In this idea paper we provide a comprehensive overview of the role computer security incident response team (CSIRT) and analyse the challenges of building a CSIRT in the academic environment. We describe an academic CSIRT schema of operation, propose its operations and risk assessment template, and discuss key threats to tackle, catalog of services, knowledge base and incident handling. The proposed CSIRT concept is tailored specifically to university environment and will be verified at a selected university.
including legacy systems that may be more vulnerable. And finally - given the evolving
regulatory landscape, it will soon be necessary to implement measures in compliance [
Although a computer security incident response team (CSIRT) should be a common
practice in all types of organisations, there are only 56 teams in research and education
organisations out of 581 CSIRT in the EU [
The aim of this paper is to propose a new concept for building a security team in an academic environment. We want to outline strategies to effectively protect sensitive data and information systems without compromising academic freedom and creativity. We will also address the specific challenges academic institutions face in the area of cybersecurity taking into account the unique needs and dynamics of educational institutions.
CSIRT represents a specialized team of experts whose primary responsibility is to respond to
cyber incidents, including but not limited to DDoS attacks, malware, data breaches, misuse, or
the outage of entire infrastructures [
The fundamental differences among the individual teams lie in their purpose, authorities, and, of course, finances. It is not possible to unequivocally determine which team is the best, as each has its own specifics. For example, a governmental CSIRT will primarily focus on protecting critical elements of the state, whereas a university team will primarily concentrate on safeguarding research databases and, generally, school infrastructure. A corporate CSIRT, on the other hand, will unequivocally endeavor to protect its infrastructure and ensure the continuous operation of its business [7].
CESNET CSIRT provides cyber security for academic and research institutions in the
Czech Republic. Its main tasks include monitoring network traffic, detection and rapid
response to security incidents, implementation of preventive measures, provision of expert
advice and support, organisation of training and educational events, cooperation with
national and international security organisations, processing of incident reports and
research in the field of cyber security. However, little is known in the literature about how
to build academic CSIRT and how to align them with the national and international
structures of CSIRT [
The first essential step is to conduct a feasibility study to determine whether the
establishment of a CSIRT team is truly necessary. This study must encompass all key aspects
associated with project implementation, including a clear answer to the question of whether a
CSIRT team is needed. Regardless of the team's level, it is crucial to clearly define its goals,
responsibilities, and workflow. These criteria are pivotal for designing an appropriate CSIRT
team structure and preparing all necessary documentation for its establishment.
Unfortunately, despite all these measures, finances remain paramount, as only a sufficiently large
budget can secure all required material and human resources for the project [
This review focused on the unique challenges and characteristics of academic CSIRTs and compared them to national and enterprise CSIRTs. We reviewed academic articles, official documents, standards such as RFC 2350, and practical examples of CSIRTs to understand current trends and best practices.
The information was organised into sections for each type of CSIRT, detailing their main tasks and characteristics. National CSIRTs secure critical state infrastructure and cooperate at the international level. Corporate CSIRTs benefit from better financial support and use artificial intelligence for decision-making. Academic CSIRTs face funding issues and staff turnover but emphasise research and publishing.
We compared the strengths and weaknesses of each type of CSIRT and highlighted the specific needs of academic teams. We concluded the review with key findings and recommendations for improving the performance of CSIRTs and provided insights for further development in cybersecurity with a focus on academic CSIRTs.
The structure of the CSIRT team that we are examining focuses primarily on three categories: national, corporate, and academic CSIRT teams. Although these teams are fundamentally similar, each has a distinct role that makes their existence essential.
National CSIRT teams have several primary missions [
2. Collaboration with entities within the state. 3. Transnational cooperation with the global CSIRT community.
National CSIRT primarily focuses on the critical infrastructure of the state and strives to
secure key institutions for its proper functioning. Currently, cybersecurity is a significant
topic globally, and every state is actively seeking to engage in measures in this area.
An important factor is that each national CSIRT team adheres to RFC 2350 [
The corporate CSIRT team is usually better financially supported than the national team and
also has sufficient resources and opportunities for the professional development of its
members. The main focus of the corporate team is to ensure the secure operation of the
company and prevent unauthorized access to the internal network. From a cybersecurity
perspective, end-user devices utilized by company employees are the most vulnerable [
The corporate team typically has the advantage of not needing to connect with various
public entities and is not required to operate from any specific public location. This simple
rule enables easier monitoring of entry points into the internal network compared to
government or university teams. The key elements of the corporate team include proper
structure, allocation of responsibilities, and prompt responses to cyber incidents. Smaller
units within the team also play an important role, requiring efficient and rapid
communication. The final integral component is the security manager, who decides on the
course of action in resolving the specific cyber incident. It is important to note that
currently, the majority of incidents are addressed automatically, with decision-making
handled by artificial intelligence (UI) [
The university CSIRT is highly specific due to its functionality, as it requires various user
and application approaches, and additionally involves research databases and projects in
general. Universities often face inadequate financial support for this type of project, and they
frequently rely on assistance from public companies or the government. From a certain
perspective, they have an advantage in recruiting team members due to the possibility of involving
students. However, this leads to team instability, and frequent turnover of members may not
guarantee sufficient expertise within the team [
Given the scope of applications, end-user devices, and other server equipment, the university network is relatively unique and capable of addressing specific cyber incidents. The university CSIRT primarily focuses on three main areas:
2. Investigating cyber incidents.
3. Publishing results and research from the university CSIRT team.
The university CSIRT team places particular emphasis on research, as the range of security
aspects is the broadest among all types of CSIRT teams [
According to [
In this chapter, we will focus on the process of establishing a CSIRT team and describing its schema of operation. This study focuses on the creation of a team for a specific part of the university, such as a department, faculty, etc. This approach differs from the creation of a CSIRT for the entire university, which views the university as a whole. In this case, the study is centered on the security of projects conducted within individual parts, which are often independent of the overall university infrastructure and have a certain degree of autonomy, including responsibility for security. The main tasks of a CSIRT are: risk identification, compiling a service catalog, and incident response. Considering the dynamic nature of the entire process, it is necessary to periodically review threats, vulnerabilities, and new services.
Based on the research of existing solutions, the following CSIRT schema of operation (Figure 1) was proposed. Solution is proposed based on previous literature research with choosing suitable techniques found in materials described in previous chapter.
After establishing a CSIRT, it is necessary to identify (i) threats and vulnerabilities, (ii) the service catalog, and (iii) controls identification (protection options for services). These three factors then feed into the risk assessment. Within this step, (i) risk identification, (ii) risk estimation, and (iii) risk evaluation are performed.
In the event of an incident, the first level of support determines whether relevant measures can be taken using playbooks established in the knowledge base. If the incident cannot be resolved at the first level of support, it is escalated to specialized second and third-level teams. The record of the resolution procedure is stored in the knowledge base in case of a recurring incident. If a new threat is identified, it is necessary to reassess the risks in relation to the operational service catalog.
According to [
There are different roles in CSIRT. Blue and red teams play complementary roles in ensuring the organization's cybersecurity posture is robust and resilient against threats.
The blue team's primary focus is on defense and response. They are responsible for continuous monitoring of network traffic, system logs, and other data to detect potential security incidents, utilizing tools such as Security Information and Event Management (SIEM) systems for data aggregation and analysis. When a security incident is detected, the blue team acts swiftly to contain, eradicate, and recover from it by following predefined incident response plans and employing forensic tools to investigate breaches. Additionally, they manage vulnerabilities by regularly scanning systems for weaknesses and ensuring timely application of patches and updates. The blue team also gathers and analyzes threat intelligence to stay ahead of emerging threats and proactively defend against them. Furthermore, they are involved in educating employees on security best practices, phishing awareness, and other aspects of cybersecurity hygiene.
The red team focuses on attack and testing. They conduct penetration testing to simulate attacks on the organization’s systems, networks, and applications to identify vulnerabilities and weaknesses, using both automated scans and manual testing techniques. This team also tests the organization’s resilience against social engineering attacks, such as phishing or pretexting, to identify human vulnerabilities. They perform advanced, targeted attack simulations, like Advanced Persistent Threat (APT) scenarios, to test the organization’s detection and response capabilities under realistic conditions. After completing their assessments, the red team documents their findings and provides detailed reports on vulnerabilities, attack vectors, and potential impacts, along with recommendations for improving defenses. Collaboration with the blue team is crucial, as it involves addressing identified weaknesses, improving incident response plans, and enhancing overall security measures.
Risk assessment can be divided into three areas.
The first area (User-focused threats) includes attacks targeted at users. These are mainly social engineering attacks, attacks using computer viruses, and attacks on insufficiently secured accounts. This category also includes insider threats, where the attacker exploits access to local network resources. However, this type of attack can also result from an insufficiently secured or compromised employee account.
The second area (Application-focused threats) includes attacks focused on application security and the security of system infrastructure. In practice, these are attacks on operating systems, hypervisors, web servers, database systems, and the applications themselves.
The third area (Network-focused threats) covers network infrastructure and network protocols. Some of these attacks fall within the competence of the Internet Service Provider (ISP). Other attacks target the vulnerabilities of individual protocols such as DNS, SMTP, IP, etc. In most universities, the network infrastructure is centrally managed in collaboration with connectivity providers. Therefore, only significant threats from this area are included here, as they must be considered, but they cannot be influenced much in terms of the proposed solution. Application-focused threats
Network-focused threats
Injection flaws DDoS Broken authentication MitM Sensitive data exposure Packet Sniffer
XML external entities IP Spoofing Security misconfiguration Flood Attack
XSS DNS Spoofing Insecure deserialization
Insufficient logging &
monitoring Login credentials Password attack
Malware Session Hijacking Insider Threats SSL Hijacking
Compromised key Brute Force attack
Malware
Database attack
Table 1 was created by selecting relevant threats from [
Despite the categorization of threats (Table 1), it is important to note that some risks can
be mitigated in multiple ways. For this reason, risk assessments must always be conducted
comprehensively, utilizing all possible defense options. Additionally, some security systems
can conflict with each other. For example, sensitive data exposure or MitM
(Man-in-theMiddle) attacks can be eliminated by implementing encrypted communication. However,
some security systems perform SSL inspection to test communication for malware, which
reduces the security of sensitive data [
The risk assessment will be recorded in a two-dimensional table, with individual threats in the rows and assets in the columns. The assessment involves three metrics: impact (I), threat (T), and vulnerability (V). All metrics are defined on a scale from 1 to 4, where 1=low, 2=medium, 3=high, and 4=critical. The risk level is determined by formula R=I x T x V and finally is evaluated as Low (1-16), Medium (17-31), High (32-47), Critical (48-64). An example of risk level assessment is provided in Table 2. The values presented in the table are illustrative only. The actual determination of risk levels will be possible after the analyses are conducted. Compromised key
XSS Spam Total
The identification of assets and provided services is crucial for determining the resources that
need protection. It is recommended to start with a minimal, yet precisely specified set of
resources, and then add and expand as necessary [
Knowledge base provides a centralized repository for all the information relevant to incident response. This includes documentation of past incidents, response procedures, technical details, threat intelligence, and more. A playbook in the context of a CSIRT and knowledge base is a set of predefined procedures and actions to be taken in response to specific types of incidents. Each playbook provides step-by-step guidance on how to handle a particular scenario.
Given the expected frequent turnover of CSIRT members from students, it is essential to ensure effective knowledge transfer. Therefore, the knowledge base is a crucial component of the proposed solution, and it is necessary to precisely document the resolution of incidents in the form of a playbook for future use.
According to [
Compared to other solutions, the proposed solution is tailored specifically for deployment in an academic environment. It is primarily focused on preventing attacks on data and the misuse of research and student projects. Less emphasis is placed on network security, which is managed by the university's system administration. More emphasis is placed on newly deployed software systems, which, unlike in a corporate environment, have greater flexibility during deployment and thus become more frequent targets of attacks.
A key strength of this study is the compilation of the latest insights for creating a CSIRT. At the same time, it is tailored to the needs and specifics of the university's department. Individual departments often have autonomy, within which they can create websites, computer systems, and projects to support teaching, which are not part of the university's system and therefore do not fall directly under the control of university-wide security. However, this also brings the responsibility for the operated systems and their security. This study can be compared to the relationship between a university and an ISP. An ISP uses its own security team, just like a university, but the purpose and functioning of each team differ. Similarly, in this study, the university acts as the ISP, and the departments are the system operators.
A potential threat may predominantly lie in the relationship between the university department's CSIRT and the university's infrastructure. Additionally, greater involvement of students and internal staff from the department is expected, which will often lead to increased turnover. Therefore, it is necessary to adhere to the principles of maintaining a knowledge base for repeated incident resolution.
We will utilize the proposed CSIRT operation within a selected university. The experience and collected feedback will be used in a follow up full research paper.