RFC2350 CSIRT Description for CSIRT-CV


1. About this document

1.1. Date of Last Update: This is version 1.11, published 2017/06/07.

1.2. Distribution List for Notifications: Currently CSIRT-CV does not use any distribution lists to notify about changes in this document.

1.3. Locations where this Document May Be Found: The current version of this CSIRT description document is available from the CSIRT-CV WWW site; its URL is www.csirtcv.gva.es/csirt-cv

Please make sure you are using the latest version.


2. Contact Information

2.1. Name of the Team: Centro de Seguridad TIC de la Comunitat Valenciana (CSIRT-CV)

2.2. Address: Centro de Seguridad TIC de la Comunitat Valenciana (CSIRT-CV)
C/ Ramiro de Maeztu 9, 46022 Valencia. (Spain)

2.3. Time Zone: CSIRT-CV is one/two hour(s) ahead of UTC (GMT) in winter/summer,UTC+0100 in winter and UTC+0200 in summer ( DST).

2.4. Telephone Number: +34 963 985 300 (ask for CSIRT-CV)

This line is available during normal working hours (from 08:00 am to 15:00pm and from 16:30 pm to 19:00pm From Monday to Thursday and from 08:00am to 15:00pm on Friday). Out of normal working hours, inquiries will be noted down and sent to CSIRT-CV.

2.5. Other Telecommunication: None available.

2.6. Electronic Mail Address: CSIRT-cv email This is a mail alias that relays mail to the human(s) on duty for CSIRT-CV.
Mail is the preferred way of contacting us. And this is also the mail to report a computer security incident to CSIRT-CV.

2.7. Public Keys and Other Encryption Information: CSIRT-CV has a PGP key whose KeyID is 0x36BCD796 and whose fingerprint is 4C83 A9FE 6051 1021 5B8C 1B31 FB42 2D6C 36BC D796
The key and its signatures can be found at the usual large public keyservers.

2.8. Team Members: None available.

2.9. Other Information: General information about the CSIRT-CV. as well as links to various recommended security resources, can be found at CSIRT-CV and Contact Form.

2.10. Points of Customer Contact: The preferred method for contacting the CSIRT-CV is via e-mail at CSIRT-cv email; e-mail sent to this address will “biff” the responsible human, or be automatically forwarded to the appropriate backup person, immediately. If you require urgent assistance, put “urgent” in your subject line.

If it is not possible (or not advisable for security reasons) to use e-mail, the CSIRT-CV can be reached by telephone during regular office hours.

The CSIRT-CV’s hours of operation are generally restricted to regular business hours (from 08:00 am to 15:00pm and from 16:30 pm to 19:00pm From Monday to Thursday and from 08:00am to 15:00pm on Friday, except holiday).

However, incidents out of this range will be noted down for further processing. If possible, when submitting your report, use the incidents form Incident Reporting Form or the phishing form Phishing Reporting Form. Note that, when you report an incident, the web page changes into SSL with GVA’s certificates.


3. Charter

3.1. Mission Statement: The purpose of the CSIRT-CV is, to assist members of Valencian Community: citizens, small and medium-sized enterprises and mainly public administration, in implementing proactive measures to reduce the risks of computer security incidents, and second, to assist this community in responding to such incidents when they occur.

3.2. Constituency: CSIRT-CV’s constituency is the citizens, small and medium-sized enterprises, and public administration in the Valencian Community. However, please note that, notwithstanding the above, CSIRT-CV.
Incident resolution services will be provided mainly for on-site public administration systems.

3.3. Sponsorship and/or Affiliation: CSIRT-cv is sponsored by the ‘Consellería de Hacienda y Modelo Económico’ which is the Ministry of Treasury and Public Administration within “Generalitat Valenciana”’s Government.
It maintains affiliations with various other CSIRTs on an as needed basis.

3.4. Authority: CSIRT-CV operates under the auspices of ‘Consellería de Hacienda y Modelo Económico’ within Generalitat Valenciana’s Government.

For further information on the mandate and authority of the Department of Computing Services, please, refer to the ministry web site (in Spanish).

CSIRT-CV expects to work cooperatively with system administrators and users at Valencian Community, and, as far as possible, to avoid authoritarian relationships. However, should circumstances warrant it, CSIRT-CV will appeal to Computing Services to exert its authority, direct or indirect, as necessary.

4. Policies

4.1. Types of Incidents and Level of Support: The level of support given by CSIRT-CV will vary depending on the type and severity of the incident or issue, the type of constituent, the size of the user community affected, and the CSIRT-CV’s resources at the time.
Incidents will be prioritized according to their apparent severity and extent. These incidents will be assessed as to their relative severity at CSIRT-CV’s discretion.

Note that no direct support will be given to end users; they are expected to contact their system administrator, network administrator, or department head for assistance.

In most cases, CSIRT-CV will provide pointers to the information needed to implement appropriate measures.

CSIRT-CV is committed to keeping its constituency informed of potential vulnerabilities, and where possible, will inform this community of such vulnerabilities before they are actively exploited.

4.2. Co-operation, Interaction and Disclosure of Information: CSIRT-CV will cooperate with other organisations in the field of computer security. This cooperation also includes and often requires the exchange of information regarding security incidents and vulnerabilities. Nevertheless CSIRT-CV will protect
the privacy of its constituency and therefore (under normal circumstances) pass on information in an anonymized way only.

CSIRT-CV operates under the restrictions imposed by the law of Spanish Data Protection Authority. Therefore it is also possible that CSIRT-cv may be forced to disclose information due to a Court’s order.

CSIRT-CV, unless explicitly authorized, will not divulge the identity or vital information of victims of computer security incidents.

4.3. Communication and Authentication: In view of the types of information that the CSIRT-CV will likely be dealing with, telephones will be considered sufficiently secure to be used even unencrypted. Unencryptede-mail will not be considered particularly secure, but will be sufficient for the transmission of low-sensitivity data. If it is necessary to send highly sensitive data by e-mail, PGP, or similar will be used. Network file transfers will be considered to be similar to e-mail for these purposes: sensitive data should be encrypted for transmission.

Where it is necessary to establish trust, for example before relying on information given to the CSIRT-CV, or before disclosing confidential information, the identity and bona fide of the other party will be ascertained to a reasonable degree of trust.

With known neighbour sites, referrals from known trusted people will suffice to identify someone. Otherwise, appropriate methods will be used, such as a search of Trusted Introducermembers, the use of WHOIS and other Internet registration information, etc, along with telephone call-back or e-mail mail-back to ensure that the party is not an impostor. Incoming e-mail whose data must be trusted will be checked with the originator personally, or by means of digital signatures (PGP in particular is supported).

5. Services

5.1. Incident Response (mainly on the gva.es network): CSIRT-CV will assist its constituency in handling the technical and organizational aspects of incidents. In particular, it will provide assistance or advice with respect to the following aspects of incident management:

5.1.1. Incident Triage:

          • Investigating whether indeed an incident occured.
          • Determining the extent of the incident.

5.1.2. Incident Coordination:

          • Determining the initial cause of the incident (vulnerability exploited).
          • Facilitating contact with other sites which may be involved.
          • Facilitating contact with appropriate security teams and/or law enforcement officials if necessary.
          • Making reports to other CSIRTs.
          • Composing announcements to users, (members of the constituency), if applicable.

5.1.3. Incident Resolution:

          • Technical Assistance. This may include analysis of compromised systems.
          • Recommendations on Eradication or Elimination of the cause of a security incident (the vulnerability exploited), and its effects.
          • Recovery Aid in restoring affected systems and services to their status before.
          • Suggestions in securing the system from the effects of the incident.

CSIRT-CV will collect statistics concerning incidents which occur within or involve its constituency and will notify the community as necessary to assist it in protecting against known attacks.

5.1.4. Technology watch:

          • Observer current trends in technology and distribute relevant knowledge to the constituency.

5.1.5. Provision of intrusion detection services (gva.es network):

          • The use of specialised tools or expertise to detect attacks and forward the alerts to the appropiate contact points in the community.

5.2. Proactive Activities: Proactive services provide means to reduce the number of actual incidents by giving proper and suitable information concerning potential incidents to the constituency. CSIRT-CV additional proactive services include:

5.2.1. Announcements:

          • CSIRT-CV will provide its constituency with information about ongoing attacks, security vulnerabilities, alerts in the general sense, and short-term recommended course of action for dealing with the resulting problems.

5.2.2. Vulnerability Analysis:

          • A database is maintained collecting information of vulnerabilities, automatically and manually, via network scans and by other means (penetration testing included). However, details of the security analyses will be confidential, and available only to the concerned parties.

5.2.3. Archiving services:

          • Records of security incidents handled will be kept. While the records will remain confidential, periodic statistical reports will be made available to the CSIRT-CV constituency.

5.3. Security Quality Management Services: In order to supervise and to increase the quality of the offered services, the following services are performed:

5.3.1. User Awareness Program:

          • The users’ awareness of security issues is improved by best practices guidelines programs, and appropriate measures. This implies an awareness of legal issues, in particular the enforcement of evidence collection.
          • CSIRT-CV will provide valuable educational materials aimed at increasing the awareness of security as well as improving the overall knowledge of security techniques among the members of the constituency. These materials in electronic formats will be distributed through the official website and social networks.
          • The members of CSIRT-CV will give seminars on computer security related topics to its constituency (mainly system administrators within gva.es network).

5.3.2. Education and Training:

          • Team members are constantly trained to enhance their skills and capacities.

5.3.3. Documentation: A documentation is maintained, dealing with the following topics:

          • The procedures being part of the services are documented.
            Results of Incident Management and Incident Analysis are documented, resulting in suggestions how to improve the services or systems, respectively.
          • Detailed descriptions of the above services, along with instructions for joining mailing lists, downloading information, or participating in certain services are available on the CSIRT-CV web site, as per section 2.10 above.

6. Incident Reporting Forms

If possible, use the following form when reporting a security incident: (this form is available in Spanish and Valencian)

For Phishing notifications, use the following form: (this form is available in Spanish and Valencian)

7. Disclaimers

While every precaution will be taken in the preparation of information, notifications and alerts, CSIRT-CV assumes no responsibility for errors or omissions, or for damages resulting from the use of the information contained within.

8. Security Considerations

This document discusses the operation of Computer Security Incident Response Teams, and the teams’ interactions with their constituencies and with other organizations.It is, therefore, not directly concerned with the security of protocols, applications, or network systems themselves.It is not even concerned with particular responses and reactions to security incidents, but only with the appropriate description of the responses provided by CSIRTs.

Nonetheless, it is vital that the CSIRTs themselves operatesecurely, which means that they must establish secure communication channels with other teams, and with members of their constituency.They must also secure their own systems and infrastructure, to protect the interests of their constituency and to maintain the confidentiality of the identity of victims and reporters of security incidents.


Aplicacions CSIRT-CV

AVÍS: algunes d’aquestes aplicacions solament estan disponibles a través de la xarxa de la GVA*
(si no es troba en aquesta xarxa, no podrà accedir a aquesta informació)

Avalua-T

Eina d’autoavaluació amb la qual podrà esbrinar si en la seua organització existeixen riscos en ciberseguretat. Inclou proposta de plans de millora.

Capacitació en seguretat per a empreses – Cursos

Formació online per a empleats, sobre els riscos en ciberseguretat existents i aplicació de bones pràctiques.

Capacitació en seguretat per a empreses – Mòduls interactius

Vídeos dirigits a empleats, amb l’objectiu de conscienciar en temes de ciberseguretat d’una manera interactiva.

GVA Bichos*

Laboratori d’anàlisi de fitxers per a determinar si suposen una amenaça per als sistemes corporatius.

GVA Custodes*

Plataforma de consulta que inclou diferents tipus d’informes sobre alertes detectades, pel nostre servei de detecció d’intrusos, en cada àmbit.

Avís legal

A través d’aquest avís legal es pretén regular les Condicions Generals d’Ús del portal que CSIRT-CV, amb dades de contacte disponibles en l’entrada de menú Contacte, posa a la disposició del públic en la present pàgina.

La utilització del contingut i/o serveis del portal per part de l’usuari suposa l’acceptació expressa a les següents Condicions Generals d’Ús, així com a la Política de Protecció de Dades de Caràcter Personal.

Condicions d’ús del portal
    • CSIRT-CV es reserva el dret d’efectuar modificacions en el contingut d’aquest portal sense previ avís, així com de la seua configuració i presentació.
    • Aquest portal pot contindre enllaços a pàgines externes, no sent CSIRT-CV responsable del contingut d’aquestes pàgines externes ni de qualsevol altre aspecte relacionat amb aquestes.
    • Els textos, imatges, logos i resta de continguts inclosos en aquest portal són propietat de CSIRT-CV. Queda prohibida la transmissió, distribució, reproducció o emmagatzematge, total o parcial, excepte si s’obté el previ consentiment de CSIRT-CV, i excepte quan s’indique el contrari.
    • Per a poder instal·lar o utilitzar qualsevol software que es trobe disponible per a la seua descàrrega des d’aquest portal, ha d’acceptar-se prèviament els termes del Contracte de Llicència, si n’hi haguera, que acompanye o s’incloga en el software.

CSIRT-CV no es fa responsable dels possibles danys que es pogueren produir pel fet d’utilitzar versions no actualitzades de navegadors, o de les conseqüències que es pogueren derivar del mal funcionament del navegador, ja siga per configuració inadequada, presència de virus informàtics o qualsevol altra causa aliena a CSIRT-CV.

Protecció de dades de caràcter personal

En compliment de la normativa vigent estatal i europea, en matèria de protecció de dades de caràcter personal, CSIRT-CV l’informa que les dades de caràcter identificatiu, adreces IP i cookies que ens proporcione en emplenar algun formulari d’inscripció o sol·licitud que aparega en la present Web, seran incorporats a la corresponent activitat de tractament el responsable del qual és la sotssecretaria de la Conselleria d’Hisenda i Model Econòmic (C/ de la Democràcia, 77. Ciutat Adva. 9 d’Octubre, 46018 València).

La recollida de les seues dades de caràcter personal es duu a terme amb la finalitat principal de poder oferir i prestar-li els serveis oferits en la present web. La legitimitat del tractament està fonamentada en l’article “6.1.e) Tractament necessari per al compliment d’una missió realitzada en interés públic o en l’exercici de poders públics conferits al responsable del tractament” del Reglament General de Protecció de Dades, sent necessari que ens proporcione les dades per a poder prestar-li els nostres serveis. Així mateix l’informem que les seues dades es mantindran en els nostres sistemes de manera indefinida mentre no ens sol·licite la seua supressió.

Per a exercir els seus drets d’accés, rectificació, cancel·lació, oposició, portabilitat i limitació al tractament de les seues dades personals, en els termes i condicions previstos en la pròpia normativa vigent tant estatal com europea en matèria de protecció de dades, pot comunicar-lo per escrit a l’adreça de la nostra seu: Contacte. A més, pot dirigir-se a l’Agència Espanyola de Protecció de Dades en cas que necessite més informació o realitzar una reclamació.

CSIRT-CV farà ús de les dades de caràcter personal facilitats per vosté exclusivament per a les finalitats indicades. No compartim la informació subministrada amb tercers excepte exigència legal o de procediments legals, i en cap cas, venem aquest tipus d’informació.

CSIRT-CV l’informa que té implantades les mesures de seguretat d’índole tècnica i organitzatives necessàries que garantisquen la seguretat de les seues dades de caràcter personal i eviten el seu robatori, modificació, pèrdua, tractament i/o accés no autoritzat.

Cookies

Utilitzem cookies per a facilitar l’ús de la nostra pàgina web. Les cookies són xicotets fitxers de text que el seu navegador emmagatzema en el disc dur del seu ordinador i que són necessàries per a utilitzar la nostra pàgina web. Les utilitzem per a entendre millor la manera en la qual s’usa la nostra pàgina web i d’aquesta manera poder millorar conseqüentment el procés de navegació.

Les cookies són el referent que ens indica, per exemple, si una pàgina de la nostra web ha sigut vista amb anterioritat, o si la seua visita és nova o recurrent.

En cas de no voler rebre cookies, per favor configure el seu navegador d’Internet perquè les esborre del disc dur del seu ordinador, les bloquege o li avise en cas d’instal·lació d’aquestes.

A més, utilitzem algunes cookies de tercers, com poden ser Matomo Analytics. Pot consultar més detalls sobre aquest tema en aquesta mateixa pàgina web.

Llei aplicable i jurisdicció

Aquest avís legal es regeix en tots i cadascun dels seus extrems per la llei espanyola, sent competents per a la resolució de qualsevol conflicte derivat o relacionat amb l’ús d’aquest portal els Jutjats i Tribunals de València.

Podeu optar per evitar que aquest lloc web agregui i analitzi les accions que feu aquí. Si ho feu protegireu la vostra privadesa, però també impedireu que el propietari aprengui de les vostres accions i creï una millor experiència per a vos i la resta d'usuaris.