Development of a Cyber Security Incident Response Team

A Cyber Security Incident Response Team is vital to any organization, especially for financial sectors, as it establishes roles, responsibilities, and communication procedures, requires technical and procedural skills, and is responsible for identifying and handling incidents. It also reports findings to management and incident to the Cyber crime office and the AST. This presentation discusses the importance of CSIRT in organizations and proposes a CSIRT for iFinance Bank, one of the largest banks in the country.

DEVELOPMENT
OF A CYBER
SECURITY
INCIDENT
RESPONSE TEAM

NEED TO
KNOW
CSIRT
IMPORTANCE OF CSIRT IN
ORGANISATIONS

CSIRT
CYBER SECURITY INCIDENT
RESPONSE TEAM:
 Establishes roles, responsibilities and
communication procedure
 Requires technical and procedural skills
(Pfleeger, 2017)
 Responsible for identifying and handling
incidents
 Reports findings to the management
 Reports incident to the Cyber crime office
and the AST
 Serves as the first responder in case of

IMPORTANCE OF
CSIRT IN
ORGANISATIONS
With the increased amount of Cyber security
threats, almost all organisations need to
implement CSIRT within their range of security
measures.
A Cyber Security Incident Response Team is very
much vital to any organisation especially for
financial sectors as it provides the following
benefits:
 A cyber security incident response
team works together to prevent the
security incidents that takes place
within the organisation and
prevents them from happening in
future (Ruefle & Murray, 2014).
 Provides guidance for recovering
the security incidents (Jayamaha,
2015).

PROPOSAL OF A CSIRT FOR IFINANCE
ORGANISATION
Background:
 One of the largest bank in the country
 Formed as a result of acquisition of
regional banks in the West and Mid
West
 Has a billion of assets
 Operates over 2225 banking offices in
25 states
 Provides services to over 4000 ATMs
iFinance
Bank

NEED FOR A CSIRT FOR I FINANCE
BANK
With the growing rate of financial
transactions and simultaneously the
growing rate of cyber threats, financial
organisations are at the verge of facing
several security incidents (Bada et al.,
2014). The organisation of iFinance is
gradually expanding their network with
other banks and so it is necessary to
have a single security policy to govern all
its business units.

PROPOSED CSIRT FOR I FINANCE BANK
MISSION AND VISSION STATEMENT:
 In a mission to provide assistance and information to the Information Security managers
and other staffs for implementing effective measures in terms of reducing risks in case of
any computer security incidents.
KEY STAKEHOLDERS:
 Security managers
 Public relations
 Risk groups
SCOPE OF THE CSIRT:
 To build a repeatable process in order to effectively handle the response of the incidents
SERVICES OFFERED:
 Supporting and preventing of any security response
 Mitigating the risks
 Improving brand image

STAFF
RECOMMENDA
TION FOR THE
PROPOSED
CSIRT
STAFFING STRUCTURE:
 Managers
 Core team members
 Subject matter experts
 Internationally affiliated representatives
IDENTIFICATION AND
PROCURRING OF
PERSONNEL:
 Security managers need to sign
agreements with technology department
 Subject matters need to be assigned in
case of any security incident.
INFRASTRUCTURE REQUIRED:
 The organisation should provide security
infrastructure on its internal website

COMMUNICATION STRATEGY :
The communication strategy
should include the following:
 Arrangement of formal
management and technical
training class
 Brainstorming session to
discuss various operation
procedure
 Monthly teleconference to
discus about progress
PROPOSED TIMELINE FOR THE
CSIRT:
 18 TO 24 MONTHS

ROI
RESEARCH OF
THE IFINANCE
BANK
TOTAL COST OF AN INCIDENT:
 US$12.97 million to US$18.28 million
DIRECT COST OF MANPOWER:
 $1,694.61
DIRECT COST OF EQUIPMENT:
 $27794.54+/- $4169.18
POTENTIAL COST OF LOST
BUSINESS:
 Less than 14% after implementing CSIRT

CONCLUSION
Thus from the presentation it can be concluded
that it is very much essential to develop a well
planned CSIRT for the organisation of IIFINANCE
in order to mitigate the possible cyber security
issues that can occur in future and to effectively
plan a response to prevent such issues in future.

REFERENCES:
Bada, M., Creese, S., Goldsmith, M., Mitchell, C., & Phillips, E.
(2014). Improving the effectiveness of CSIRTs.
Jayamaha, R. (2015). INNOVATE TO WIN: INNOVATE FOR FINANCIAL
INCLUSION. Unpublished), World Bank.
Pfleeger, S. L. (2017). Improving Cybersecurity Incident Response
Team (CSIRT) Skills, Dynamics and Effectiveness. Trustees of
Dartmouth College Hanover United States.
Ruefle, R. M., & Murray, M. (2014). CSIRT requirements for
situational awareness. CARNEGIE-MELLON UNIV PITTSBURGH PA
SOFTWARE ENGINEERING INST.