What is it about?
National Computer Security Incident Response Teams (CSIRTs) have been established in many countries to coordinate responses to cyber security incidents at the national level. A previous study conducted by us (https://doi.org/10.1145/3609230) reported a proposed set of candidate criteria for evaluating software tools and data sources for the purposes of incident response in National CSIRTs. The candidate criteria were proposed based on insights learned from a number of focus group discussions participated by staff working for national CSIRTs. This study validated such candidate criteria empirically via semi-structured online interviews participated by nine members of staff from national CSIRTs in nine national CSIRTs in Asia-Pacific, Africa and Europe. The candidate criteria were also evaluated by one of us (the first co-author), an experienced member of staff at Malaysia’s national CSIRT, by applying the criteria to two software tools and one data source and by converting each criterion into one or more relevant metrics. Our results showed that all participants perceived the candidate criteria as practically useful for staff of national CSIRTs, and that they can be applied relatively easily in practice.
Featured Image
Why is it important?
This work addresses a key practical issue in the national CSIRTs’ operation: staff do not have a standard and practically applicable set of criteria for evaluating and selecting suitable software tools and data sources for daily incident response work. By empirically validating the candidate criteria proposed in another prior study, this study provides a useful baseline for national CSIRTs (and other types of CSIRTs) in their operational practices on selecting software tools and data sources, especially those freely and publicly available ones that are often less evaluated than commercial tools and data sources. Despite the relatively small number of interviewees, they represent nine different national CSIRTs in different continents and of different sizes/maturity levels, therefore, the overwhelming positive feedback confirmed the deployment readiness of the candidate criteria and the importance of our work. Our own validation of the candidate criteria using two software tools and a public data source further proved that such criteria can be practically used in national CSIRTs’ operational practices. In addition, the criteria could help software designers and developers in producing tools and data sources that are more aligned with end users’ needs.
Perspectives
The work was motivated by the first co-author’s personal observation of national CSIRTs’ operation while working at Malaysia Computer Emergency Response Team (MyCERT) of CyberSecurity Malaysia, Malaysia. Staff members of national CSIRTs often use a lot of free (especially open source) software tools and public data sources to support their day-to-day work. However, a set of criteria that could guide staff to evaluate and select candidate software tools and data sources is lacking. In our previous study, we developed a set of criteria based on insights learned from a number of focus group discussions with staff members of national CSIRTs. This study is a follow-up validation of the proposed criteria using semi-structured interviews, again with staff members of national CSIRTs. Using actual end users at national CSIRTs to derive and validate the criteria means the results we obtained are likely practical and useful for the target end users. Additionally, the first author’s test validations of two software tools and one data source also gave further confidence in the deployment readiness of the criteria. We hope that more future research will be conducted to help understand and improve national CSIRTs’ operational practices, thereby making all nations and sectors more resilient to cyberattacks.
Sharifah Roziah Binti Mohd Kassim
CyberSecurity Malaysia
Read the Original
This page is a summary of: Validating a Set of Candidate Criteria for Evaluating Software Tools and Data Sources for National CSIRTs’ Cyber Incident Responses, Digital Threats Research and Practice, December 2025, ACM (Association for Computing Machinery),
DOI: 10.1145/3748267.
You can read the full text:
Contributors
The following have contributed to this page
