A Model for Afghanistan’s Cyber Security Incident Response Team

Abstract

Persistent cyber threats require effective and efficient mitigation techniques. The cyber security incident response team (CSIRT) is expected to respond to external and internal cyber threats or incidents. Various organizational, national, and international level CSIRTs have been developed for defending and protecting such kinds of threats. Developing countries like Afghanistan have also formed a Computer Emergency Response Team for handling national cyber incidents although it provides limited services to only a few constituencies and depends on funding from foreign donors. Therefore, a new organizational model was proposed to provide guidelines for a specific country, instead of a provision from a constitutional context. Five national CSIRTs were compared to identify their features and characteristics to provide basis for the proposed framework. The study presented the proposed model based on two CSIRT organizational models that incorporated a new funding strategy to achieve a Sustainable National CSIRT for developing countries. Our model combined coordinate and security teams; if consists of constituency's mission, services, resources, organizational framework, and funding strategy. This study employed qualitative method by using document analysis and interview techniques. CSIRT for Afghanistan known as AFCERT was evaluated in terms of structure, services, resources, and funding. AFCERT services level were below the standard of a national CSIRT. Therefore, a more sustainable service need to be provided based on the proposed model components. Findings showed the suitability and potential of the model in controlling and mitigating cyber-attacks, more specifically in the context of Afghanistan.

Ecommerce Fraud Incident Response: A Grounded Theory Study

“…The phases are preparation, discovery, containment, investigation, remediation, prevention, and lessons learned (Adamov & Carlsson, 2016). The incident lifecycle presented identification and declaration, analysis, response, and lessons learned phases (Jalal et al, 2018). Al-Dhaqm et al (2020) suggested the incident phases include pre-incident response, incident response, and post-incident response.…”

“…There were several similarities and differences between the academic literature and the perspectives of ecommerce industry fraud experts. The literature review identified an incident response model that included preparation, discovery, containment, analysis, response, and improvement phases (Adamov & Carlsson, 2016;Al-Dhaqm et al, 2020;Jalal et al, 2018;Lamis, 2010;Pilitsky et al, 2021;Pinto & Talley, 2006;Rollason-Reese, 2003;Ruefle et al, 2014;Sadik et al, 2020,). The five cyber incident phases of the empirical model were similar the literature model's preparation, discovery, analysis, response, and improvement phases.…”

Mitigating Global Cyber Risk Through Bridging the National Incident Response Capacity Gap

“…However, less-developed countries have fewer funding alternatives when compared to developed ones (Skierka and Hohmann, 2015). For these countries, some alternative options include government sponsorship, fee-based services, in-kind supports, or a combination of these could be funding alternatives for national CSIRTs (Jalal et al, 2018). Likewise, in lowincome countries, the availability of qualified staff or solid technology pipeline, training options, external support, and cultural differences create greater challenges due to limited critical infrastructure, lower living standards, underdeveloped industrial base, and low HDI.…”