Enhancing International Cybersecurity Statistics: CSIRTs Risk Indicators Study
Explore the development of cybersecurity risk indicators through an in-depth study on the international comparability of statistics produced by CSIRTs. Discover the feasibility analysis, preliminary findings, and key questions related to CSIRT aspects, organizational capacity, and incident-related data sources.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
IMPROVING THE INTERNATIONAL COMPARABILITY OF STATISTICS PRODUCED BY CSIRTs Developing Cybersecurity Risk Indicators panel 26thAnnual FIRST Conference Aaron Martin
Feasibility study design Questionnaire developed to determine: Can CSIRTs respond to these questions? Would the data collected help produce quality statistical indicators? Widely distributed to national CSIRTs 25 responses Analysis of results ongoing
Preliminary analysis Three sets of primary questions 1. General aspects of CSIRTs 2. Organisational capacity 3. Incidents Feedback questions Explaining non-responses Additional information Basis for calculations Difficulties encountered How to improve the questions
General aspects Accounting for more than one national CSIRT per country/economy Classifying CSIRTs by constituency IP addresses as an indicator of network size Internet users as an indicator of network size Understanding CSIRT data sources
Capacity questions CSIRT annual budget Percentage of budget funded by government FTEs employed by the CSIRT FTEs employed for security incident handling Technical skills Incident reports handled without human intervention (i.e. automated) Requests for assistance dedicated action taken Targeted mitigation (proactive notice) Formal co-operation Informal co-operation
Incident-related questions Phishing websites hosted in the CSIRT s constituency DoS attacks targeting the constituency Defaced websites hosted in the constituency Servers hosting malware Servers directing to malware Botnet C&C servers
