How to set up CSIRT and SOC

HOW TO SETUP UP CSIRT AND SOC

GOOD PRACTICE GUIDE DECEMBER 2020 0 HOW TO SETUP UP CSIRT AND SOC

ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

CONTACT

For queries in relation to this study, please use: csirt-relations@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu.

AUTHORS

Edgars Taurins, ENISA. Activities supporting this study were conducted under contract with NRD Cyber Security.

ACKNOWLEDGEMENTS

Study was performed with the input from Informal Expert Group on EU Member States Incident Response Development.

LEGAL NOTICE

Notice must be taken that this publication represents the views and interpretations of ENISA unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 2019/881. This publication does not necessarily represent state-of-the-art and ENISA may update it from time to time.

Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

Copyright notice

© European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged.

For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

ISBN 978-92-9204-410-7 - DOI 10.2824/056764

HOW TO SETUP UP CSIRT AND SOC

TABLE OF CONTENTS

1. INTRODUCTION 5

1.1 CONTEXT OF THE WORK 5

1.2 OBJECTIVES OF THE WORK 5

1.3 OVERVIEW OF THE METHODOLOGY 6

1.4 DEFINITIONS OF CSIRT AND SOC 6

1.4.1 Computer security incident response teams 6 1.4.2 Security operations centres 7

1.5 PREVIOUS ENISA WORK ON THE TOPIC OF CSIRTS 9

2. GUIDELINES FOR ESTABLISHING CSIRTS 10

2.1 ORGANIZATION OF THE GUIDELINES 10

2.2 ASSESSMENT FOR READINESS 13

2.2.1 Preliminary mandate 14 2.2.2 Governance structure 16 2.2.3 Identification of the CSIRT hosting organisation 16 2.2.4 High-level roadmap and budget 16 2.2.5 Detailed requirements for the design stage 18

2.3 DESIGN 19

2.3.1 Approved detailed mandate 19 2.3.2 CSIRT services plan 20 2.3.3 CSIRT processes and workflows plan 21 2.3.4 CSIRT organisation, skills and training structure plan 26 2.3.5 CSIRT facilities plan 31 2.3.6 CSIRT technologies and processes automation plan 32 2.3.7 CSIRT cooperation plan 33 2.3.8 CSIRT IT and information security management plan 34 2.3.9 Detailed requirements for the implementation stage 34

2.4 IMPLEMENTATION 34

2.4.1 Approval and implementation of the organisational structure 34 2.4.2 Hiring and appointing of staff 35 2.4.3 Execution of a training plan for different staff roles 35 2.4.4 Preparation of facilities 35 2.4.5 Development and implementation of detailed processes and procedures 35 2.4.6 Implementation of technology for the automation of processes 35 2.4.7 Implementation of IT and information security management procedures 35 2.4.8 Training of staff for CSIRT operations 36

HOW TO SETUP UP CSIRT AND SOC

2.4.9 Signing of relevant agreements with the constituency, stakeholders and partners 36 2.4.10 Test run of CSIRT services and tuning of results 36 2.4.11 Launch of CSIRT communications and celebrations 36

2.5 OPERATIONS 37

2.5.1 Measurement of key performance indicators 37 2.5.2 Annual operations performance review 38 2.5.3 Annual stakeholder needs review 38 2.5.4 Approval of the annual budget 38 2.5.5 Collection of improvement initiatives 38

2.6 IMPROVEMENT 38

2.6.1 List of improvement initiatives 38 2.6.2 Detailed plans for improvement initiatives for the design stage 40 2.6.3 Preliminary budget for improvement initiatives 40

3. CONCLUSIONS 41 4. GLOSSARY AND ACRONYMS 42 5. BIBLIOGRAPHY 43 A ANNEX: QUESTIONNAIRE 44 6. B ANNEX: METHODOLOGY MAPPING 48 HOW TO SETUP UP CSIRT AND SOC

EXECUTIVE SUMMARY

This publication provides results-driven guidance for those who are interested in establishing a computer security incident response team (CSIRT) or security operations centre (SOC), and guidance on possible improvements for different types of CSIRTs and SOCs that exist currently.

The content of this report is based on an analysis of current publications on the establishment of CSIRTs (the analysis is summarised in Annex B); a field questionnaire (Annex A), which was completed by 40 CSIRTs and SOCs; and the authors’ experiences in establishing and improving CSIRTs as part of numerous projects carried out in Europe, Asia, Africa and South America.

A results-driven approach is taken throughout the publication to provide guidance on the different stages involved in the establishment of a CSIRT or SOC organisation:

 Assessment for readiness  Design  Implementation  Operations  Improvement.

The reader will receive practical guidance on what to focus on during the individual phases of establishment and improvement.

Up to July 2020, ENISA had published 61 reports and 21 translated versions of reports 1 2 supporting CSIRTs on its website ( ). ENISA’s training package ( ) provides online training materials, training courses and exercise materials for cybersecurity specialists, based on the ‘Train the Trainer’ philosophy. This document aims to enhance ENISA’s existing body of knowledge on the establishment of CSIRTs.

HOW TO SETUP UP CSIRT AND SOC

1. INTRODUCTION

1.1 CONTEXT OF THE WORK

Cybersecurity threats are increasing and becoming more complex. One of the most effective ways to counter these threats is by creating a global ecosystem of computer security incident response teams (CSIRTs) and security operations centres (SOCs) that can communicate, share

A more mature

information and respond to cyberthreats effectively. This can be facilitated by providing relevant

ecosystem of

frameworks and increasing the number of CSIRTs and SOCs around the world and the maturity

CSIRTs and

of existing CSIRTs and SOCs.

SOCs enables

In Europe, ENISA is assisting Member States with their incident response capabilities by better providing them with various resources, such as documents, tools, materials and guidance. For cooperation and example, ENISA hosts a European CSIRT inventory – an interactive map on ENISA’s website collective actions that gives an overview of publicly listed CSIRTs in Europe. In addition, the Study on CSIRT

to respond to

landscape and IR capabilities in Europe 2025( ) looks at the overall status of CSIRTs’ incident

cyber security

handling and response capabilities, while the EU Member States incident response

4 5 threats

development status report( ) provides an insight into the NIS Directive( ) (Directive (EU) 2016/1148 on security of network and information systems) sectoral incident response capabilities. ENISA has also carried out work in the field of national and governmental CSIRTs’ capabilities and incident response capabilities, including providing training material covering some aspects of the development of CSIRTs.

To provide additional resources, a decision was made to publish guidelines and produce an interactive online information repository to guide the establishment of different types of CSIRTs and SOCs by building on the existing work of ENISA, especially in the areas of maturity and training.

1.2 OBJECTIVES OF THE WORK

This publication provides results-driven guidance for those who are interested in establishing a CSIRT or SOC or modernising a CSIRT or SOC in a structured way.

A results-driven approach is taken throughout the publication to provide guidance on the different stages involved in the establishment of a CSIRT organisation: assessment for readiness, design, implementation, operation and improvement.

The expectation is that the reader will use this publication as a practical guide during the individual phases involved in the establishment of CSIRTs. Readers may be stakeholders of CSIRTs that are to be established.

This report aims to encourage the establishment of CSIRTs and SOCs and provide practical techniques to ensure that the establishment and improvement process is effective.

HOW TO SETUP UP CSIRT AND SOC 1.3 OVERVIEW OF THE METHODOLOGY

Existing documents on CSIRT establishment focus on activities to do, without elaborating much on the resulting outcome. This publication aims to build a recurring process of improvement and related deliverables during the growth and development of a CSIRT. It was designed in a way that provides guidance for all CSIRTs no matter what development stage they are in or their current maturity.

To achieve this result data gathering methods such as analysis of current publications on the establishment of CSIRTs (the analysis is summarised in Annex B); a field questionnaire aimed at established CSIRTs and SOCs (Annex A); and the authors’ and reviewers’ practical experience in establishing and improving CSIRTs, were used. The objective was to make this publication as close to real life as possible. For this reason citations from various CSIRT teams as well as realistic costing and timing were included.

FIRST.org CSIRT Services Framework, as well as SIM3 assessment model are referred to as companions in the process because they are widely respected when defining an initial service catalogue for new CSIRT teams and for the assessment and development of CSIRT maturity.

1.4 DEFINITIONS OF CSIRT AND SOC

The most common terms used to describe the teams responsible for incident response handling are CSIRT, CERT( ), and SOC.

1.4.1 Computer security incident response teams

The term CSIRT, or computer security incident response team, was established in the 1990s. CSIRTs are also known as CIRTs (Computer incident response teams), CERTs (Computer emergency response teams), SIRTs (Security incident response teams) among others. National teams may also be called national cyber security centres (NCSCs), which by law are usually assigned the CSIRT role as well as providing additional services for the nation (e.g. handling a country’s information classification schemes). Each team chooses its name based on the preference of the organisation.

CSIRT has become a generic name for a team that provides a set of services: information and cybersecurity incident handling (core service), security monitoring, vulnerability management, situational awareness and cybersecurity knowledge management.

In simpler terms, a CSIRT is a team that is assigned to handle computer security (thus, often, cybersecurity) incidents. Often this includes additional responsibilities, from detection to analysis, and even hands-on fixing, as well as different situational awareness, knowledge transfer and vulnerability management activities. Over the years, the role of a CSIRT has evolved from providing incident monitoring and handling services to coordinating and communicating with different stakeholders, countries and specific sectors.

Currently, FIRST.org hosts and continuously improves a CSIRT Services Framework ( ), which is a high-level document that describes the activities carried out by CSIRTs. These activities are organised into five main service areas, which are further split into services, functions and subfunctions. A CSIRT can choose which of the services and functions are relevant to their mandate and organise them into their own services structure. Although this framework does not define a SOC framework, services from some of the areas can also be applicable to SOC

HOW TO SETUP UP CSIRT AND SOC

teams. The CSIRT Services Framework is supported by ENISA, the International Telecommunications Union (ITU) and many other organisations.

Typically, a minimal set of services for CSIRTs usually includes those those in bold below in accordance with the FIRST services framework.

Figure 1: FIRST services framework – typical CSIRT services

1.4.2 Security operations centres

A SOC, or security operations centre, provides an incident detection service by observing

‘SOC is the first line,

technical events in networks and systems and can also be responsible for incident

they receive all alerts,

response and handling. In large enterprises, SOCs sometimes focus only on monitoring and detection services and then hand over incident handling to a separate CSIRT. In smaller whereas IRT would organisations, CSIRTs and SOCs are often considered to be synonymous. only receive escalated

alerts or be involved

Typically, SOC teams operate from SOC rooms, where analysts sit at their workstations in

in the coordination.

front of a video wall that projects a summary of the current situation (Figure 2). SOC teams

SOC is the

typically evolve from information technology (IT) security teams automating their work using

responsibility of our

security information and event management (SIEM) and other security automation and

members as we are a

orchestration technology for security monitoring. SOC teams usually focus their key performance indicators (KPIs) around quality indicators – detection speed, detection sector CERT’ breadth, coverage, false-positive rates – as well as incidents handled, the ratio of (sectorial CSIRT) alerts/events/incidents, number of escalations and workload per incident.

HOW TO SETUP UP CSIRT AND SOC

Figure 2: Multi-State Information Sharing & Analysis Center (MS-ISAC) SOC room. Source: MS-ISAC website (https://www.cisecurity.org/ms-isac/)

As well as operating physically, SOCs can consist of virtual and outsourced staff, or a hybrid model of internal and outsourced staff. It is common practice that, over time, SOCs alternate between outsourced and internal operations. As both CSIRT and SOC organisations adhere to the same CSIRT Services framework, both CSIRTs and SOCs are referred to this report as CSIRTs. Typically, a minimal set of services for SOCs usually includes those in bold below in accordance with the FIRST services framework. Figure 3: First service framework – Typical SOC services

HOW TO SETUP UP CSIRT AND SOC 1.5 PREVIOUS ENISA WORK ON THE TOPIC OF CSIRTS

Up to July 2020, ENISA had published 61 reports and 21 translated versions of reports about CSIRTs on its website ( ).

‘ENISA has excellent

The foundational document on the establishment of a CSIRT is the CSIRT Setting up

10 publications which

Guide ( ), published in 2006. It was translated into more than 20 languages, including Chinese and Hindi. This 86-page publication covers the step-by-step process of creating a are well organised CSIRT and is still valid today. and easy to read and

understand’

ENISA’s Good Practice Guide for Incident Management ( ), published in 2010, provides

(Unicom CSIRT)

guidelines for establishing incident handling management structures and capabilities; it can be used as a reference for establishment topics including incident handling processes and workflows.

ENISA’s training package ( ) provides online training materials, training courses and exercise materials for cybersecurity specialists, based on the ‘Train the Trainer’ philosophy.

ENISA has also published a body of knowledge for national and governmental CSIRTs on, for 13 14 example, baseline capabilities ( ) and maturity profiles ( ), as well as a self-assessment tool.

In the past few years, ENISA has published a guidance document on CSIRT and law

15 ‘Most of the

enforcement partnerships ( ), including an analysis of partnership models, technical

16 publications and

cooperation, electronic evidence analysis ( ) and training modules. In addition, further information on how to choose a CSIRT cooperation model and the technical implementation guidance from

of cooperation models is available from the ENISA website. ENISA is relevant to

our effective work.

This report aims to enhance ENISA’s existing body of knowledge on the establishment of

ENISA threat

CSIRTs. The content of this report is based on an analysis of previous publications on the

landscape is used

establishment of CSIRTs (the analysis is summarised in Annex B); a field questionnaire (Annex A), which was completed by 40 CSIRTs and SOCs; and the authors’ experiences in to set our threat establishing and improving CSIRTs as part of numerous projects carried out in Europe, baseline every year’

Asia, Africa and South America. (BGD e-GOV CIRT)

HOW TO SETUP UP CSIRT AND SOC

2. GUIDELINES FOR ESTABLISHING CSIRTS

2.1 ORGANIZATION OF THE GUIDELINES

The guidelines for establishing CSIRTs are organised according to the different phases of the CSIRT establishment ( ) process:

 Assessment for readiness  Design  Implementation  Operations  Improvement.

Figure 4: Lifecycle of CSIRT

The establishment of a new CSIRT starts with the ‘assessment for readiness’ phase, which begins with a discussion about the reasons and necessity for establishing a CSIRT and ends with the approval of an initial budget and shaping requirements for the design phase.

During the ‘design’ phase, detailed plans for the implementation phase are developed.

The ‘implementation’ phase covers organisational matters: governance, people, processes, services and technology.

In the ‘operations’ phase, a CSIRT delivers the CSIRT services.

Existing CSIRTs can follow the guidelines from the ‘improvement’ phase rather than from the ‘assessment for readiness’ phase.

During the ‘improvement’ phase, a CSIRT formulates requests for improvements, prioritises initiatives and receives an approved budged for following the ‘design–implementation– operation–improvement’ cycle.

HOW TO SETUP UP CSIRT AND SOC

These guidelines are organised based on the outcomes of each phase.

1. Assessment for Readiness

 Preliminary Mandate  Governance Structure  Identification of the CSIRT hosting organisation  High-level roadmap and budget  Detailed Requirements for the Design Stage

2. Design

 Approved Detailed Mandate  CSIRT Services Plan  CSIRT Processes and Workflows Plan  CSIRT Organisation, Skills and Training Structure Plan  CSIRT Facilities Plan  CSIRT Technologies and Processes Automation Plan  CSIRT Cooperation Plan  CSIRT IT and Information Security Management Plan  Detailed Requirements for the Implementation Stage

3. Implementation

 Approved and implemented organisational structure  Hired and appointed people  Executed training plan for the staff roles  Prepared facilities  Developed and Implemented detailed processes and procedures  Implemented technology for the automation of processes  Implemented IT and information security management procedures  Trained people for CSIRT operations  Signed relevant agreements with the constituency, stakeholders and partners  CSIRT services Test run and Tuning of results  CSIRT Launch Communication and Celebrations

4. Operation

 Measured KPIs  Annual Operations Performance Review  Annual Stakeholder Needs Review  Approval Annual Budget  Collected Requirements for Improvement

5. Improvement

 List of chosen Initaitves for improvement  Detailed Requirements for Improvement for Design Stage  Preliminary budget for Improvement

HOW TO SETUP UP CSIRT AND SOC

Figure 5: Summary of CSIRT establishment outcomes

HOW TO SETUP UP CSIRT AND SOC

Figure 6: Sample of CSIRT establishment phases and required efforts

Figure 6 shows a timeline for CSIRT establishment, the expected internal and external resources needed, and the intensity of work required for the different roles involved in each phase.

The percentages in Figure 6 represent the workload/time required for the different roles. For example, ‘1 x Project manager 50 %’ means that one project manager is required and that the required tasks will take up to 50 % of their maximum workload/time.

2.2 ASSESSMENT FOR READINESS

In the assessment for readiness phase, the following outcomes are expected.

 Preliminary mandate  Governance structure  Identification of the CSIRT hosting organisation  High-level roadmap and budget  Detailed requirements for the design stage

Figure 7: Implementation phases

HOW TO SETUP UP CSIRT AND SOC 2.2.1 Preliminary mandate

A CSIRT begins with a purpose – the initial idea and reasons why a CSIRT is needed. The establishment of a CSIRT must be justified.

The expectations of stakeholders and constituencies should be carefully considered before deciding to establish a CSIRT. In practice, this means considering the following aspects.

1. Identifying all major stakeholders and understanding their needs and expectations of a CSIRT. Depending on the stakeholder, their needs can include identification of incidents, security awareness, resolution of incidents and compliance with certain standards. 2. Identifying constituencies. This could be a small group of companies for a sectorial CSIRT, the residents of a city or even a whole country. Evaluating and meeting the needs and expectations of a specific constituency are extremely important for the success of a CSIRT.

A series of workshops should be planned with the main stakeholders and representatives of constituencies in order to obtain their support for the establishment of a CSIRT and to start a conversation about the real value that a CSIRT could bring. This can then be used as input for justifying the establishment of a CSIRT and for its mandate and budgeting.

Common justifications for establishing a CSIRT include:

1. The need to organise cybersecurity incident handing in a professional way to minimise the impact of incidents. 2. The need to have a professional team to respond to cybersecurity incidents using internationally accepted incident handling methods. 3. The need to be trusted by other CSIRTs around the world during incident investigations. 4. The need to have a coordinating team for cybersecurity incident handling, vulnerability handling, situational and security awareness rising and analysis of threats.

A team’s purpose is determined in a CSIRT mandate, which must include the authority and responsibilities given to the team.

A mandate usually includes:

1. The authority given to a CSIRT to serve and act in a constituency. 2. The responsibilities of the CSIRT. 3. Requirements, objectives and tasks.

For a CSIRT with internal-only constituencies in an organisation or a managed security service provider (MSSP) set-up, the mandate is usually expressed in a single document of one of the following types:

1. An office order (in a government agency). 2. A decision or resolution by the board or executive management (in a private enterprise).

HOW TO SETUP UP CSIRT AND SOC

For sectoral or national CSIRTs, the mandate is usually expressed in at least two documents, namely:

1. A cybersecurity strategy, law or by-law, or government order assigning authority and overall responsibility (the only way to establish authority over a country’s different organisations). 2. An office order of the CSIRT hosting organisation, outlining the detailed requirements, objectives and tasks and a list of services.

The following additional guidance on the mandate should also be followed.

1. The responsibilities of a CSIRT must be stated. Simply stating that a CSIRT is being established is not enough; the mandate should also indicate what its responsibilities are and why it is needed. 2. The responsibilities should indicate which overall constituency a CSIRT will serve, for example a CSIRT for the financial sector for cyberthreat management, threat information sharing and critical incident coordination, or a CSIRT for internal business divisions for cybersecurity monitoring and incident handling. 3. An authorised body must issue authority to a CSIRT. For sectoral or national CSIRTs this might be the national government, the parliament or a ministry. 4. An organisation or a business unit must be assigned to establish a CSIRT. Sometimes this might be a new organisation.

For national governments or sectoral regulators, the development of a mandate usually begins with drafting of a law, bill, cybersecurity strategy or cybersecurity plan.

For organisational CSIRTs, the development of a mandate usually begins after receiving approval to establish a CSIRT from the management board or C-level executives, starting with the purpose why it is being established.

An approved mandate of authority and responsibility usually indicates a person, unit or organisation that will lead the establishment of a CSIRT.

Examples of phrases typically used in mandate documents include the following.

1. Cybersecurity has become very important; thus, a CSIRT is being established to increase the resilience of information systems to cyberattacks; manage cyberthreats; work on lowering the costs of the impact of incidents by establishing strong incident management controls; improve know-how; foster collaboration between stakeholders; and ensure cyber situational awareness and cyber situational visibility. 2. A sectoral (national, organisational) CSIRT is being established by modernising the current IT security unit to provide effective cyber resilience, organise incident responses, enable cyber situational awareness and establish cyber information exchange channels with partner organisations.

For EU Member States, NIS Directive Annexes I and II present the requirements, tasks and mandatory constituencies of national CSIRTs; the high-level responsibility of CSIRTs is described as follows: ‘responsible for risk and incident handling in accordance with a welldefined process’.

HOW TO SETUP UP CSIRT AND SOC

Examples of mandates for the establishment of a CSIRT include:

 btCIRT ( ) – national CIRT of Bhutan, established by government order.  BGD e-GOV CIRT ( ) – Bangladesh government sectorial CSIRT, established by office order.

Additional guidance on mandates and responsibilities can be found in ENISA’s Good Practice Guide for Incident Management (2010), Section 5.4.

2.2.2 Governance structure

The governance structure defines the responsibilities of the CSIRT’s stakeholders. It can be presented as a planning document or even as part of the mandate.

The governance structure document should provide answers to a number of questions.

1. Who will provide funding for the establishment and operations of a CSIRT and on what grounds? 2. Who will provide direction, monitoring and oversight of the CSIRT? 3. What types of agreements should the CSIRT have and with which stakeholders (e.g. law enforcement, intelligence agencies, international organisations, technology partners, academia)? 4. Who will the CSIRT report to, how often and in what form?

The owner of the CSIRT governance structure is usually the hosting organisation.

The governance structure is usually clarified during the workshops held to discuss the mandate with various stakeholders.

2.2.3 Identification of the CSIRT hosting organisation

The CSIRT hosting organisation is usually mentioned in the preliminary mandate. The hosting organisation might already exist or might need to be set up.

If a new hosting organisation is being established, the CSIRT budget can be approved only after the organisation is functional in terms of setting up management and legal processes, meaning that additional time will be required at this stage.

When choosing an organisation to host a CSIRT, the organisation’s authority to deliver the services in accordance with the CSIRT’s mandate must be evaluated.

2.2.4 High-level roadmap and budget

After the mandate is defined, a high-level roadmap and budget must be approved.

The roadmap should include an expected timeline for the CSIRT establishment phases – design, implementation and operations – and further improvement initiatives.

HOW TO SETUP UP CSIRT AND SOC

Figure 8: Roadmap example

Commonly, it takes 2–3 years from development of the preliminary mandate to initial mandate approval when a CSIRT becomes fully operational. This includes the following steps:

1. Budget approval, setting up of facilities, organisation establishment and initial hiring can take up to 1 year. 2. Design and implementation usually take 1–2 years, especially if the assistance of external consultants and technology has to be acquired through public tenders.

The budget for the initial year, which is spent on the establishment of the CSIRT and initial services, should cover at least:

1. Initial staff salaries – at least for the minimum required personnel (CSIRT manager, CSIRT establishment project manager, administrative assistant). 2. Facility establishment costs. 3. Salaries or consultancy service fees for creating the design stage results (legal processes, CSIRT-related expertise, technology deployment). 4. CSIRT skills acquisition recruitment and training. 5. Preliminary technology and licences.

‘We operate 24/7’

The budget should be adjusted according to the roadmap, mandate, stakeholder (national CSIRT) commitment and requirements for how quickly the CSIRT should be established.

The budget should be adjusted again once the design phase has finished and when the detailed plans are prepared for the implementation and operations phases. For example, if the budget is insufficient, some aspects can be moved to the further improvement phase in the roadmap.

The following notes provide indicative costings for 2020. Cost estimates are done for illustrative purposes only and does not depict any particular country.

1. In EU countries, a CSIRT staff member (including managers) costs on average EUR 40 000–60 000 per year. 2. Small CSIRT operations with three staff members (manager, two incident handlers) should budget around EUR 120 000–180 000 annually. 3. If a CSIRT is required to provide operations 24/7 for 365 days a year, it needs at least 12 additional employees (six teams of two staff members to cover 24/7, with each shift covering 8 hours). This will add EUR 480 000 annually to the budget. 4. CSIRTs typically employ the following numbers of staff: small – 3–7, medium – 10–15, large – 30–60, depending on the constituency size and mandate. 5. The cost of office rental is normally around EUR 3 000–4 000 per staff member per year.

HOW TO SETUP UP CSIRT AND SOC

6. It is common to spend EUR 3 000–10 000 on staff training per person per year. Attending conferences is highly recommended (one event per person per year).

7. Depending on the scope, consultancy services for the establishment of a CSIRT (design and implementation) can cost from EUR 75 000 to EUR 1 000 000 over a 1- to 3-year period.

8. It is common to spend EUR 100 000–300 000 on technology: hardware (at least two servers with virtualisation, backup solutions, firewalls, computers, printers), networking and specialised equipment for performing specific CSIRT operations (digital forensics, reverse engineering, vulnerability assessment, etc.). Using cloud services can be an effective way to limit initial investments in hardware, by allowing spending only on what is actually being used.

9. With regard to software components, CSIRTs might begin by using mostly opensource solutions, using commercial tools only if there are no comparative alternatives or for their better effectiveness. In this case, the budget for software and software services should start at EUR 50 000. If CSIRTs are focusing on commercial technology, the budget should be increased; however, focusing on commercial technology can result in higher productivity, i.e. fewer staff members are required.

The initial amounts in the budget and the time period over which the budget should be spent may change over time. Design phase activities will be bound by the approved budget available.

The approved budget will impact the final detailed mandate, as an organisation can achieve the anticipated results only when a sufficient budget is made available. The discrepancy between the detailed mandate and the budget is a common reason why CSIRTs do not fulfil their mandate.

It may take 3 years for a CSIRT to become operational, so the budget should reflect the expected intensity of the CSIRT establishment process.

2.2.5 Detailed requirements for the design stage ‘We buy some

The design phase activities will be based on the requirements and constraints of the CSIRT,

such as: specific services from vendors on

1. The agreed mandate. behalf of the 2. The roadmap and budget.

whole sector, e.g.

3. The people, competences and resources allocated to the design phase.

TI for specific geographical

These must be validated and approved.

regions/actors;

When external consultancy work is involved, the detailed requirements are often expressed sandboxes, as the consultancy project terms of reference (ToR) for a competitive tender (request for takedown of information (RFI)/request for proposal (RFP)). domains, etc.’

(sectorial CSIRT)

When preparing the ToR for such work, it is relevant to include:

1. The mandate definition of the CSIRT. 2. A clear statement of the expected results. 3. The expected delivery plan. 4. The experience required from the consultants from delivering similar activities.

HOW TO SETUP UP CSIRT AND SOC 2.3 DESIGN

The design phase prerequisites are all of the outcomes from the assessment for readiness phase.

The design phase recommendations are aligned with SIM3 (security incident management maturity model which estimates how well a team governs, documents, performs and measures their function), covering all four areas – organisation, human, tools and processes – in sequence, as presented below. This guidance does not provide specific advice on how to reach the maturity levels, as this information can be found in the SIM3 assessment tools from 21 22 ENISA ( ) or the Open CSIRT Foundation ( ).

In the design phase, the following outcomes are expected, in the form of either separate approved documents or one approved document.

1. Approved detailed mandate 2. CSIRT services plan 3. CSIRT processes and workflows plan 4. CSIRT organisation, skills and training structure plan 5. CSIRT facilities plan 6. CSIRT technologies and processes automation plan 7. CSIRT cooperation plan 8. CSIRT IT and information security management plan 9. Detailed requirements for the implementation stage

In addition, the resulting design structure is often published in RFC 2350 format ( ) – this is the de facto format for the formal presentation of a CSIRT, covering the team name, contact information, the time zone, PGP (pretty good privacy) keys, the mandate (charter), policies and services, etc. It is good practice for a CSIRT to publish the RFC 2350 document on its own website.

2.3.1 Approved detailed mandate

The design phase is based on the requirements of the CSIRT mandate, which might still be in final discussions or might include some broad overarching statements. In this phase it must be ensured that final approval has been granted (e.g. the mandate has been signed by the minister, or board of directors, or executive) and that the mandate is clear and easy to understand and sets out:

1. The authority given to a CSIRT to serve and act in its constituency. 2. The responsibilities of the CSIRT. 3. The requirements, objectives and tasks.

The approval of the mandate, together with the budget constraints and the initial roadmap for establishment of the CSIRT, allows for successful preparation of the design.

A detailed mandate might indicate how to name a CSIRT, as described below.

1. The name of the organisation should reflect the mandate, ensuring that it is clearly formulated and includes the role of the CSIRT. 2. The type of constituency covered is often reflected in the name; for example, national CSIRTs are often named using the two-letter country code and the CSIRT/CIRT/CERT

HOW TO SETUP UP CSIRT AND SOC

abbreviation, joined by a dash, a dot or some other symbol, e.g. CERT-LV, CERT-MU, SK-CERT. The sector is often included too in a shortened form; for example, the financial sector would be FinCIRT or FS-CSIRT, with the country additionally named using the two-letter country code, e.g. EG (EG-FinCIRT). 3. Often, a name is chosen based on a short company or organisation name and adding CSIRT, for example Adidas CSIRT, CSIRT BNP Paribas. 4. A CSIRT is often referred to as a CIRT, CERT or SIRT. Such organisations must provide an incident handling (response) service. 5. The SOC name is usually used for organisations that monitor operations for the security of networks and data centres, for example NestleSOC, TDC SOC. Recently, 24 25 names such as iSOC ( ) and gSOC ( ) have also been used. 6. When the primary function of an incident response team is to handle the vulnerabilities of the products of a certain company, it is usually referred to as a PSIRT ( ), for example Adobe PSIRT, NVIDIA PSIRT, Fujitsu PSIRT. Separate guidance on PSIRTs has been created by FIRST.org ( ). 7. Examples of existing team names are available on the FIRST.org ( ), Trusted 29 30 Introducer ( ) and ENISA CSIRTs Map . 8. If the chosen name includes the CERT abbreviation, a request for approval must be submitted to the CERT trademark owner SEI ( ) (the SEI policy may be amended in the future).

2.3.2 CSIRT services plan

The CSIRT services plan explains which services a CSIRT organisation will provide to a constituency to fulfil the roles and responsibilities defined in the mandate and adhere to the roadmap and budget constraints.

Figure 9: FIRST services framework

HOW TO SETUP UP CSIRT AND SOC

The following guidelines are provided for preparation of the CSIRT services plan.

1. CSIRT should take a look at the latest version of the FIRST.org CSIRT Services Framework ( ). This document is now available in several languages. This document presents the conceptual CSIRT services map, as presented below. 2. Choose which service areas (out of five) and which exact services the CSIRT should provide to fulfil the specific mandate stipulations. 3. Select and adjust the names of the service areas as the names provided in the CSIRT Services Framework may be too detailed initially. For example, when looking at the information security event management service area for SOCs, one might decide to consolidate both services (monitoring and detection and event analysis) into one entity and to rename the service area as security monitoring. Similarly, within the information security incident management service area, one might choose to include two services: incident handling service and artefact analysis. 4. Validate the list of resulting services to ensure that all of the mandate requirements are covered and that it does not include more services than the mandate requires. The resources of CSIRTs are limited; therefore, it is reasonable to concentrate on what is mandatory to ensure the provision of good-quality services for which proper authority has been provided.

The list of chosen CSIRT services should be listed in a CSIRT services catalogue. ITIL On activities: (information technology infrastructure library) methodology may be of value to organise the

‘incident response,

delivery of services. It is important to clearly understand the distinction between the different

monitoring sensor

meanings of the word ‘incident’ – in CSIRTs, ‘incident handling’ is the name of the service,

network, dispatching

while in ITIL methodology ‘incident’ means a disturbance to service delivery, i.e. that the service cannot be delivered, with the ‘incident’ being closed when the service is recovered. notifications,

constituency

Realistically, CSIRTs must ensure that good-quality services are delivered and, if these building, awareness services are disrupted, they are rapidly recovered. For example, if a CSIRT IT system fails,

raising and

this could be recovered using an internal IT support process according to ITIL principles.

education, training and cyber exercises’ 2.3.3 CSIRT processes and workflows plan (national CSIRT)

CSIRT processes are needed to implement and support agreed CSIRT services.

Typically, each type of service delivery is implemented using at least one process. More than one process may be required to deliver a service if, for example, service provisioning requires several working groups to be involved, or specific intermediate goals must be reached.

Some processes may be established as supportive processes, for example, an IT support process for maintaining and updating CSIRT IT infrastructure. This process can be handled using ITIL methodology, using a separate IT services catalogue (not to be confused with a CSIRT services catalogue).

The interrelationships between the identified processes should be analysed and documented. For example, the output from the security monitoring process is an identified incident that is handed over to the incident handling process as input; the artefact analysis process can be initiated from the incident handling process when needed.

HOW TO SETUP UP CSIRT AND SOC

Each process consists of one or more workflows, represented by workflow diagrams, depicting each step from the start until the final phase of activity. In addition, it is common to provide a tabular description of each step.

An example of a security incident handling workflow diagram, taken from ENISA’s Good Practice Guide for Incident Management (2010), is provided below.

Figure 10: Incident handling workflow example

An example of an interrelationship diagram for different services and processes is presented in Figure 11.

When designing processes and workflows, the human parameters of SIM3, the ENISA CSIRT 34 35 maturity assessment model ( ) and the SOC capability and maturity model (SOC-CMM) ( ) might be relevant tools for validating their completeness and coverage.

HOW TO SETUP UP CSIRT AND SOC

Figure 11: Services/processes interrelationship diagram for an internal CSIRT

Examples of security incident handling and security monitoring processes, which are used for implementing security incident management and security monitoring services, are provided in Tables 1 and 2, respectively. Process definitions are adapted to the needs of CSIRTs.

Table 1: Examples of security incident handling processes

HOW TO SETUP UP CSIRT AND SOC

The process is then usually constructed as a workflow diagram.

Figure 12: A simple security incident management process workflow diagram

Table 2: Examples of security incident monitoring processes

HOW TO SETUP UP CSIRT AND SOC

Figure 13: A simple security monitoring process workflow diagram

Example guidelines for intrusion incident handling are presented in Table 3.

Table 3: Example guidelines for intrusion incident handling

Section Description

HOW TO SETUP UP CSIRT AND SOC 2.3.4 CSIRT organisation, skills and training structure plan

The CSIRT processes are run by CSIRT staff, who are organised into particular organisational structures.

Figure 14: Example of a small CSIRT structure

Smaller CSIRTs of up to five to seven people are mostly organised as one unit run by a unit Staff training: manager (Figure 15). In this case, staff roles may be based on the NIST NICE framework’s

‘TRANSITS I and II

Cyber Defence Incident Responder work roles (PR-CIR-001) ( ).

for all plus internal policies/procedures

Figure 15: Example of organisational units for a bigger CSIRT

to use tools and communicate with rest of the team’ (ISP CSIRT)

For larger CSIRT organisations of over 10 people, the structural units should be designed according to the services structure or the activities run or other organisational practices (Figure 16). Again, the NIST NICE roles may serve as a starting point for defining staff roles.

HOW TO SETUP UP CSIRT AND SOC

It should be noted that 24/7 shift work can become very expensive, as six teams are required to cover the 8-hour shifts, including holidays. Thus, CSIRTs often use one of following operating procedures:

1. Operate only during normal business hours. 2. Have someone on duty to monitor calls or emergency escalations. 3. Outsource night and weekend registration monitoring to an external party for initial triage. 4. Rely on existing 24/7 network operations centre operations to process initial calls according to typical basic standard operating procedures (SOPs) and call experts if needed if a duty phone is in operation.

ENISA has developed around 50 training courses on CSIRT-related topics, which are provided

ENISA has

for free on their website ( ). These training materials cover technical and operational aspects,

developed around

setting up a CSIRT, legal and cooperation aspects, and guidance on, for example, proactive

50 free training

training for CSIRTs and training methodologies. All of the training materials are licensed under

courses on CSIRT

a Creative Commons BY-NC-SA 4.0 license, i.e. they are open for use by anyone under attribution to ENISA. However, the training materials are non-commercial and thus are most topics, which are useful for internal training delivered by CSIRT senior staff members. available at ENISA

Trainings for

Similarly, FIRST.org provides an increasing number of training courses on its website

Cybersecurity

education pages ( ), under the same licence terms. Also GEANT provides training for CSIRTs

Specialists, see:

TRANSITS I and TRANSITS II

ENISA - Online

Suggested technical training courses and laboratories for incident handlers are provided in

training material

Tables 4 and 5.

Table 4: Suggested training courses for CSIRT incident handlers

Role/skills Training course Provider

Duty officer, incident handler

HOW TO SETUP UP CSIRT AND SOC

Role/skills Training course Provider

Senior incident handler

Incident handling manager

HOW TO SETUP UP CSIRT AND SOC

Role/skills Training course Provider

Table 5: Suggested training laboratories for CSIRT incident handlers

Title Description Target group

The training suggested for developing technical skills is not sufficient to enable the successful operation of a CSIRT. In addition, each CSIRT must develop comprehensive professional, leadership and operational skills during the implementation phase using the following means.

1. Knowledge transfer by implementation experts in the form of workshops, training, mentoring and post-implementation support. 2. Visits to other CSIRTs to learn about their operations. At least two to three visits to When hiring: CSIRTs in other countries should be planned. Visits usually last for a few hours and ‘Typically we

are focused on sharing operational experience. Some CSIRTs carry out staff

ask for CISSP’

exchanges to build knowledge.

(CSIRT)

All CSIRT staff members must develop professional competences, as described in the NIST NICE framework (where KSA stands for knowledge, skills, and abilities) (Table 6).

HOW TO SETUP UP CSIRT AND SOC

Table 6: Essential professional competences for CSIRT staff members

Competency Description

CSIRT management and administrative staff must develop their leadership and operational competences, for example as indicated in the NIST NICE framework (Tables 7 and 8).

Table 7: Essential leadership competences for CSIRT management and administrative staff

Competency Description

Table 8: Essential operational competences for CSIRT management and administrative staff

Competency Description

HOW TO SETUP UP CSIRT AND SOC

Competency Description

All of these competences can be acquired through participation in locally provided academic or online courses or integrated programmes. For example, Coursera.org provides more than 1 000 courses on leadership.

2.3.5 CSIRT facilities plan

Secure facilities with separate workspaces and clear physical rules and regulations are essential for the efficient functioning of CSIRTs.

At a minimum the CSIRT facilities should include a data room to house any technology, an office room for incident handling staff, and a guest reception or meeting room.

To enable business continuity, the continuity of the CSIRT infrastructure should be ensured. To this end, redundant systems and backup working space should be available.

The following must be taken into consideration when planning facilities.

1. Physical security should be considered and proper access control and monitoring should be established. In addition, a risk assessment should be performed based on neighbouring facilities. 2. The data room must provide a level of physical and environmental security that is appropriate to the data that the CSIRT will possess and manage. 3. The office room for incident handling staff must provide an appropriate, convenient and secure working environment by ensuring the ‘least required privilege’ access for personnel.

CSIRTs must implement appropriate physical security measures, such as ensuring perimeter control of the premises and providing access controls for entry into the different rooms for reasons of confidentiality.

HOW TO SETUP UP CSIRT AND SOC

Additional sources of information on physical security requirements are the ISO 27001 standard from the International Organization for Standardization, Field Manual FM 3-19.30 and national regulations. Organisations should refer to their internal safety or physical security teams for further advice on implementation of security measures.

Larger CSIRTs may have separate zones for a digital forensics and incident response (DFIR) laboratory, security monitoring (a SOC room), a crisis room and a visitors’ room.

Figure 16: Example layout of the internal rooms for a CSIRT On tools:

‘MISP for threat information sharing. Elastic to analyze data. matrix.org as internal communications platform. Gitlab for internal projects management. BBB for video conferencing. Commercial feeds and tools for specific tasks if no viable open source alternative exists.’ (national CSIRT) 2.3.6 CSIRT technologies and processes automation plan

A CSIRT’s success depends heavily on the automation of its processes. Generic IT automation processes are used for workplaces and office work. There are also specific CSIRT processes related to automation.

A typical CSIRT should adhere to the following practices with regard to its technical infrastructure.

1. As an on-premises data centre solution, a CSIRT must have at least two virtualisation servers to ensure high availability and recovery. In case one fails, backups are performed on a third server using tapes or an alternative solution, located in a different room. 2. Network segmentation must ensure that data centre production systems, the LAN (local area network), the guest network, the laboratory and the DMZ (demilitarised zone) are separated accordingly via firewall rules. 3. CSIRTs and SOCs are often cautious about using cloud systems extensively, as shown by the survey responses. Cloud services are mandatory at least for SaaS (software-as-a-service) services, for example data feeds from external dataset providers or websites used for interaction. Use of cloud services often results in availability, cost and operational efficiencies, with less data governance. Depending on a CSIRT’s data security needs and risk appetite, different cloud services may be utilised.

HOW TO SETUP UP CSIRT AND SOC

Often, automation needs fall into the following areas:

‘Automation makes the analysis of a big

1. ticketing systems for incident report registration and handling – typically, CSIRTs use

incident easier and

RTIR, OTRS, ServiceNow and Jira, among other ticketing technologies.

more efficient.

2. data feed processing and routing – feed routers, threat intelligence platforms or dataset repositories are used. Automation helps 3. alert and awareness bulletin publishing platforms – these include website portals, with the daily tasks, publishing platforms and social media channels. allowing manpower

to concentrate on 2.3.7 CSIRT cooperation plan malware analysis,

A CSIRT’s success depends heavily on implementing effective working partnerships with

forensic analysis

different stakeholders and the international CSIRT community.

and more training.’

After establishment, a CSIRT might not be known by all stakeholders and constituencies; (CSIRT-CY) thus, it must actively approach stakeholders and constituencies and build cooperation arrangements. Some of these cooperation initiatives will result in the signing of formal memorandums of understanding (MoUs) or partnership agreements, or in formal and informal memberships of associations and information sharing communities.

‘Anyrun for

Trust-based and long-lasting partnerships require planning, including clear objectives from each partnership and strategies for how to maintain the relationships. sandboxing,

Recorded Future

The guidelines set out below should be followed. for threat stream’

(MSSP SOC)

1. A proactive approach to building partnerships with local and international law enforcement and intelligence agencies might help to handle cybercrime incidents or advanced persistent threats (APTs) more effectively in crisis situations. 2. Regional and national (if any) CSIRT initiatives for improving cooperation should be 43 44 , considered. The Trusted Introducer listed status ( ) ( ) is relatively easy to achieve for a CSIRT that is already operational and that has the support of other CSIRTs and participates in CSIRT-related events and conferences. CSIRTs should subsequently 45 46 focus on attaining accredited status ( ) or even certified status ( ), The Trusted Introducer scheme is the only certification scheme currently available for CSIRTs and Trusted Introducer services are more focused to CSIRTs operating in Europe. 3. It is strongly advised that CSIRTs join the FIRST.org association as this is the major global association for CSIRTs. 4. Proactively approaching different ISAC( )s for partnering and exploring the value of such partnerships is often a good way to determine what partnerships will be valuable. 5. The structure of MoUs and partnership agreements can usually be divided into three parts: a. the objectives of partnering – this can reflect the mandates of both parties; b. what each of the parties will be doing in relation to each other, for example invite each other to training sessions, share knowledge, participate in workshops and exercises, share indicators, respond to inquiries about collaboration on incidents; c. an initial action plan and timeline, to be executed after signing of the MoU or agreement, which includes a joint evaluation of the agreement and planning of the following year’s activities.

HOW TO SETUP UP CSIRT AND SOC

6. For cooperation to work, related activities, for example organising, travel, hosting, workshops and informal socialising, must have a dedicated budget as part of the annual budget.

2.3.8 CSIRT IT and information security management plan

CSIRTs should implement an IT and information security management plan or adopt and adapt the IT security framework from the hosting organisation.

It is recommended that CSIRTs adhere to industry good practices, for example ISO 27001-based information security management systems (ISMS).

The IT management plan might adhere to COBIT( ) (control objectives for information and related technology) and ITIL principles and methods.

2.3.9 Detailed requirements for the implementation stage

The results of the design plans should be included in the requirements for implementation, explaining in more detail:

1. What the requirements are and how they should be implemented. 2. What precise outcomes should be achieved.

The detailed requirements might be included as ToR.

2.4 IMPLEMENTATION

The implementation phase focuses on rolling out all services, enabling processes, preparing detailed procedures and training staff members.

At the end of the implementation phase, the CSIRT is ready to deliver services to its constituency and start the operations phase.

In the implementation phase, the following outcomes are expected.

1. Approval and implementation of the organisational structure. 2. Hiring and appointing of staff. 3. Execution of a training plan for different staff roles. 4. Preparation of facilities. 5. Development and implementation of detailed processes and procedures. 6. Implementation of technology for the automation of processes. 7. Implementation of IT and information security management procedures. 8. Training of staff for CSIRT operations. 9. Signing of relevant agreements with the constituency, stakeholders and partners.

10. Test run of CSIRT services and tuning of results.

11. Launch of CSIRT communications and celebrations.

2.4.1 Approval and implementation of the organisational structure

For a CSIRT to become operational, the designed organisational structure must be approved and the different positions defined.

HOW TO SETUP UP CSIRT AND SOC

Sometimes this process can take months; thus, an organisation might begin work using an interim structure, to enable work to progress without it being dependent on the CSIRT establishment process.

For example, hiring can begin using an existing structure, with a clear plan of how resources will be moved later, or by adjusting the initial services plan if a smaller number of staff are available.

2.4.2 Hiring and appointing of staff

The new structure must be filled with competent and skilled staff. It is highly likely that ‘SEI has a number of only a few positions will be filled with current staff; thus, additional staff members must

open source tools on its

be hired.

github site. These include SiLK,

Usually, there is a lot of interest from those wanting to work for a newly established

Cyberticket Studio,

CSIRT and gain professional experience; however, potential recruits often lack the

required competences. Cyobstract, and others. We have a network

As for other positions, it is important to hire staff showing a determination and

situational awareness

willingness to provide services in a professional manner.

suite of tools: https://tools.netsa.cert.o 2.4.3 Execution of a training plan for different staff roles rg/ We also use MISP’

All CSIRT staff must have the initial skills needed for their roles. To upskill staff, the designed training plan should support implementation of, and participation by staff (CERT/CC) members in, standard training sessions, conferences and workshops.

Additional training for CSIRT operations – processes, and SOPs – must also be run.

2.4.4 Preparation of facilities

CSIRT facilities must be prepared according to the approved plan, taking into account physical security and appropriate accesss rights.

Some teams choose to brand their facilities with logos and recognisable marks, whereas other teams, especially if hosted in a national security area, do not provide any markings on their buildings; the CSIRT is visible only inside the premises.

2.4.5 Development and implementation of detailed processes and procedures

Planned CSIRT processes are implemented in the form of established procedures.

Some of the typical activities that are repeated are defined in SOPs and automated using technology.

2.4.6 Implementation of technology for the automation of processes

Technology implementation is carried out by installing, configuring, documenting and testing technologies.

CSIRTs use open-source software extensively, often written or contributed by other CSIRT members.

2.4.7 Implementation of IT and information security management procedures

CSIRTs must define and implement detailed procedures for IT and information security management.

HOW TO SETUP UP CSIRT AND SOC

A common challenge is that core CSIRT services and processes are a priority in the implementation phase, while IT support and internal security management processes and procedures usually receive less attention initially. Thus, it is expected that these processes and procedures will require further improvements.

When a CSIRT is part of a larger organisation, the hosting organisation’s IT processes and information security management system can be adopted into practice.

2.4.8 Training of staff for CSIRT operations

Extensive hands-on and theoretical knowledge transfer to CSIRT members with regard to implemented technologies and procedures is crucial for establishment success.

Knowledge transfer activities are usually run in the form of hands-on workshops, where all processes and procedures are explained and practised.

Further training can be carried out and identification of skills gaps achieved using crisis drills and blue–red–purple teaming exercises.

2.4.9 Signing of relevant agreements with the constituency, stakeholders and partners

During the execution of a CSIRT partnership plan, there might be a need for the implementation of additional policies and procedures.

FIRST.org and Trusted Introducer membership applications should be submitted as soon as they are ready and the requirements for functional and operational readiness have been fulfilled. It may take a few months for the membership applications to be approved.

The building up and maintenance of partnerships require active participation and communication and should be overseen by the CSIRT manager or, in case of larger CSIRTs, the partnership manager.

2.4.10 Test run of CSIRT services and tuning of results

Once the processes and technologies have been implemented it is important to run tests for at least a day and provide notifications of any deficiencies in processes and technologies in the test run report. Tuning actions should then be carried out, that is, adjustments should be made to processes, workflows and technology implementation as appropriate.

Irrespective of the initial preparations and planning, the results often reveal that some design presumptions were not correct and some implementation activities must be modified.

2.4.11 Launch of CSIRT communications and celebrations

Once implementation has been completed, the CSIRT’s operations can begin. It is important to communicate properly about the new CSIRT services, the CSIRT’s mode of operations, the practical value it will provide and the responsibilities of the constituency and the CSIRT.

Typically, this communication is aligned with a CSIRT launch celebration and press release.

The launch celebration usually includes a small presentation, a visit to the facilities by the constituency, stakeholders and journalists, and printed materials.

A successful launch can inspire and give positive momentum to the entire CSIRT.

HOW TO SETUP UP CSIRT AND SOC

Similarly, other improvements are worth celebrating in order to draw positive stakeholder attention to the CSIRT, for example inauguration of a CSIRT laboratory or cyber gym facilities, launch of an annual report or any other major event in the life of the CSIRT.

2.5 OPERATIONS

The operations phase focuses on effective and efficient delivery of services, i.e. executing the CSIRT mandate daily. On KPIs:

‘incident statistics,

In the operations phase, the following outcomes are expected.

vulnerability management statistics

1. Measurement of KPIs. 2. Annual operations performance review. (monthly and quarterly) 3. Annual stakeholder needs review. including number of 4. Approval of the annual budget. vulnerabilities detected 5. Collection of improvement initiatives.

and remediated (only critical and high for 2.5.1 Measurement of key performance indicators now)’

KPIs are used for management and governance purposes and quality monitoring. Not all

(university CSIRT)

CSIRTs are KPI driven. It has been observed that many CSIRTs are overburdened and run their overall operations without a sharp focus on the quality management of CSIRT services.

The following guidelines are provided for the use of KPIs.

1. KPIs should be measured monthly. For mature organisations, weekly indicators might also be of relevance. Annual KPIs are usually the sum of monthly KPIs. 2. KPIs should be linked to service delivery, i.e. they should be linked to each service and should facilitate an understanding of whether or not a service is of a good quality and meets service objectives. 3. Some KPIs are used only for statistical analysis whereas others are used for implementing actions for improvement. For example, the number of incidents, analysed monthly, is useful for statistical analysis – bigger or smaller numbers rarely produce actions for improvement – whereas the number of visitors to the CSIRT website, where alerts and awareness information is shared, indicates trends of relevance, which might result in actions for improvement.

Examples of KPIs include:

On KPIs:

1. The number of meetings with the constituency each month for awareness raising

‘Time to respond and

(target: at least one).

mitigate ongoing DDoS

2. Incident handling service-level agreement (SLA) breaches for critical incidents (target: less than 5 %). incidents via e-mail 3. Number of monthly visitors to a website (target: an increase from the previous (1.5 hours), respond

month). and mitigate ongoing

4. Number of awareness-raising campaigns carried out (target: at least one every

DDoS incidents (45

second month).

minutes)’

5. Trends in incident statistics (target: priority incidents must be handled according to

(ISP CSIRT)

SLAs).

HOW TO SETUP UP CSIRT AND SOC 2.5.2 Annual operations performance review

The management team of an operational CSIRT should conduct the annual CSIRT performance review, to identify successes to celebrate and areas for improvement.

During the internal phase of the review, staff skills and individual performances are assessed, CSIRT processes are checked, automation is evaluated and KPIs are analysed.

The review of operations is commonly presented in the CSIRT annual report..

2.5.3 Annual stakeholder needs review

It is good practice to set up an annual workshop or meeting with CSIRT stakeholders where the performance of the CSIRT and stakeholders’ priorities for and expectations of the CSIRT are presented.

These priorities contribute to the planning of subsequent improvements for the CSIRT.

2.5.4 Approval of the annual budget

As for any organisation, CSIRTs must develop and gain approval for their annual budget each year. The budget outlines which initiatives will receive additional funding.

The budget must be prepared in agreement with local laws, rules and regulations.

2.5.5 Collection of improvement initiatives

The internal annual review, stakeholder needs analysis and daily operations allow identification of CSIRT requirements that may need to be improved. These are analysed as part of the improvement phase.

Ideas for improvements may also come from the operations review. All improvement initiatives should be presented in a table, including justifications and explanations of need.

2.6 IMPROVEMENT

The improvement phase focuses on selecting and approving CSIRT enhancement initiatives. After approval, these initiatives are moved to the design, implementation and operations phases. Improvement process should be continuous during existence of CSIRT.

In the improvement phase, the following outcomes are expected.

1. List of improvement initiatives. 2. Detailed plans for improvement initiatives for the design stage. 3. Preliminary budget for improvement initiatives.

2.6.1 List of improvement initiatives

It is often difficult initially to execute the CSIRT mandate at an excellent level of quality because of a lack of skills, automation, processes and resources; thus, balancing improvement priorities is a common activity for CSIRTs.

Improvement initiatives come from the operations phase as areas requiring improvement; from a high-level roadmap; from additional guidance from stakeholders; or from the demands of CSIRT management to improve the maturity and capability of the CSIRT.

HOW TO SETUP UP CSIRT AND SOC

Guidance on maturity improvement is available from frameworks such as SIM3 and SOC-CMM and from ENISA, the Global Forum on Cyber Expertise (GFCE), the CERT Coordination Center (CERT/CC) and FIRST.org, among others.

With the knowledge of existing resources available for improvement initiatives, the management team of a CSIRT decides which initiatives to prioritise and approve and what resources to allocate, e.g. the budget and number of people. Examples of improvement initiatives for prioritisation are provided in Table 9.

Table 9: Examples of improvement initiatives for prioritisation

Budget

49 Duration Initiative required( ) Justification Approved (months) (EUR)

HOW TO SETUP UP CSIRT AND SOC 2.6.2 Detailed plans for improvement initiatives for the design stage

After the improvement initiatives have been approved, the next step is to prepare detailed plans for the design stage.

In the case of external consultancy involvement, detailed requirements are often expressed as improvement project ToR in competitive tenders (RFI/RFP).

Requirements for the design stage outcomes must be specifically listed.

At this stage it is relevant to consider:

1. The objectives of the improvement initiatives. 2. The clearly stated expectations of any improvements. 3. The expected implementation plan. 4. The experience required of experts carrying out similar work.

2.6.3 Preliminary budget for improvement initiatives

The annual budget must incorporate any approved preliminary budget for improvement initiatives. This may be needed to cover the costs of internal staff, additional facilities, technology, external consultancy, administration, cooperation and marketing, and additional training.

The preliminary budget will guide resource and design constraints for the design phase activities during planning.

It is normal to expect that at least 15 % of the annual CSIRT budget will be spent on improvement initiatives for mature CSIRTs. For CSIRTs with a lower level of maturity, improvement initiatives usually make up at least 30 % of the CSIRT budget.

HOW TO SETUP UP CSIRT AND SOC

3. CONCLUSIONS

This report presents guidelines for the establishment of CSIRTs and SOCs using a phased outcomes-driven approach, including many examples from established CSIRTs of the different phases of implementation.

Establishment is a continuous process. It is possible to identify the beginning of the process; however, the end stage consists of a continuous improvement cycle – to better serve the constituency, be more effective in operations and respond better to stakeholder needs.

The authors hope that this publication will inspire better CSIRT and SOC project management and provide clearer descriptions of the intermediate steps involved in the establishment of CSIRTs and SOCs.

Some challenges related to the establishment of CSIRTs and SOCs are not covered in this report and require additional work.

1. This publication focuses on the establishment of a single CSIRT. However, a single CSIRT is usually part of an ecosystem of CSIRTs. Future research might focus on ecosystem buildout and value creation through partnerships and specialisation. 2. Sectorial CSIRTs are emerging in different sectors in many countries; however, there are currently too few data points and good practice guidelines available for guidance to be provided for different sector-specific CSIRTs. 3. There is too little relevant and practical guidance on blueprints for technology orchestration and automation of CSIRTs and SOCs. 4. The do-it-yourself approach to creating a CSIRT is still challenging because of the relevant expertise required, which is not easily available in many countries. It will be important to determine in the future how this can be overcome.

ENISA continues to support incident response teams by creating relevant content for CSIRTs..

HOW TO SETUP UP CSIRT AND SOC

4. GLOSSARY AND ACRONYMS

Please refer to ENISA glossaries and lists of acronyms:  https://www.enisa.europa.eu/topics/threat-risk-management/risk-management/currentrisk/bcm-resilience/glossary  https://www.enisa.europa.eu/topics/csirts-in-europe/glossary  https://www.enisa.europa.eu/media/media-press-kits/enisa-glossary

HOW TO SETUP UP CSIRT AND SOC

5. BIBLIOGRAPHY

Carnegie Mellon University, 2016, Create a CSIRT, Software Engineering Institute, Pittsburgh, PA. Cowley, C. and Pescatore, J., 2019, Common and best practices for security operations centers: Results of the 2019 SOC survey, SANS Institute. ENISA, 2006, A step-by-step approach on how to set up a CSIRT. (https://www.enisa.europa.eu/publications/csirt-setting-up-guide ) FIRST, 2019, Computer Security Incident Response Team (CSIRT) Services Framework (https://www.first.org/standards/frameworks/csirts/csirt_services_framework_v2.1 ). IETF Internet Engineering Task Force, 1998, RFC 2350 for CSIRT establishments. (https://tools.ietf.org/html/rfc2350 ) Internet Governance Forum, 2014, Best practice forum on establishing and supporting computer security incident response teams (CSIRTs) for internet security (https://www.intgovforum.org/multilingual/content/establishing-and-supporting-computer-incident-securityresponse-teams-csirts-for-internet ). MITRE, 2014, Ten strategies of a world-class cybersecurity operations center, MITRE, Bedford, MA. Morgus, R., Skierka, I., Hohmann, M. and Maurer, T., 2015, National CSIRTs and their role in computer security incident response, New America and GPPi. (https://www.researchgate.net/publication/323358191_National_CSIRTs_and_Their_Role_in_Computer_Secu rity_Incident_Response ) National Cyber Security Centre, 2015, CSIRT Maturity Kit, National Cyber Security Centre, the Hague. National Cyber Security Centre, 2017, Building a SOC: Start Small, National Cybersecurity Centre, the Hague. Organization of American States, 2016, Best Practices for Establishing a National CSIRT, OAS, Washington, D.C. Open CSIRT Foundation, 2008-2019, SIM3: Security Incident Management Maturity Model. (https://opencsirt.org/csirt-maturity/sim3-and-references/) Skierka, I., Morgus, R., Hohmann, M. and Maurer, T., 2015, CSIRT Basics for Policy-makers, New America and GPPi. (https://www.researchgate.net/publication/323358187_CSIRT_Basics_for_Policy-Makers ) Telecommunications Development Sector (ITU-D), 2020, ITU CIRT framework, International Telecommunication Union, Geneva. ThaiCERT, 2017, Establishing a CSIRT, Thailand Computer Emergency Response Team, Bangkok. TNO, 2017, GFCE global good practices: National computer security incident response teams (CSIRTs). (https://thegfce.org/wp-content/uploads/2020/06/NationalComputerSecurityIncidentResponseTeamsCSIRTs-1.pdf )

HOW TO SETUP UP CSIRT AND SOC

A ANNEX: QUESTIONNAIRE

Data collection using the questionnaire

The content of the report “Guidelines for establishing CSIRTs and SOCs” is based on the analysis of current publications on CSIRT establishment, the answers to this questionnaire and the authors’ experience in establishing and improvement CSIRTs over numerous projects in Europe, Asia, Africa and South America.

This field questionnaire (presented below) was published using the European Commission Questionnaire platform (the direct link to the questionnaire was https://ec.europa.eu/eusurvey/runner/HowtosetupCSIRTandSOC) and distributed to various CSIRTs and SOCs in different parts of the world, via sharing networks, as well as individually encouraging to participate. CSIRT and SOC teams were invited to fill it in via personal invitations as well as Trusted Introducer member and CIRTs Network communication.

During the set time for the questionnaire detailed responses were received from over 40 CSIRT and SOC teams from different geographic locations including various types of CSIRTs and SOCs (national, sectorial, internal to organization and other).

The questionnaire used

The objective of the questionnaire is to serve ENISA’s study on Guidelines to setup CSIRTs and SOCs. Responses are expected from at least 40 organizations and the received data will be processed and integrated with other methods of research. Some of the gathered data will be used in the ENISA CSIRT and SOC Setup Guidelines publication as a case study, an example, or statistically processed data.

The data is gathered in the European Commission Questionnaire platform, and will not be used, sold, or processed in any other way except for direct ENISA analysis, to serve its target:

“Since 2009, ENISA has carried out a considerable amount of work in CSIRT Capabilities and Maturity area, and this work contributes by shaping the role of ENISA in helping CSIRTs on their way to a higher maturity standard and advanced capabilities.”

To be filled by CSIRT or SOC team manager or assigned person.

You can answer only the questions you find relevant/interesting/on which you are willing to share your experience and expertise.

HOW TO SETUP UP CSIRT AND SOC

A.1 About your CSIRT/SOC team:

1.1. Team / Organization name: (text box) 1.2. Country: (text box) 1.3. Type of CSIRT or SOC: National / Sectorial / MSSP / Internal to organization (multichoice choosing) 1.4. Team size: (text box) 1.5. Constituency of the CSIRT or SOC: (text box) 1.6. Year of establishment: (text box) 1.7. Contact email and/or phone, for clarifications if any: (text box) 1.8. Permission of data usage: Anonymous (i.e. without any attribution to the team) / Can be attributed to your team, but need to receive a prior confirmation for exact data to be attributed / all data is ok to be used in ENISA research and possibly attributed to your team)

A.2 Terminology questions:

2.1. Does your organization operate a CSIRT or SOC, or both? (single choice) 2.2. If both, how are the roles split between CSIRT and SOC? (text box) 2.3. How do you perceive the difference between a CSIRT and a SOC as organizations? (text box)

A.3 CSIRT/SOC related knowledge questions:

3.1. Which publications do you use or find relevant to implement capability and maturity improvements for your organization? (text box) 3.2. What publications and guidance from ENISA content do you find are missing on CSIRT and SOC topics for your effective work? (text box) 3.3. If you conduct a Coordinating CSIRT role (i.e. your team coordinates incidents, which are happening outside your institution/enterprise), what activities do you regularly conduct under such role? (Text box) 3.4. If you conduct Internal or MSSP CSIRT/SOC role (i.e. you handle your own institution/enterprise incidents or work as contractual MSSP), what activities you regularly conduct under such a role? (Text box) 3.5. If you outsource some functions of CSIRT/SOC, what are they? What is the motivation to outsource? (text box) 3.6. What kind of regular reporting are you delivering (please describe to whom (no names needed but general target group, for example – energy sector), what kind of content, and how often? For example, annual report to the public with statistics of incidents, quarterly to ENISA on CII threats, weekly vulnerability statistics to CISO, etc.) (Text box) 45

HOW TO SETUP UP CSIRT AND SOC

3.7. Describe the information-sharing methods you have implemented in your operations (for example: website newsletters and alerts; provide customized MISP/IntelMQ based feed to CII subscribers; provide annual/quarterly statistics from internal/external sources on incidents/vulnerabilities and share it with constituency; have deployed PassiveDNS sensors and share resulting feed with passiveDNS community; contribute to FIRST.org MISP instance with OSINT and data from your investigations; deployed T-POT and share data with sicherheitstacho platform, etc.) (Text box)

3.8. Do you run your tools on premises, in cloud (public or private), or mixed? What are your future plans regarding this topic? What is your opinion about the industry trend on this topic? (text box)

3.9. Are orchestration and automation important objectives for your CSIRT/SOC? Do you currently or in future plans use SOAR-like tools?

3.10. Do you operate 24/7? Do you see "follow-the-sun" as a solution (team spread in different time zones), at least for the future? (text box)

3.11. Which open-source tools and for what objective are you using? Which and for what reason would you advocate them to other CSIRT/SOCs as especially valuable? (text box)

3.12. Which commercial tools and for what objective you are using them? Which and for what reason you would advocate them to other CSIRT/SOCs as valuable? (text box)

3.13. What are the main KPIs and their target levels you have implemented for your CSIRT/SOC operations? (text box)

3.14. What were the main problems that you encountered when setting up your CSIRT or SOC? (text box)

3.15. What actions would you take (or would recommend) to avoid the mentioned problems when setting up a new CSIRT or SOC? (text box)

3.16. If you would have to establish a new CSIRT or SOC team in the same or a different organization, what activity priorities you would focus on? Please choose up to 5. (text box)

A.4 Staffing Roles:

4.1. How many formal roles have you defined in your CSIRT/SOC organization? What are they, and what is their short description? (text box)

4.2. What training for different roles (that you have defined earlier) do you recommend or consider before you consider the employee as a fully-prepared specialist at a specific role in your organization? (text box)

4.3. What are the ongoing training paths for the current staff (ex. ad-hoc, organised in a particular order, etc.) (text box)

4.4. What challenges do you face developing and arranging roles in your organization? (text box)

A.5 SIM3 and other CSIRT models related questions:

HOW TO SETUP UP CSIRT AND SOC

5.1. About SIM3 model usage in your CSIRT or SOC organization: we do not know or use the model/it is somewhat used as a reference/it is our development guiding and maturity improvement model/we use alternative model;

5.2. If you are using or planning to use SIM3 model in your organization: how has SIM3 created value for your organization so far? (text box)

5.3. Please list what CSIRT/SOC services have you defined, implemented, are providing and measuring for your constituency? (text box)

5.4. What Organizational and Personnel biggest challenges do you see for improving maturity of your CSIRT/SOC organisation? (text box)

5.5. Which CSIRT/SOC operational processes have you formally documented and implemented (e.g. Incident Prevention Process, Incident Detection Process, Incident Resolution Process, Audit/Feedback Process, etc.)? (text box)

HOW TO SETUP UP CSIRT AND SOC December 2020

6. B ANNEX: METHODOLOGY MAPPING

HOW TO SETUP UP CSIRT AND SOC HOW TO SETUP UP CSIRT AND SOC HOW TO SETUP UP CSIRT AND SOC HOW TO SETUP UP CSIRT AND SOC HOW TO SETUP UP CSIRT AND SOC HOW TO SETUP UP CSIRT AND SOC HOW TO SETUP UP CSIRT AND SOC

The acronyms used in the methodology mapping diagram are explained in the following table.

-N -EN -935 -20 2 P0 T

ABOUT ENIS A

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found at www.enisa.europa.eu.

ISBN 978-92-9204-410-7 DOI 10.2824/056764