Uma Proposta de Framework para Gestão, Resposta e Tratamento de Ciberincidentes para o Ensino Superior: O caso do CSIRT.UTAD
Data
2022-05-24
Autores
Título da revista
ISSN da revista
Título do Volume
Editora
Resumo
Na conjuntura atual, observa-se que a informação constitui um recurso fundamental no crescimento e na competitividade das organizações, onde as tecnologias de informação (TI) atuam como um coadjuvante de especial relevo no seu processamento, transmissão e armazenamento, que ao catalisar as suas atividades, garante assim a sua sobrevivência num mercado cada vez mais dinâmico. Também nas Instituições do Ensino Superior (IES) a informação representa um ativo crucial, pois além de albergar um conjunto considerável de dados acerca do seu público – estudantes, colaboradores (docentes e não docentes), empresas associadas, entre outros, beneficia também a condução da sua atividade. Por se tratar de um serviço que tem essencialmente como propósito a transferência de conhecimento para a sociedade, assenta sob os princípios de abertura do seu ambiente para o meio académico, característica patente na infraestrutura de TI, e ainda na partilha de informação e conhecimento entre esta comunidade, que visa, por conseguinte, a evolução e a melhoria da qualidade de vida da sociedade. Como consequência, estas constituem-se um alvo aliciante a ciberatacantes, quer pela natureza dos princípios do Ensino Superior, quer pela informação que retêm, informação essa percecionada com potencial valor económico, e, portanto, um chamariz para a ocorrência de incidentes. No entanto, estas instituições padecem de diferentes dificuldades que inviabilizam ou retardam a integração e a atividade de equipas de resposta a incidentes – as Computer Security Incident Response Team (CSIRT) – cujo estabelecimento as protegeria da exposição operacional, reputacional e financeira, preservando a sua confiabilidade junto do seu públicoalvo. Como entidade de estudo da problemática que assola os CSIRTs académicas, procedeuse à análise do CSIRT da Universidade de Trás-os-Montes e Alto Douro – CSIRT.UTAD, utilizando como referência o Security Incident Management Maturity Model (SIM3), que culminou nas seguintes considerações: 1) existência do documento RFC2350 que formalizava as atividades da equipa; 2) integração em grupos de cooperação, que potenciavam a s operações da equipa; 3) aplicação de políticas/código de conduta externos na equipa; 4) necessidade de integrar mais colaboradores na equipa, considerando a extensão da constituency; 5) abordagem a incidentes melhorada após a instituição do CSIRT; 6) colaboradores recetíveis à sensibilização; 7) utilização de projetos de alunos na equipa; 8) utilização de feeds de informação gratuitos, que permitia ter visibilidade das vulnerabilidades da organização, sem custos monetários para a mesma; 9) emissão de recomendações técnicas para os departamentos da IES. Denotadas as características anteriores, foram apontada possíveis soluções para que os CSIRT prosperem no Ensino Superior, nomeadamente a reformulação da estrutura organizacional atual, considerando ainda a integração de um CISO (Chief Information Security Officer), a aposta nos alunos para robustecer a equipa, a mudança de perspetiva necessária para que as políticas de segurança sejam cumpridas pelos colaboradores, e a aproximação da comunidade à equipa, através da constituição de um Comité de Cibersegurança, a aposta na sensibilização dos alunos e a reforma nos métodos de comunicação aplicados.
In the presente conjuncture, it is perceived that information compose an essential resource to the growth and competitiveness of organizations, where information technologies (IT) act like as a particular importante adjunct in its processing, transmission and storage, that by catalyzing its activities, thus assures its survival in a dynamic increased market. Also in the Higher Education Institutions (HEI) information portray a crucial asset, since it retains a substantial set of informations about its public – students, staff (teachers and non teachers), associated companies, and others, also benefits the conduction of its activity. Because it is a service that has essentially the purpose of transfer knowledge to society, it settles upon principles of open environment to the academia, a feature patent in the IT infrastructure, ando also in information and knowledge sharing between this community, that aims the evolution and improvement in life quality of society. In the virtual environment, it can also feels these principles, through uncomplexed accessibility from a dedicated network infrastrucutre, exclusively for the ends of the academia. As a consequence, these represents an enticing target for cyberattackers, that by the nature of Higher Education and for the retained information, these last one it is perceived with a potencial economic value, and therefore, a lure for the occurrence of incidents. However, these instituitions suffer from different obstacles that derail the integration and the activity of incident response teams – the Computer Security Incident Response Team (CSIRT) – whose establishment it would protect it from operational, reputational and financial exposure, preserving the trustability of its public. As an entity for the problem in research that desolates the academic CSIRTs, it was executed an analysis to the CSIRT of Universidade of Trás-os-Montes and Alto Douro – CSIRT.UTAD – using as a reference the Security Incident Management Maturity Model (SIM3), culminated in the following considerations: 1) existence of the RFC2350 document that formalized the team's activities; 2) integration into cooperation groups, which enhanced the team's operations; 3) application of external policies/code of conduct in the team; 4) need to integrate more collaborators in the team, considering the extent of the constituency; 5) improved incident handling after the establishment of the CSIRT; 6) employees receptive to raising awareness; 7) use of student projects in the team; 8) use of free information feeds, which allowed visibility of the organization's vulnerabilities, without monetary costs for it; 9) issuance of technical recommendations for HEI departments. Denoted the previous features, it was ascertained possible solutions so that CSIRT prosper in the Higher Education, namely the organizational structure reformulation, considering in it the integration of a CISO (Chief Information Security Officer), the investment in students to strengthen the team, the change of perspective necessary for the security policies to be complied by employees, and the approach of the team to the community, through the constitution of a Cybersecurity Committee, and by reinforcing the awareness of students and the reform in the communication methods applied.
In the presente conjuncture, it is perceived that information compose an essential resource to the growth and competitiveness of organizations, where information technologies (IT) act like as a particular importante adjunct in its processing, transmission and storage, that by catalyzing its activities, thus assures its survival in a dynamic increased market. Also in the Higher Education Institutions (HEI) information portray a crucial asset, since it retains a substantial set of informations about its public – students, staff (teachers and non teachers), associated companies, and others, also benefits the conduction of its activity. Because it is a service that has essentially the purpose of transfer knowledge to society, it settles upon principles of open environment to the academia, a feature patent in the IT infrastructure, ando also in information and knowledge sharing between this community, that aims the evolution and improvement in life quality of society. In the virtual environment, it can also feels these principles, through uncomplexed accessibility from a dedicated network infrastrucutre, exclusively for the ends of the academia. As a consequence, these represents an enticing target for cyberattackers, that by the nature of Higher Education and for the retained information, these last one it is perceived with a potencial economic value, and therefore, a lure for the occurrence of incidents. However, these instituitions suffer from different obstacles that derail the integration and the activity of incident response teams – the Computer Security Incident Response Team (CSIRT) – whose establishment it would protect it from operational, reputational and financial exposure, preserving the trustability of its public. As an entity for the problem in research that desolates the academic CSIRTs, it was executed an analysis to the CSIRT of Universidade of Trás-os-Montes and Alto Douro – CSIRT.UTAD – using as a reference the Security Incident Management Maturity Model (SIM3), culminated in the following considerations: 1) existence of the RFC2350 document that formalized the team's activities; 2) integration into cooperation groups, which enhanced the team's operations; 3) application of external policies/code of conduct in the team; 4) need to integrate more collaborators in the team, considering the extent of the constituency; 5) improved incident handling after the establishment of the CSIRT; 6) employees receptive to raising awareness; 7) use of student projects in the team; 8) use of free information feeds, which allowed visibility of the organization's vulnerabilities, without monetary costs for it; 9) issuance of technical recommendations for HEI departments. Denoted the previous features, it was ascertained possible solutions so that CSIRT prosper in the Higher Education, namely the organizational structure reformulation, considering in it the integration of a CISO (Chief Information Security Officer), the investment in students to strengthen the team, the change of perspective necessary for the security policies to be complied by employees, and the approach of the team to the community, through the constitution of a Cybersecurity Committee, and by reinforcing the awareness of students and the reform in the communication methods applied.
Descrição
Dissertação de Mestrado em Engenharia Informática
Palavras-chave
Cibersegurança , CSIRT