous during existence of CSIRT.

text: In the improvement phase, the following outcomes are expected.

text: 1. List of improvement initiatives. 2. Detailed plans for improvement initiatives for the design stage. 3. Preliminary budget for improvement initiatives.

text: 2.6.1 List of improvement initiatives

text: It is often difficult initially to execute the CSIRT mandate at an excellent level of quality because of a lack of skills, automation, processes and resources; thus, balancing improvement priorities is a common activity for CSIRTs.

text: Improvement initiatives come from the operations phase as areas requiring improvement; from a high-level roadmap; from additional guidance from stakeholders; or from the demands of CSIRT management to improve the maturity and capability of the CSIRT.

text: HOW TO SETUP UP CSIRT AND SOC

text: Guidance on maturity improvement is available from frameworks such as SIM3 and SOC-CMM and from ENISA, the Global Forum on Cyber Expertise (GFCE), the CERT Coordination Center (CERT/CC) and FIRST.org, among others.

text: With the knowledge of existing resources available for improvement initiatives, the management team of a CSIRT decides which initiatives to prioritise and approve and what resources to allocate, e.g. the budget and number of people. Examples of improvement initiatives for prioritisation are provided in Table 9.

text: Table 9: Examples of improvement initiatives for prioritisation

text: Budget

text: 49 Duration Initiative required( ) Justification Approved (months) (EUR)

text: HOW TO SETUP UP CSIRT AND SOC 2.6.2 Detailed plans for improvement initiatives for the design stage

text: After the improvement initiatives have been approved, the next step is to prepare detailed plans for the design stage.

text: In the case of external consultancy involvement, detailed requirements are often expressed as improvement project ToR in competitive tenders (RFI/RFP).

text: Requirements for the design stage outcomes must be specifically listed.

text: At this stage it is relevant to consider:

text: 1. The objectives of the improvement initiatives. 2. The clearly stated expectations of any improvements. 3. The expected implementation plan. 4. The experience required of experts carrying out similar work.

text: 2.6.3 Preliminary budget for improvement initiatives

text: The annual budget must incorporate any approved preliminary budget for improvement initiatives. This may be needed to cover the costs of internal staff, additional facilities, technology, external consultancy, administration, cooperation and marketing, and additional training.

text: The preliminary budget will guide resource and design constraints for the design phase activities during planning.

text: It is normal to expect that at least 15 % of the annual CSIRT budget will be spent on improvement initiatives for mature CSIRTs. For CSIRTs with a lower level of maturity, improvement initiatives usually make up at least 30 % of the CSIRT budget.

text: HOW TO SETUP UP CSIRT AND SOC

text: 3. CONCLUSIONS

text: This report presents guidelines for the establishment of CSIRTs and SOCs using a phased outcomes-driven approach, including many examples from established CSIRTs of the different phases of implementation.

text: Establishment is a continuous process. It is possible to identify the beginning of the process; however, the end stage consists of a continuous improvement cycle – to better serve the constituency, be more effective in operations and respond better to stakeholder needs.

text: The authors hope that this publication will inspire better CSIRT and SOC project management and provide clearer descriptions of the intermediate steps involved in the establishment of CSIRTs and SOCs.

text: Some challenges related to the establishment of CSIRTs and SOCs are not covered in this report and require additional work.

text: 1. This publication focuses on the establishment of a single CSIRT. However, a single CSIRT is usually part of an ecosystem of CSIRTs. Future research might focus on ecosystem buildout and value creation through partnerships and specialisation. 2. Sectorial CSIRTs are emerging in different sectors in many countries; however, there are currently too few data points and good practice guidelines available for guidance to be provided for different sector-specific CSIRTs. 3. There is too little relevant and practical guidance on blueprints for technology orchestration and automation of CSIRTs and SOCs. 4. The do-it-yourself approach to creating a CSIRT is still challenging because of the relevant expertise required, which is not easily available in many countries. It will be important to determine in the future how this can be overcome.

text: ENISA continues to support incident response teams by creating relevant content for CSIRTs..

text: HOW TO SETUP UP CSIRT AND SOC

text: 4. GLOSSARY AND ACRONYMS

text: Please refer to ENISA glossaries and lists of acronyms:  https://www.enisa.europa.eu/topics/threat-risk-management/risk-management/currentrisk/bcm-resilience/glossary  https://www.enisa.europa.eu/topics/csirts-in-europe/glossary  https://www.enisa.europa.eu/media/media-press-kits/enisa-glossary

text: HOW TO SETUP UP CSIRT AND SOC

text: 5. BIBLIOGRAPHY

text: Carnegie Mellon University, 2016, Create a CSIRT, Software Engineering Institute, Pittsburgh, PA. Cowley, C. and Pescatore, J., 2019, Common and best practices for security operations centers: Results of the 2019 SOC survey, SANS Institute. ENISA, 2006, A step-by-step approach on how to set up a CSIRT. (https://www.enisa.europa.eu/publications/csirt-setting-up-guide ) FIRST, 2019, Computer Security Incident Response Team (CSIRT) Services Framework (https://www.first.org/standards/frameworks/csirts/csirt_services_framework_v2.1 ). IETF Internet Engineering Task Force, 1998, RFC 2350 for CSIRT establishments. (https://tools.ietf.org/html/rfc2350 ) Internet Governance Forum, 2014, Best practice forum on establishing and supporting computer security incident response teams (CSIRTs) for internet security (https://www.intgovforum.org/multilingual/content/establishing-and-supporting-computer-incident-securityresponse-teams-csirts-for-internet ). MITRE, 2014, Ten strategies of a world-class cybersecurity operations center, MITRE, Bedford, MA. Morgus, R., Skierka, I., Hohmann, M. and Maurer, T., 2015, National CSIRTs and their role in computer security incident response, New America and GPPi. (https://www.researchgate.net/publication/323358191_National_CSIRTs_and_Their_Role_in_Computer_Secu rity_Incident_Response ) National Cyber Security Centre, 2015, CSIRT Maturity Kit, National Cyber Security Centre, the Hague. National Cyber Security Centre, 2017, Building a SOC: Start Small, National Cybersecurity Centre, the Hague. Organization of American States, 2016, Best Practices for Establishing a National CSIRT, OAS, Washington, D.C. Open CSIRT Foundation, 2008-2019, SIM3: Security Incident Management Maturity Model. (https://opencsirt.org/csirt-maturity/sim3-and-references/) Skierka, I., Morgus, R., Hohmann, M. and Maurer, T., 2015, CSIRT Basics for Policy-makers, New America and GPPi. (https://www.researchgate.net/publication/323358187_CSIRT_Basics_for_Policy-Makers ) Telecommunications Development Sector (ITU-D), 2020, ITU CIRT framework, International Telecommunication Union, Geneva. ThaiCERT, 2017, Establishing a CSIRT, Thailand Computer Emergency Response Team, Bangkok. TNO, 2017, GFCE global good practices: National computer security incident response teams (CSIRTs). (https://thegfce.org/wp-content/uploads/2020/06/NationalComputerSecurityIncidentResponseTeamsCSIRTs-1.pdf )

text: HOW TO SETUP UP CSIRT AND SOC

text: A ANNEX: QUESTIONNAIRE

text: Data collection using the questionnaire

text: The content of the report “Guidelines for establishing CSIRTs and SOCs” is based on the analysis of current publications on CSIRT establishment, the answers to this questionnaire and the authors’ experience in establishing and improvement CSIRTs over numerous projects in Europe, Asia, Africa and South America.

text: This field questionnaire (presented below) was published using the European Commission Questionnaire platform (the direct link to the questionnaire was https://ec.europa.eu/eusurvey/runner/HowtosetupCSIRTandSOC) and distributed to various CSIRTs and SOCs in different parts of the world, via sharing networks, as well as individually encouraging to participate. CSIRT and SOC teams were invited to fill it in via personal invitations as well as Trusted Introducer member and CIRTs Network communication.

text: During the set time for the questionnaire detailed responses were received from over 40 CSIRT and SOC teams from different geographic locations including various types of CSIRTs and SOCs (national, sectorial, internal to organization and other).

text: The questionnaire used

text: The objective of the questionnaire is to serve ENISA’s study on Guidelines to setup CSIRTs and SOCs. Responses are expected from at least 40 organizations and the received data will be processed and integrated with other methods of research. Some of the gathered data will be used in the ENISA CSIRT and SOC Setup Guidelines publication as a case study, an example, or statistically processed data.

text: The data is gathered in the European Commission Questionnaire platform, and will not be used, sold, or processed in any other way except for direct ENISA analysis, to serve its target:

text: “Since 2009, ENISA has carried out a considerable amount of work in CSIRT Capabilities and Maturity area, and this work contributes by shaping the role of ENISA in helping CSIRTs on their way to a higher maturity standard and advanced capabilities.”

text: To be filled by CSIRT or SOC team manager or assigned person.

text: You can answer only the questions you find relevant/interesting/on which you are willing to share your experience and expertise.

text: HOW TO SETUP UP CSIRT AND SOC

text: A.1 About your CSIRT/SOC team:

text: 1.1. Team / Organization name: (text box) 1.2. Country: (text box) 1.3. Type of CSIRT or SOC: National / Sectorial / MSSP / Internal to organization (multichoice choosing) 1.4. Team size: (text box) 1.5. Constituency of the CSIRT or SOC: (text box) 1.6. Year of establishment: (text box) 1.7. Contact email and/or phone, for clarifications if any: (text box) 1.8. Permission of data usage: Anonymous (i.e. without any attribution to the team) / Can be attributed to your team, but need to receive a prior confirmation for exact data to be attributed / all data is ok to be used in ENISA research and possibly attributed to your team)

text: A.2 Terminology questions:

text: 2.1. Does your organization operate a CSIRT or SOC, or both? (single choice) 2.2. If both, how are the roles split between CSIRT and SOC? (text box) 2.3. How do you perceive the difference between a CSIRT and a SOC as organizations? (text box)

text: A.3 CSIRT/SOC related knowledge questions:

text: 3.1. Which publications do you use or find relevant to implement capability and maturity improvements for your organization? (text box) 3.2. What publications and guidance from ENISA content do you find are missing on CSIRT and SOC topics for your effective work? (text box) 3.3. If you conduct a Coordinating CSIRT role (i.e. your team coordinates incidents, which are happening outside your institution/enterprise), what activities do you regularly conduct under such role? (Text box) 3.4. If you conduct Internal or MSSP CSIRT/SOC role (i.e. you handle your own institution/enterprise incidents or work as contractual MSSP), what activities you regularly conduct under such a role? (Text box) 3.5. If you outsource some functions of CSIRT/SOC, what are they? What is the motivation to outsource? (text box) 3.6. What kind of regular reporting are you delivering (please describe to whom (no names needed but general target group, for example – energy sector), what kind of content, and how often? For example, annual report to the public with statistics of incidents, quarterly to ENISA on CII threats, weekly vulnerability statistics to CISO, etc.) (Text box) 45

text: HOW TO SETUP UP CSIRT AND SOC

text: 3.7. Describe the information-sharing methods you have implemented in your operations (for example: website newsletters and alerts; provide customized MISP/IntelMQ based feed to CII subscribers; provide annual/quarterly statistics from internal/external sources on incidents/vulnerabilities and share it with constituency; have deployed PassiveDNS sensors and share resulting feed with passiveDNS community; contribute to FIRST.org MISP instance with OSINT and data from your investigations; deployed T-POT and share data with sicherheitstacho platform, etc.) (Text box)

text: 3.8. Do you run your tools on premises, in cloud (public or private), or mixed? What are your future plans regarding this topic? What is your opinion about the industry trend on this topic? (text box)

text: 3.9. Are orchestration and automation important objectives for your CSIRT/SOC? Do you currently or in future plans use SOAR-like tools?

text: 3.10. Do you operate 24/7? Do you see "follow-the-sun" as a solution (team spread in different time zones), at least for the future? (text box)

text: 3.11. Which open-source tools and for what objective are you using? Which and for what reason would you advocate them to other CSIRT/SOCs as especially valuable? (text box)

text: 3.12. Which commercial tools and for what objective you are using them? Which and for what reason you would advocate them to other CSIRT/SOCs as valuable? (text box)

text: 3.13. What are the main KPIs and their target levels you have implemented for your CSIRT/SOC operations? (text box)

text: 3.14. What were the main problems that you encountered when setting up your CSIRT or SOC? (text box)

text: 3.15. What actions would you take (or would recommend) to avoid the mentioned problems when setting up a new CSIRT or SOC? (text box)

text: 3.16. If you would have to establish a new CSIRT or SOC team in the same or a different organization, what activity priorities you would focus on? Please choose up to 5. (text box)

text: A.4 Staffing Roles:

text: 4.1. How many formal roles have you defined in your CSIRT/SOC organization? What are they, and what is their short description? (text box)

text: 4.2. What training for different roles (that you have defined earlier) do you recommend or consider before you consider the employee as a fully-prepared specialist at a specific role in your organization? (text box)

text: 4.3. What are the ongoing training paths for the current staff (ex. ad-hoc, organised in a particular order, etc.) (text box)

text: 4.4. What challenges do you face developing and arranging roles in your organization? (text box)

text: A.5 SIM3 and other CSIRT models related questions:

text: HOW TO SETUP UP CSIRT AND SOC

text: 5.1. About SIM3 model usage in your CSIRT or SOC organization: we do not know or use the model/it is somewhat used as a reference/it is our development guiding and maturity improvement model/we use alternative model;

text: 5.2. If you are using or planning to use SIM3 model in your organization: how has SIM3 created value for your organization so far? (text box)

text: 5.3. Please list what CSIRT/SOC services have you defined, implemented, are providing and measuring for your constituency? (text box)

text: 5.4. What Organizational and Personnel biggest challenges do you see for improving maturity of your CSIRT/SOC organisation? (text box)

text: 5.5. Which CSIRT/SOC operational processes have you formally documented and implemented (e.g. Incident Prevention Process, Incident Detection Process, Incident Resolution Process, Audit/Feedback Process, etc.)? (text box)

text: HOW TO SETUP UP CSIRT AND SOC December 2020

text: 6. B ANNEX: METHODOLOGY MAPPING

text: HOW TO SETUP UP CSIRT AND SOC HOW TO SETUP UP CSIRT AND SOC HOW TO SETUP UP CSIRT AND SOC HOW TO SETUP UP CSIRT AND SOC HOW TO SETUP UP CSIRT AND SOC HOW TO SETUP UP CSIRT AND SOC HOW TO SETUP UP CSIRT AND SOC

text: The acronyms used in the methodology mapping diagram are explained in the following table.

text: -N -EN -935 -20 2 P0 T

text: ABOUT ENIS A

text: ISBN 978-92-9204-410-7 DOI 10.2824/056764