RFC 2350
Expectations for Computer Security Incident Response
1. Introduction ✨
okay bestie, let's get into it 🎀 This is the title block, so you know who wrote this and why it exists 💅
Network Working Group: N. Brownlee (The University of Auckland) and E. Guttman (Sun Microsystems) wrote RFC 2350, titled "Expectations for Computer Security Incident Response". It's dated June 1998 and it's a Best Current Practice (BCP: 21) 🦋 That means it's the community's recommended way of doing things, not a strict spec you have to follow. It doesn't obsolete or update any other RFC, so it's a standalone classic 👑
The whole point of this doc is to set the community's expectations for CSIRTs (Computer Security Incident Response Teams) 🔥 The big idea is that there's no single "one-size-fits-all" list of requirements, because every team is different. Instead, the doc gives you a list of the topics and issues that matter to the people a team protects (its constituency) 🫶 It also includes an outline template plus a filled-in example, so constituents can actually understand their team's policies and procedures 💖
Now here's the intro proper ✨
The GRIP Working Group was formed to write a doc about what the community expects from CSIRTs 🌸 Even though the need came from the general Internet community, the expectations should also match more restricted communities pretty closely 💜
Honestly, people have had misunderstandings about what to expect from CSIRTs in the past 🙈 So the goal here is to give a framework for the important incident-response topics the community cares about 🎀
Before we go further, we need to be clear on what "Computer Security Incident Response Team" actually means 🧚 For this doc, a CSIRT is a team that performs, coordinates, and supports the response to security incidents involving sites inside a defined constituency (Appendix A has the full definition). So any group calling itself a CSIRT for a constituency has to react to reported incidents, and to threats against "their" constituency, in ways the community agrees are in its general interest 💅
Here's the vibe check: each member of a constituent community has to understand what's reasonable to expect from their team 💖 That means a CSIRT should make it crystal clear who belongs to its constituency, and define the services it offers ✨ Each CSIRT should also publish its policies and operating procedures 🎀 And constituents need to know what's expected of them to get those services, which means the team has to publish how and where to report incidents 🦋
This doc gives a template that CSIRTs use to share all this info with their constituents 🌈 Constituents should totally expect their CSIRT to deliver the services it describes in the completed template 👑
Here's a big one, so listen up 😭 Active participation from users is a must. Without it, the CSIRT's services can be seriously diminished, and that's especially true for reporting. At a minimum, users need to know that they should report security incidents, and they need to know how and to where to report them 🔥
Lots of incidents start outside local community boundaries and hit inside sites. Others start inside the local community and hit hosts or users on the outside 🌸 So handling an incident often involves multiple sites and maybe multiple CSIRTs 💜 Fixing these things takes cooperation between individual sites and CSIRTs, and between CSIRTs too ✨
Constituent communities need to know exactly how their CSIRT works with other CSIRTs and with organizations outside the constituency, and what information gets shared 🧚
The rest of the doc covers the topics and issues CSIRTs need to spell out for their constituents 🎀 It doesn't try to name a "correct" answer for any topic, though. Each topic is just explained in terms of what it means 🦋
Chapter two gives an overview of three big areas: publishing info, how a response team relates to other teams, and the need for secure communications 🌈 Chapter three goes into detail on all the kinds of info the community needs to know about its response team 💖
To make it easy to use, all these topics get condensed into an outline template in Appendix D 💅 Constituents can use that template to pull info out of their CSIRT 🫶
The working group really hopes that clearing up these topics will help the community and its CSIRTs understand each other better 🥹💜
2. Scope 🦋
The interactions between an incident response team and its constituent community need a few things first 🎀 Step one: the community has to understand the team's policies and procedures ✨ Step two: since lots of response teams work together on incidents, the community also needs to understand how its team relates to other teams 🌸 Step three: a lot of interactions use existing public infrastructure, so the community needs to know how those communications get protected 🔥
Each of these three subjects gets its own section in the following parts, so stay tuned bestie 💅✨
2.1 Publishing CSIRT Policies and Procedures ✨
Okay bestie, every user who has access to a Computer Security Incident Response Team should know as much as possible about the team's services and how to interact with it long before they actually need it 💅 (learning the rules in the middle of a crisis is not the vibe 😭).
A clear statement of a CSIRT's policies and procedures helps the constituent figure out how to report incidents and what support to expect afterwards. Will the CSIRT help resolve the incident? Will it help avoid incidents in the future? Clear expectations, especially about the limitations of the services a CSIRT provides, make the interaction more efficient and effective 🎀
There are different kinds of response teams 🌈 Some have very broad constituencies (e.g., CERT Coordination Center and the Internet), others have more bounded constituencies (e.g., DFN-CERT, CIAC), and still others have very restricted constituencies (e.g., commercial response teams, corporate response teams). No matter what type of response team it is, the constituency it supports must be knowledgeable about the team's policies and procedures. Therefore, it is mandatory that response teams publish such information to their constituency 🫶
A CSIRT should communicate all necessary information about its policies and services in a form that suits the needs of its constituency 💖 It's important to understand that not all policies and procedures need to be publicly available. For example, it is not necessary to understand the internal operation of a team in order to interact with it, like when you're reporting an incident or getting guidance on how to analyze or secure your systems 🧚
In the past, some teams supplied a kind of Operational Framework, others provided a Frequently Asked Questions list (FAQ), and still others wrote papers for distribution at user conferences or sent newsletters 📰
We recommend that each CSIRT publish its guidelines and procedures on its own information server (e.g. a World Wide Web server) 🦋 This would let constituents easily access it. The problem remains of how a constituent can find their team, though. People within the constituency have to discover that there is a CSIRT "at their disposal" 👀
It is foreseen that completed CSIRT templates will soon become searchable by modern search engines ✨ That will help spread the word about the existence of CSIRTs and the basic information needed to approach them 🌸
It would be very useful to have a central repository containing all the completed CSIRT templates. No such repository exists at the time of writing, though this might change in the future 🔥
Regardless of where the information comes from, the user of the template must check its authenticity. It is highly recommended that such vital documents be protected by digital signatures. These let the user verify that the template was indeed published by the CSIRT and that it has not been tampered with 💀 This document assumes the reader is familiar with the proper use of digital signatures to determine whether a document is authentic 🔐
2.2 Relationships between different CSIRTs 🌸
In some cases a CSIRT may be able to operate effectively on its own and in close cooperation with its constituency 💅 But with today's international networks, it is much more likely that most of the incidents a CSIRT handles will involve parties outside its constituency. So the team will need to interact with other CSIRTs and sites outside its constituency 🌍
The constituent community should understand the nature and extent of this collaboration, because very sensitive information about individual constituents may be disclosed in the process 😳
Inter-CSIRT interactions could include asking other teams for advice, spreading knowledge of problems, and working cooperatively to resolve a security incident that affects one or more of the CSIRTs' constituencies 🤝
When establishing relationships to support these interactions, CSIRTs must decide what kinds of agreements can exist between them, so they can share information while still safeguarding it. They also need to decide whether the relationship can be disclosed, and if so, to whom 🧐
Note that there is a difference between a peering agreement, where the CSIRTs involved agree to work together and share information, and simple co-operation, where a CSIRT (or any other organization) just contacts another CSIRT and asks for help or advice 💭
Even though setting up these relationships is super important and affects a CSIRT's ability to support its constituency, it is up to the teams involved to decide the details. It is beyond the scope of this document to make recommendations for this process 🙈 However, the same set of information used to set expectations for a user community about sharing information will help other parties understand the objectives and services of a specific CSIRT. That supports a first contact 🎀
2.3 Establishing Secure Communications 🔐
Once one party has decided to share information with another party, or two parties have agreed to share information or work together (as required for coordinating computer security incident response), all the parties involved need secure communication channels 🦋 (In this context, "secure" refers to the protected transmission of information shared between different parties, and not to how the parties use the information appropriately 💅)
The goals of secure communication are:
- Confidentiality: Can somebody else access the content of the communication?
- Integrity: Can somebody else manipulate the content of the communication?
- Authenticity: Am I communicating with the "right" person?
It is very easy to send forged e-mail, and not hard to establish a (false) identity over the telephone 😬 Cryptographic techniques, for example Pretty Good Privacy (PGP) or Privacy Enhanced Mail (PEM), can provide effective ways of securing e-mail. With the correct equipment it is also possible to secure telephone communication 📞 But before using these mechanisms, both parties need the "right" infrastructure, which means preparation in advance. The most important preparation is making sure the authenticity of the cryptographic keys used in secure communication 🔑
- Public keys (for techniques like PGP and PEM): Because they are accessible through the Internet, public keys must be authenticated before use. While PGP relies on a "Web of Trust" (where users sign the keys of other users), PEM relies on a hierarchy (where certification authorities sign the keys of users) 🕸️
- Secret keys (for techniques like DES and PGP/conventional encryption): Because these must be known to both sender and receiver, secret keys must be exchanged before the communication, via a secure channel 🗝️
Communication is critical to every aspect of incident response 💜 A team can best support the use of the techniques above by gathering all relevant information in a consistent way. Specific requirements (such as calling a specific number to check the authenticity of keys) should be clear from the start. CSIRT templates provide a standardized vehicle for delivering this information 📋
It is beyond the scope of this document to address the technical and administrative problems of secure communications. The point is that response teams must support and use a method to secure communications between themselves and their constituents (or other response teams) 🫶 Whatever the mechanism is, the level of protection it provides must be acceptable to the constituent community 💅
3 Information, Policies and Procedures 📚
In chapter 2 it was mentioned that the policies and procedures of a response team need to be published to their constituent community. In this chapter we list all the types of information that the community needs to receive from its response team 🌈 How this information is communicated will differ from team to team, as will the specific content. The intent here is to clearly describe the various kinds of information a constituent community expects from its response team ✨
To make it easier to understand the issues and topics relevant to constituents interacting with "their" CSIRT, we suggest that a CSIRT publish all information, policies, and procedures addressing its constituency as a document, following the template given in Appendix D 📝 The template structure arranges items, which makes it easy to supply specific information. In Appendix E we provide an example of a filled-out template for the fictitious XYZ University 🎓 While no recommendations are made about what a CSIRT should adopt for its policy or procedures, different possibilities are outlined to give some examples. The most important thing is that a CSIRT has a policy and that those who interact with it can obtain and understand that policy 🧠
As always, not every aspect of every environment and/or team can be covered 🙃 This outline should be seen as a suggestion. Each team should feel free to include whatever they think is necessary to support its constituency 💖
3.1 Obtaining the Document 📥
Details of a CSIRT change over time, so the completed template must indicate when it was last changed. Information should also be provided about how to find out about future updates. Without this, misunderstandings and misconceptions are inevitable over time, because outdated documents can do more harm than good 😭
- Date of last update: This should be sufficient to allow anyone interested to evaluate the currency of the template 🗓️
- Distribution list: Mailing lists are a convenient mechanism for distributing up-to-date information to a large number of users 📬 A team can decide to use its own list or an already existing one to notify users whenever the document changes. The list might normally be groups the CSIRT has frequent interactions with.
Digital signatures should be used for update messages sent by a CSIRT ✍️
- Location of the document: This is where a current version of the document can be accessed through a team's online information services 🌐 Constituents can then easily learn more about the team and check for recent updates 👀 This online version should also be accompanied by a digital signature 🔏
3.2 Contact Information 📞💖
Okay bestie, this is the "how do I reach you??" section 🫶 Full details of how to contact the CSIRT should be listed here, although this might be very different for different teams. Like, some might choose not to publicize the names of their team members 🙈 No further clarification is given when the meaning of the item can be assumed.
- Name of the CSIRT
- Mailing Address
- Time zone This is useful for coordinating
incidents which cross time zones.
- Telephone number
- Facsimile number
- Other telecommunication Some teams might provide secure
voice communication (e.g. STU III).
- Electronic mail address
- Public keys and encryption The use of specific techniques
depends on the ability of the
communication partners to have
access to programs, keys and so on.
Relevant information should be
given to enable users to determine
if and how they can make use of
encrypted communication while
interacting with the CSIRT.
- Team members
- Operating Hours The operating hours and holiday
schedule should be provided here.
Is there a 24 hour hotline?
- Additional Contact Info Is there any specific customer
contact info?More detailed contact information can be provided 🌸 This might include different contacts for different services, or might be a list of online information services. If specific procedures for access to some services exist (for example addresses for mailing list requests), these should be explained here.
3.3 Charter 📜
Every CSIRT must have a charter which specifies what it is to do, and the authority under which it will do it 👑 The charter should include at least the following items:
- Mission statement
- Constituency
- Sponsorship / affiliation
- Authority
3.3.1 Mission Statement 🎯
The mission statement should focus on the team's core activities, already stated in the definition of a CSIRT. In order to be considered a Computer Security Incident Response Team, the team must support the reporting of incidents and support its constituency by dealing with incidents 💅
The goals and purposes of a team are especially important, and require clear, unambiguous definition ✨
3.3.2 Constituency 🫧
A CSIRT's constituency can be determined in any of several ways. For example it could be a company's employees or its paid subscribers, or it could be defined in terms of a technological focus, such as the users of a particular operating system 💻
The definition of the constituency should create a perimeter around the group to whom the team will provide service. The policy section of the document (see below) should explain how requests from outside this perimeter will be handled 🚧
If a CSIRT decides not to disclose its constituency, it should explain the reasoning behind this decision. For example, for-fee CSIRTs will not list their clients but will declare that they provide a service to a large group of customers that are kept confidential because of the clients' contracts 🤐
Constituencies might overlap, as when an ISP provides a CSIRT which delivers services to customer sites that also have CSIRTs. The Authority section of the CSIRT's description (see below) should make such relationships clear 🦋
3.3.3 Sponsoring Organization / Affiliation 🏢
The sponsoring organization, which authorizes the actions of the CSIRT, should be given next. Knowing this will help the users to understand the background and set-up of the CSIRT, and it is vital information for building trust between a constituent and a CSIRT 🤝💜
3.3.4 Authority 🔑
This section will vary greatly from one CSIRT to another, based on the relationship between the team and its constituency. While an organizational CSIRT will be given its authority by the management of the organization, a community CSIRT will be supported and chosen by the community, usually in a advisory role 🌈
A CSIRT may or may not have the authority to intervene in the operation of all of the systems within its perimeter. It should identify the scope of its control as distinct from the perimeter of its constituency. If other CSIRTs operate hierarchically within its perimeter, this should be mentioned here, and the related CSIRTs identified 🧚
Disclosure of a team's authority may expose it to claims of liability. Every team should seek legal advice on these matters. (See section 3.7 for more on liability.) ⚖️
3.4 Policies 📋
It is critical that Incident Response Teams define their policies 🔥 The following sections discuss communication of these policies to the constituent community.
3.4.1 Types of Incidents and Level of Support 🛟
The types of incident which the team is able to address, and the level of support which the team will offer when responding to each type of incident, should be summarized here in list form. The Services section (see below) provides the opportunity to give more detailed descriptions, and to address non-incident-related topics 🍓
The level of support may change depending on factors such as the team's workload and the completeness of the information available. Such factors should be outlined and their impact should be explained. As a list of known types of incidents will be incomplete with regard to possible or future incidents, a CSIRT should also give some background on the "default" support for incident types not otherwise mentioned 🫠
The team should state whether it will act on information it receives about vulnerabilities which create opportunities for future incidents. A commitment to act on such information on behalf of its constituency is regarded as an optional proactive service policy rather than a core service requirement for a CSIRT 🌸
3.4.2 Co-operation, Interaction and Disclosure of Information 🤓
This section should make explicit which related groups the CSIRT routinely interacts with. Such interactions are not necessarily related to the computer security incident response provided, but are used to facilitate better cooperation on technical topics or services. By no means need details about cooperation agreements be given out; the main objective of this section is to give the constituency a basic understanding of what kind of interactions are established and what their purpose is 💬
Cooperation between CSIRTs can be facilitated by the use of unique ticket number assignment combined with explicit handoff procedures. This reduces the chance of misunderstandings, duplications of effort, assists in incident tracking and prevents 'loops' in communication 🎀
The reporting and disclosure policy should make clear who will be the recipients of a CSIRT's report in each circumstance. It should also note whether the team will expect to operate through another CSIRT or directly with a member of another constituency over matters specifically concerning that member 📨
Related groups a CSIRT will interact with are listed below 👇
- Incident Response Teams:
- A CSIRT will often need to interact with other CSIRTs. For example a CSIRT within a large company may need to report incidents to a national CSIRT, and a national CSIRT may need to report incidents to national CSIRTs in other countries to deal with all sites involved in a large-scale attack 🌍
- Collaboration between CSIRTs may lead to disclosure of information. The following are examples of such disclosure, but are not intended to be an exhaustive list:
- Reporting incidents within the constituency to other teams. If this is done, site-related information may become public knowledge, accessible to everyone, in particular the press.
- Handling incidents occurring within the constituency, but reported from outside it (which implies that some information has already been disclosed off-site).
- Reporting observations from within the constituency indicating suspected or confirmed incidents outside it.
- Acting on reports of incidents from outside the constituency.
- Passing information about vulnerabilities to vendors, to partner CSIRTs or directly to affected sites lying within or outside the constituency.
- Feedback to parties reporting incidents or vulnerabilities.
- The provision of contact information relating to members of the constituency, members of other constituencies, other CSIRTs, or law-enforcement agencies.
- Vendors:
- Some vendors have their own CSIRTs, but some vendors may not. In such cases a CSIRT will need to work directly with a vendor to suggest improvements or modifications, to analyze the technical problem or to test provided solutions. Vendors play a special role in handling an incident if their products' vulnerabilities are involved in the incident 🛠️
- Law-enforcement agencies:
- These include the police and other investigative agencies. CSIRTs and users of the template should be sensitive to local laws and regulations, which may vary considerably in different countries. A CSIRT might advise on technical details of attacks or seek advice on the legal implications of an incident. Local laws and regulations may include specific reporting and confidentiality requirements ⚖️
- Press:
- A CSIRT may be approached by the press for information and comment from time to time 📰
- An explicit policy concerning disclosure to the press can be helpful, particularly in clarifying the expectations of a CSIRT's constituency. The press policy will have to clarify the same topics as above more specifically, as the constituency will usually be very sensitive to press contacts 🙊
- Other:
- This might include research activities or the relation to the sponsoring organization 🔬
The default status of any and all security-related information which a team receives will usually be 'confidential,' but rigid adherence to this makes the team to appear to be an informational 'black hole,' which may reduce the likelihood of the team's obtaining cooperation from clients and from other organizations 🕳️ The CSIRT's template should define what information it will report or disclose, to whom, and when 🗓️
Different teams are likely to be subject to different legal restraints requiring or limiting disclosure, especially if they work in different jurisdictions. In addition, they may have reporting requirements imposed by their sponsoring organization. Each team's template should specify any such constraints, both to clarify users' expectations and to inform other teams 💜
Conflicts of interest, particularly in commercial matters, may also restrain disclosure by a team; this document does not recommend on how such conflicts should be addressed 🙃
A team will normally collect statistics. If statistical information is distributed, the template's reporting and disclosure policy should say so, and should describe how to obtain such statistics 📊✨
3.4.3 Communication and Authentication ✨
okay bestie, your team MUST have a policy about how you talk securely and verifiably 🔐 wait, lowercase "must" 💅 the original says "must", so: your team must have a policy describing the secure, verifiable methods you'll use. This matters between CSIRTs and between a CSIRT and its constituents 🫶 The template should include public keys (or pointers to them) with key fingerprints, plus guidelines on how to use that info to check authenticity and what to do when info is corrupted (like where to report it) 😭
right now the recommendation is that every CSIRT has a PGP key available if possible 🔑 Teams can also offer other mechanisms like PEM, MOSS, or S/MIME, depending on what the team and its constituents need 🦋 BUT ngl, CSIRTs and users need to be aware of local laws and regulations 📜 some countries don't allow strong encryption, or have specific rules about using it 💀 So along with encrypting sensitive info whenever possible, correspondence should include digital signatures ✍️ (fun fact from the original: in most countries, digital signatures for authenticity aren't affected by encryption regulations 🌈)
for phone or fax contact, a CSIRT can keep secret authentication data for the people it deals with, like an agreed password or phrase 🤫 obviously those secrets must not be published, but their existence can be 🙈
3.5 Services 🎀
services from a CSIRT can be split into two rough categories 🍓 first, real-time activities directly tied to the main job of incident response ⏰ second, non-real-time proactive activities that support incident response 🧚 the second category, and part of the first, are optional, meaning not every CSIRT will offer them 💅
3.5.1 Incident Response 🚨
incident response usually includes assessing incoming reports about incidents ("Incident Triage") and following up with other CSIRTs, ISPs, and sites ("Incident Coordination") 📨 a third range of services, helping a local site recover from an incident ("Incident Resolution"), is typically optional, so not all CSIRTs offer it 🌸
3.5.1.1 Incident Triage 🔍
incident triage usually includes:
Report assessment Interpretion of incoming incident
reports, prioritizing them, and
relating them to ongoing incidents
and trends.
Verification Help in determining whether an
incident has really occurred, and
its scope.3.5.1.2 Incident Coordination 🤝
incident coordination normally includes:
Information categorization Categorization of the incident related
information (logfiles, contact
information, etc.) with respect to
the information disclosure policy.
Coordination Notification of other involved
parties on a need-to-know basis, as
per the information disclosure
policy.3.5.1.3 Incident Resolution 🛠️
usually additional or optional, incident resolution services include:
Technical Assistance This may include analysis of
compromised systems.
Eradication Elimination of the cause of a
security incident (the vulnerability
exploited), and its effects (for
example, continuing access to the
system by an intruder).
Recovery Aid in restoring affected systems
and services to their status before
the security incident.3.5.2. Proactive Activities 🌈
usually additional or optional, proactive services might include:
Information provision This might include an archive of
known vulnerabilities, patches or
resolutions of past problems, or
advisory mailing lists.
Security Tools This may include tools for auditing
a Site's security.
Education and training
Product evaluation
Site security auditing and consulting3.6 Incident Reporting Forms 📝
forms make life easier for both users and teams 🥹 the constituent can prepare answers to the important questions before actually contacting the team, so they show up well prepared 💖 the team gets all the necessary info in one go with the first report and can move quickly ⚡
depending on a CSIRT's objectives and services, it might use multiple forms 🦋 for example, a form for reporting a new vulnerability can look totally different from the form for reporting incidents 👑
the most efficient move is to provide forms through the team's online information services 💻 the exact pointers should go in the CSIRT description document, along with statements about appropriate use and guidelines for when and how to use the forms 📖 if separate email addresses are supported for form-based reporting, they should be listed there too 📧
one example is the Incident Reporting Form from the CERT Coordination Center:
ftp://info.cert.org/incident_reporting_form
3.7 Disclaimers 🧾
even though the CSIRT description document isn't a contract, liability could still come from its descriptions of services and purposes 😬 so including a disclaimer at the end of the template is recommended, to warn users about possible limitations 🫧
if the original document has to be translated into another language, the translation should carry a disclaimer and a pointer to the original 🌍 for example:
Although we tried to carefully translate the original document
from German into English, we can not be certain that both
documents express the same thoughts in the same level of detail
and correctness. In all cases, where there is a difference
between both versions, the German version will prevail.how disclaimers work, and how they're protected, depends on local laws and regulations, which every CSIRT should know about ⚖️ if in doubt, the CSIRT should check its disclaimer with a lawyer 💅
Appendix A: Glossary of Terms 📚
this glossary defines terms used when describing security incidents and Computer Security Incident Response Teams 🎓 it's only a limited list, so for more definitions check other sources, like the Internet User's Glossary [RFC 1983] 🌸
Constituency: implicit in the purpose of a Computer Security Incident Response Team is a constituency 👯 that's the group of users, sites, networks, or organizations the team serves 🫶 the team must be recognized by its constituency to be effective ✨
Security Incident: for this document, this term is a synonym of Computer Security Incident: any adverse event that compromises some aspect of computer or network security 🚫
the definition of an incident may vary between organizations, but at least these categories are generally applicable 🧩
- Loss of confidentiality of information.
- Compromise of integrity of information.
- Denial of service.
- Misuse of service, systems or information.
- Damage to systems.
these are very general categories 🙃 for instance, replacing a system utility program with a Trojan Horse is an example of 'compromise of integrity,' and a successful password attack is an example of 'loss of confidentiality.' 🐴 attacks count as incidents even if they failed because of proper protection 🛡️
within the definition of an incident, the word 'compromised' is used 👀 sometimes an administrator may only 'suspect' an incident 🕵️♀️ during the response, it must be established whether or not an incident has really occurred 💜
Computer Security Incident Response Team: based on two of the definitions above, a CSIRT is a team that coordinates and supports the response to security incidents involving sites within a defined constituency 🦸♀️
to be considered a CSIRT, a team must:
- Provide a (secure) channel for receiving reports about suspected incidents.
- Provide assistance to members of its constituency in handling these incidents.
- Disseminate incident-related information to its constituency and to other involved parties.
note that we're not talking about police or other law enforcement bodies that might investigate computer-related crime 🚓 CSIRT members don't need any powers beyond those of ordinary citizens 🙌
Vendor: a 'vendor' is any entity that produces networking or computing technology and is responsible for the technical content of that technology 🏭 examples of 'technology' include hardware (desktop computers, routers, switches, etc.) and software (operating systems, mail forwarding systems, etc.) 💻
the supplier of a technology is not necessarily its 'vendor' 📦 for example, an Internet Service Provider (ISP) might supply routers to each of its customers, but the 'vendor' is the manufacturer, since the manufacturer, not the ISP, is responsible for the technical content of the router 🏷️
Vulnerability: a 'vulnerability' is a characteristic of a piece of technology that can be exploited to perpetrate a security incident 🔓 for example, if a program unintentionally let ordinary users run arbitrary operating system commands in privileged mode, that "feature" would be a vulnerability 🙈
Appendix B: Related Material 📚✨
Okay so the big one for site-level incident stuff is [RFC 2196], the Site Security Handbook 🎀. It was produced by the Site Security Handbook Working Group (SSH), and the SSH working group is going to keep it updated with recommendations for local policies and procedures, mainly about avoiding security incidents in the first place 🛡️. Prevention is literally iconic.
Other docs for CSIRTs and their tasks are up for grabs by anonymous FTP 📂. There's a collection here:
ftp://ftp.cert.dfn.de/pub/docs/csir/Check out file 01-README for the lowdown on what's in that directory 🧐.
Some especially juicy ones for this document:
ftp://ftp.nic.surfnet.nl/surfnet/net-security/cert-nl/docs/reports/R-92-01This report has the Operational Framework of CERT-NL, the CSIRT of SURFnet (network provider in the Netherlands) 🇳🇱.- For readers who want the scoop on how FIRST (Forum of Incident Response and Security Teams) operates, you'll find more in Appendix C 👑.
http://hightop.nrl.navy.mil/news/incident.htmlThis one leads to the NRL Incident Response Manual 📖.http://www.cert.dfn.de/eng/team/kpk/certbib.htmlThis is an annotated bibliography of available material, documents and files about how CSIRTs operate, with links to a bunch of the referenced items 🔗.ftp://info.cert.org/incident_reporting_formThis Incident Reporting Form comes from the CERT Coordination Center. It's there to gather incident info and to avoid extra delays caused by having to request more detailed info from the reporting site 📝.http://www.cert.org/cert.faqintro.htmlA collection of frequently asked questions from the CERT Coordination Center 💁♀️.
Appendix C: Known Computer Security Incident Response Teams 🌍
Okay, so there are SO many CSIRTs out there, but no single source lists every single one 😭. Most of the major, long-established teams are nowadays members of FIRST, the worldwide Forum of Incident Response and Security Teams 👑. (The first CSIRT was founded in 1988, so these teams have been around the block 🦋.) At the time of writing, more than 55 teams are members: 1 in Australia, 13 in Europe, and all the others in North America 🌎.
You can learn about FIRST here:
The current member list is also available, with the relevant contact info and some extra details the teams provided themselves:
Wanna join? Heads up, a team needs a sponsor to be introduced. The sponsor has to be a team that's already a full member of FIRST 🫶. These files have the deets:
http://www.first.org/about/op_frame.htmlThe Operational Framework of FIRST.http://www.first.org/docs/newmem.htmlGuidelines for teams that want to become members of FIRST.
Many of the European teams are listed by country on a page maintained by the German CSIRT, whether they're FIRST members or not 🇪🇺:
Looking for a team that fits your needs? It's often super helpful to ask either a team you already know or an Internet Service Provider for the "right" contact 📞.
Appendix D: Outline for CSIRT Template 💅
This outline is giving summary vibes 📝. It sums up in point form the issues addressed in this document, and it's the recommended template for a CSIRT description document 🎀. Its structure is designed to make it easier to communicate a CSIRT's policies, procedures, and other relevant info to its constituency and to outside organizations like other CSIRTs 🤝. A 'filled-in' example of this template is given as Appendix E, so you can see it in action ✨.
1. Document Information
1.1 Date of Last Update
1.2 Distribution List for Notifications
1.3 Locations where this Document May Be Found
2. Contact Information
2.1 Name of the Team
2.2 Address
2.3 Time Zone
2.4 Telephone Number
2.5 Facsimile Number
2.6 Other Telecommunication
2.7 Electronic Mail Address
2.8 Public Keys and Encryption Information
2.9 Team Members
2.10 Other Information
2.11 Points of Customer Contact
3. Charter
3.1 Mission Statement
3.2 Constituency
3.3 Sponsorship and/or Affiliation
3.4 Authority
4. Policies
4.1 Types of Incidents and Level of Support
4.2 Co-operation, Interaction and Disclosure of Information
4.3 Communication and Authentication
5. Services
5.1 Incident Response
5.1.1. Incident Triage
5.1.2. Incident Coordination
5.1.3. Incident Resolution
5.2 Proactive Activities
6. Incident Reporting Forms
7. DisclaimersAppendix E: Example - 'filled-in' Template for a CSIRT 🧚
Here's a filled-in template for a fictitious CSIRT called XYZ-CSIRT 🎪. This text is for example purposes only, and does not constitute endorsement by the working group or the IETF of any particular set of procedures or policies 🙅♀️. CSIRTs are welcome to use any or all of this text if they wish, but using it is of course not mandatory, or even appropriate in most cases 💖.
CSIRT Description for XYZ-CERT
-----------------------------
1. About this document
1.1 Date of Last Update
This is version 1.01, published 1997/03/31.
1.2 Distribution List for Notifications
Notifications of updates are submitted to our mailing list
<xyz-cert-info@xyz-univ.ca>. Subscription requests for this
list should be sent to the Majordomo at
<xyz-cert-info-request@xyz-univ.ca>; the body of the message
should consist of the word "subscribe". Send the word "help"
instead if you don't know how to use a Majordomo list manager.
This mailing list is moderated.
1.3 Locations where this Document May Be Found
The current version of this CSIRT description document is
available from the XYZ-CERT WWW site; its URL is
http://www.xyz-univ.ca/xyz-cert/english/CSIRT-descr.txt
Une version francaise de ce document est igalement disponible:
http://www.xyz-univ.ca/xyz-cert/francais/CSIRT-descr.txt
Please make sure you are using the latest version.
1.4 Authenticating this Document
Both the English and French versions of this document have
been signed with the XYZ-CERT's PGP key. The signatures are
also on our Web site, under:
http://www.xyz-univ.ca/xyz-cert/english/CSIRT-descr.asc
http://www.xyz-univ.ca/xyz-cert/francais/CSIRT-descr.asc
2. Contact Information
2.1 Name of the Team
"XYZ-CERT": the XYZ University Computer Emergency Response
Team.
2.2 Address
XYZ-CERT
XYZ University, Computing Services Department
12345 Rue Principale
UniversityTown, Quebec
Canada H0H 0H0
2.3 Time Zone
Canada/Eastern (GMT-0500, and GMT-0400 from April to October)
2.4 Telephone Number
+1 234 567 7890 (ask for the XYZ-CERT)
2.5 Facsimile Number
+1 234 567 7899 (this is *not* a secure fax)
2.6 Other Telecommunication
None available.
2.7 Electronic Mail Address
<xyz-cert@xyz-univ.ca> This is a mail alias that relays mail
to the human(s) on duty for the XYZ-CERT.
2.8 Public Keys and Other Encryption Information
The XYZ-CERT has a PGP key, whose KeyID is 12345678 and
whose fingerprint is
11 22 33 44 55 66 77 88 88 77 66 55 44 33 22 11.
The key and its signatures can be found at the usual large
public keyservers.
Because PGP is still a relatively new technology at XYZ
University, this key still has relatively few signatures;
efforts are underway to increase the number of links to this
key in the PGP "web of trust". In the meantime, since most
fellow universities in Quebec have at least one staff member
who knows the XYZ-CERT coordinator Zoe Doe, Zoe Doe has
signed the XYZ-CERT key, and will be happy to confirm its
fingerprint and that of her own key to those people who know
her, by telephone or in person.
2.9 Team Members
Zoe Doe of Computing Services is the XYZ-CERT coordinator.
Backup coordinators and other team members, along with their
areas of expertise and contact information, are listed in the
XYZ-CERT web pages, at
http://www.xyz-univ.ca/xyz-cert/teamlist.html
Management, liaison and supervision are provided by Steve Tree,
Assistant Director (Technical Services), Computing Services.
2.10 Other Information
General information about the XYZ-CERT, as well as links to
various recommended security resources, can be found at
http://www.xyz-univ.ca/xyz-cert/index.html
2.11 Points of Customer Contact
The preferred method for contacting the XYZ-CERT is via
e-mail at <xyz-cert@xyz-univ.ca>; e-mail sent to this address
will "biff" the responsible human, or be automatically
forwarded to the appropriate backup person, immediately. If
you require urgent assistance, put "urgent" in your subject
line.
If it is not possible (or not advisable for security reasons)
to use e-mail, the XYZ-CERT can be reached by telephone during
regular office hours. Telephone messages are checked less
often than e-mail.
The XYZ-CERT's hours of operation are generally restricted to
regular business hours (09:00-17:00 Monday to Friday except
holidays).
If possible, when submitting your report, use the form
mentioned in section 6.
3. Charter
3.1 Mission Statement
The purpose of the XYZ-CERT is, first, to assist members of XYZ
University community in implementing proactive measures to
reduce the risks of computer security incidents, and second, to
assist XYZ community in responding to such incidents when they
occur.
3.2 Constituency
The XYZ-CERT's constituency is the XYZ University community,
as defined in the context of the "XYZ University Policy on
Computing Facilities". This policy is available at
http://www-compserv.xyz-univ.ca/policies/pcf.html
However, please note that, notwithtanding the above, XYZ-CERT
services will be provided for on-site systems only.
3.3 Sponsorship and/or Affiliation
The XYZ-CERT is sponsored by the ACME Canadian Research
Network. It maintains affiliations with various University
CSIRTs throughout Canada and the USA on an as needed basis.
3.4 Authority
The XYZ-CERT operates under the auspices of, and with authority
delegated by, the Department of Computing Services of XYZ
University. For further information on the mandate and
authority of the Department of Computing Services, please
refer to the XYZ University "Policy on Computing Facilities",
available at
http://www-compserv.xyz-univ.ca/policies/pcf.htmlOkay so the XYZ-CERT really wants to vibe with system admins and users at XYZ University 🫶, and it's trying its hardest to stay chill and not bossy 💅. But if things get serious, it'll call on Computing Services to step in and use its authority, directly or indirectly 👑. Every XYZ-CERT member is in the CCSA (Committee of Computer Systems Administrators), so they have all the powers and responsibilities of Systems Administrators under the Policy on Computing Facilities, or they're University management 🎀.
If you wanna appeal something the XYZ-CERT did, you reach out to the Assistant Director (Technical Services), Computing Services 🙈. Not satisfied? It can go to the Director of Computing Services if the problem is with existing policy, or to the XYZ University Office of Rights and Responsibilities if the policy was applied wrong 💀.
4. Policies ✨
4.1. Types of Incidents and Level of Support 🚨
The XYZ-CERT is authorized to handle all types of computer security incidents that happen, or threaten to happen, at XYZ University 🦋.
How much support you get depends on the type and severity of the incident, what kind of constituent you are, how many users are affected, and what the XYZ-CERT's resources look like at the time 🧚. Still, every case gets some response within one working day ⭐. Resources get assigned by these priorities, in decreasing order:
- Threats to the physical safety of human beings. 🚑
- Root or system-level attacks on any Management Information System, or any part of the backbone network infrastructure.
- Root or system-level attacks on any large public service machine, either multi-user or dedicated-purpose.
- Compromise of restricted confidential service accounts or software installations, especially the ones used for MIS applications containing confidential data, or the ones used for system administration.
- Denial of service attacks on any of the above three items.
- Any of the above at other sites, originating from XYZ University.
- Large-scale attacks of any kind, e.g. sniffing attacks, IRC "social engineering" attacks, password cracking attacks.
- Threats, harassment, and other criminal offenses involving individual user accounts.
- Compromise of individual user accounts on multi-user systems.
- Compromise of desktop systems.
- Forgery and misrepresentation, and other security-related violations of local rules and regulations, e.g. netnews and e-mail forgery, unauthorized use of IRC bots.
- Denial of service on individual user accounts, e.g. mailbombing.
Types of incidents other than those above will be prioritized based on their apparent severity and extent 📊.
Heads up: there's no direct support for end users 🙅♀️. They're expected to contact their system administrator, network administrator, or department head for help. The XYZ-CERT will support those people 💖.
The XYZ-CERT totally gets that system administrator expertise at XYZ University varies a lot 🌈. It'll try its best to give info and help at a level that fits each person, BUT it can't train sysadmins on the fly, and it can't do system maintenance for them 😭. Usually, it'll just point you to the information you need to put the right measures in place 📚.
The XYZ-CERT is committed to keeping the XYZ University system administration community in the loop about potential vulnerabilities 📣, and where possible, it'll tell this community about them before they're actively exploited 🔥.
4.2. Co-operation, Interaction and Disclosure of Information 🫶
There are legal and ethical limits on what information can flow out of the XYZ-CERT, many of which are also outlined in the XYZ University Policy on Computing Facilities, and all of them will be respected 🎀. The XYZ-CERT also acknowledges its debt to the spirit of cooperation that created the Internet, and it's committed to contributing to that spirit 🌸. So while appropriate measures will be taken to protect the identity of constituency members and members of neighbouring sites where necessary, the XYZ-CERT will otherwise share information freely whenever it helps others resolve or prevent security incidents ✨.
In the paragraphs below, "affected parties" means the legitimate owners, operators, and users of the relevant computing facilities 🧑💻. It does not mean unauthorized users, including authorized users who are making unauthorized use of a facility. Intruders may have no expectation of confidentiality from the XYZ-CERT 🕵️♀️. They may or may not have legal rights to confidentiality, and those rights will of course be respected where they exist ⚖️.
Information being considered for release is classified as follows:
- Private user information is information about particular users, or in some cases particular applications, that must be treated as confidential for legal, contractual, and/or ethical reasons 🔒.
Private user information will not be released in identifiable form outside the XYZ-CERT, except as provided for below. If the user's identity is disguised, the information can be released freely (for example, to show a sample .cshrc file as modified by an intruder, or to demonstrate a particular social engineering attack) 🙈.
- Intruder information is like private user information, but it's about intruders 🦹♀️.
Intruder information, and especially identifying information, won't be released to the public (unless it becomes a matter of public record, for example because criminal charges have been laid). It will be exchanged freely with system administrators and CSIRTs tracking an incident 🤝.
- Private site information is technical information about particular systems or sites 🏢.
It won't be released without the permission of the site in question, except as provided for below 🙅♀️.
- Vulnerability information is technical information about vulnerabilities or attacks, including fixes and workarounds 🛠️.
Vulnerability information will be released freely, though every effort will be made to inform the relevant vendor before the general public hears about it 📬.
- Embarrassing information includes the statement that an incident has occurred, and information about its extent or severity 😳. It may concern a site, or a particular user or group of users.
Embarrassing information won't be released without the permission of the site or users in question, except as provided for below 💜.
- Statistical information is embarrassing information with the identifying information stripped off 📈.
Statistical information will be released at the discretion of the Computing Services Department 🎀.
- Contact information explains how to reach system administrators and CSIRTs ☎️.
Contact information will be released freely, except where the contact person or entity has asked that it not be, or where the XYZ-CERT has reason to believe that sharing it wouldn't be appreciated 🌷.
Potential recipients of information from the XYZ-CERT are classified as follows:
- XYZ University management 👑 is entitled to receive whatever information is necessary to help handle computer security incidents in their jurisdictions. That's because of the nature of their responsibilities and the expectations of confidentiality that come with them.
- Members of the Office of Rights and Responsibilities are entitled to receive whatever information they request about a computer security incident or related matter that's been referred to them for resolution ⚖️. The same goes for the XYZ Security Department, when its help with an investigation has been enlisted, or when the investigation was started at its request 🔍.
- System administrators at XYZ University who are members of the CCSA are also trusted with confidential information, because of their responsibilities 🔐. However, unless they're also members of the XYZ-CERT, they'll only be given the confidential information they need to help with an investigation, or to secure their own systems 🛡️.
- Users at XYZ University are entitled to information about the security of their own computer accounts 💅, even if that means revealing "intruder information" or "embarrassing information" about another user. For example, if account
aaaais cracked and the intruder attacks accountbbbb, userbbbbis entitled to know thataaaawas cracked, and how the attack on thebbbbaccount was carried out. Userbbbbis also entitled, if she or he asks for it, to information about accountaaaathat might helpbbbbinvestigate the attack. For instance, ifbbbbwas attacked by someone remotely connected toaaaa,bbbbshould be told where the connections toaaaacame from, even though that information would normally be private toaaaa😱. Users at XYZ University are also entitled to be notified if their account is believed to have been compromised 🚨. - The XYZ University community won't receive any restricted information, unless the affected parties have given permission for it to be shared 🙅♀️. Statistical information may be made available to the wider XYZ community 📊. The XYZ-CERT has no obligation to report incidents to the community, though it may choose to 🤷♀️. In particular, the XYZ-CERT will likely tell all affected parties how they were affected, or will encourage the affected site to do so 💌.
- The public at large gets zero restricted info 🙅♀️ No special effort goes into talking to them, BUT XYZ-CERT knows that anything shared with the XYZ University community is basically shared with the whole world, so it'll tailor what it puts out with that in mind 👀✨
- The computer security community gets treated exactly like the general public 💅 Members can hang out in newsgroups, mailing lists (including the full-disclosure list "bugtraq"), and conferences, but XYZ-CERT treats those spaces like the public at large. Technical stuff, vulnerabilities included, can be discussed in as much detail as you want, but any examples from XYZ-CERT's own experience get disguised so nobody's identity is exposed 🙈🎀
- The press is also part of the general public 📰 XYZ-CERT won't interact directly with reporters about computer security incidents, except to point them toward info that's already been released to the public. If needed, info goes to the XYZ University Public Relations Department and the Customer Relations group of the Computing Services Department, and all incident-related questions get referred to those two. Members can still grant interviews on general computer security topics, and they're actually encouraged to, as a public service 🌈
- Other sites and CSIRTs that are partners in investigating an incident will sometimes be trusted with confidential info 🤝 But only if the foreign site's bona fide can be verified, and only the info likely to help resolve the incident gets shared. This mostly happens with sites XYZ-CERT already knows well (for example, several other Quebec universities have informal but well-established working relationships with XYZ University in such matters).
For the purposes of resolving a security incident, otherwise semi-private but relatively harmless user info, like the provenance of connections to user accounts, isn't considered highly sensitive and can be sent to a foreign site without excessive precautions. "Intruder information" gets shared freely with other system administrators and CSIRTs. "Embarrassing information" can be shared when there's reasonable assurance it will stay confidential, and when it's necessary to resolve an incident 🫣
- Vendors count as foreign CSIRTs for most intents and purposes 🏪 XYZ-CERT wants vendors of all kinds of networking and computer equipment, software, and services to level up their product security 💪 So a vulnerability found in one of their products gets reported to the vendor, along with all the technical details needed to identify and fix the problem. Identifying details won't be given to the vendor without the permission of the affected parties 🔒
- Law enforcement officers get full cooperation from XYZ-CERT 👮♀️, including any info they need to pursue an investigation, in accordance with the Policy on Computing Facilities.
4.3 Communication and Authentication
Given the kinds of info XYZ-CERT will likely be dealing with, telephones are considered secure enough to use even unencrypted 📞 Unencrypted e-mail isn't considered particularly secure, but it's fine for low-sensitivity data ✉️ If highly sensitive data needs to go by e-mail, PGP will be used 🔐 Network file transfers get treated like e-mail for these purposes, so sensitive data should be encrypted for transmission 💾
Whenever trust needs to be established, like before relying on info given to XYZ-CERT or before disclosing confidential info, the identity and bona fide of the other party will be ascertained to a reasonable degree of trust 🕵️ Within XYZ University, and with known neighbor sites, referrals from known trusted people are enough to identify someone. Otherwise, other methods get used, such as a search of FIRST members, the use of WHOIS and other Internet registration info, etc, along with telephone call-back or e-mail mail-back to make sure the party isn't an impostor 👀 Incoming e-mail whose data must be trusted will be checked with the originator personally, or by means of digital signatures (PGP in particular is supported).
5. Services
5.1 Incident Response
XYZ-CERT will help system administrators with the technical and organizational sides of incidents 🛠️ In particular, it will provide assistance or advice on the following aspects of incident management:
5.1.1 Incident Triage
- Investigating whether an incident actually occurred.
- Determining the extent of the incident.
5.1.2 Incident Coordination
- Determining the initial cause of the incident (vulnerability exploited).
- Facilitating contact with other sites which may be involved.
- Facilitating contact with XYZ University Security and/or appropriate law enforcement officials, if necessary.
- Making reports to other CSIRTs.
- Composing announcements to users, if applicable.
5.1.3 Incident Resolution
- Removing the vulnerability.
- Securing the system from the effects of the incident.
- Evaluating whether certain actions are likely to reap results in proportion to their cost and risk, in particular those actions aimed at an eventual prosecution or disciplinary action: collection of evidence after the fact, observation of an incident in progress, setting traps for intruders, etc.
- Collecting evidence where criminal prosecution, or University disciplinary action, is contemplated.
XYZ-CERT will also collect statistics on incidents that occur within or involve the XYZ University community, and will notify the community as necessary to help it protect against known attacks 📊
To use XYZ-CERT's incident response services, send e-mail as per section 2.11 above. Remember that the amount of assistance available will vary according to the parameters described in section 4.1 💌
5.2 Proactive Activities
XYZ-CERT coordinates and maintains the following services to the extent possible depending on its resources:
- Information services
- List of departmental security contacts, administrative and technical. These lists will be available to the general public, via commonly-available channels such as the World Wide Web and/or the Domain Name Service.
- Mailing lists to inform security contacts of new information relevant to their computing environments. These lists will be available only to XYZ University system administrators.
- Repository of vendor-provided and other security-related patches for various operating systems. This repository will be available to the general public wherever license restrictions allow it, and will be provided via commonly-available channels such as the World Wide Web and/or ftp.
- Repository of security tools and documentation for use by sysadmins. Where possible, precompiled ready-to-install versions will be supplied. These will be supplied to the general public via www or ftp as above.
- "Clipping" service for various existing resources, such as major mailing lists and newsgroups. The resulting clippings will be made available either on the restricted mailing list or on the web site, depending on their sensitivity and urgency.
- Training services
- Members of the XYZ-CERT will give periodic seminars on computer security related topics; these seminars will be open to XYZ University system administrators.
- Auditing services
- Central file integrity checking service for Unix machines, and for any other platforms capable of running "tripwire".
- Security level assignments: machines and subnetworks at XYZ University will be audited and assigned a security level. This security level information will be available to the XYZ University community, to facilitate the setting of appropriate access privileges. However, details of the security analyses will be confidential, and available only to the concerned parties.
- Archiving services
- Central logging service for machines capable of Unix-style remote logging. Incoming log entries will be watched by an automated log analysis program, and events or trends indicative of a potential security problem will be reported to the affected system administrators.
- Records of security incidents handled will be kept. While the records will remain confidential, periodic statistical reports will be made available to the XYZ University community.
Detailed descriptions of the above services, along with instructions for joining mailing lists, downloading information, or participating in certain services such as the central logging and file integrity checking services, are available on the XYZ-CERT web site, as per section 2.10 above.
6. Incident Reporting Forms
There are no local forms developed yet for reporting incidents to XYZ-CERT. If possible, please make use of the Incident Reporting Form of the CERT Coordination Center (Pittsburgh, PA). The current version is available from:
ftp://info.cert.org/incident_reporting_form
7. Disclaimers
While every precaution will be taken in the preparation of information, notifications and alerts, XYZ-CERT assumes no responsibility for errors or omissions, or for damages resulting from the use of the information contained within. 🫶
4 Acknowlegdements 🎀
The editors are so grateful to Anne Bennett for the contributed material and for the careful editorial scrutiny 💖 Huge thanks also to Don Stikvoort for helping rework the description of Incident Response Team services 🫶
5 References ✨
[RFC 2196] Fraser, B., "Site Security Handbook", FYI 8, RFC 2196, September 1997. 📚
[RFC 1983] Malkin, G., "Internet Users' Glossary", FYI 18, RFC 1983, August 1996. 🧚
6 Security Considerations 🔥
okay this section is lowkey the most important one for CSIRTs 😭 This document is about how Computer Security Incident Response Teams operate, and how they talk to their constituencies and to other organizations. So it's not really about the security of protocols, applications, or network systems themselves 💅 It's also not about the specific responses and reactions to security incidents. It's only about describing properly the responses that CSIRTs provide 🌸
BUT, and this is a big but 🙈, it's vital that the CSIRTs themselves operate securely. That means they must set up secure communication channels with other teams and with members of their constituency 🔐 They also have to secure their own systems and infrastructure, so they can protect their constituency's interests and keep the identities of victims and reporters of security incidents confidential 🫶 No cap, that confidentiality part is everything 💀
7 Authors' Addresses 💜
Nevil Brownlee
ITSS Technology Development
The University of Auckland
Phone: +64 9 373 7599 x8941
EMail: n.brownlee@auckland.ac.nz
Erik Guttman
Sun Microsystems, Inc.
Bahnstr. 2
74915 Waibstadt Germany
Phone: +49 7263 911484
EMail: Erik.Guttman@sun.com8 Full Copyright Statement 🦋
Copyright (C) The Internet Society (1998). All Rights Reserved. 🌈
okay so the vibe here is: you're totally free to copy this document and share it with others 🎀 You can also make derivative works that comment on or explain it, or help people implement it, and you can prepare, copy, publish and distribute those however you like, in whole or in part, with no restrictions of any kind 💖 The one condition is that the above copyright notice and this paragraph have to be included on every copy and every derivative work ✨
HOWEVER, this document itself can't be modified in any way. That includes removing the copyright notice or the references to the Internet Society or other Internet organizations 🙅♀️ The exceptions are: if you need it for developing Internet standards, then the copyright procedures in the Internet Standards process must be followed, or if you need to translate it into languages other than English 🌸
The limited permissions above are perpetual, and the Internet Society or its successors or assigns will never revoke them 🧚 Forever and ever, bestie 🫶
This document and the information in it are provided on an "AS IS" basis, and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE 😭 That's the legal tea, periodt 💅
📦 where this page comes from
- ietf: rfc2350 1998-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms