Commonwealth National Computer Security Incident Response Team (CSIRT) Community: Strengthening Capabilities, Promoting International Cyber Security Standards and Skills and Facilitating Collaboration

Summary

This project continued the work of the ‘Commonwealth CSIRT community – Extension’ into 2022 by maintaining the CSIRT community network and diving deeper into the topics of threat and resilience; technology and ecosystem; global leadership and influence; and human rights.

Details

Aim

The project aims to improve information sharing and incident response strategies, through training, mentoring and peer-to-peer learning across the Commonwealth. The project assists Commonwealth countries eligible for Official Development Assistance (ODA) in implementing the Commonwealth Cyber Declaration, signed at the Commonwealth Heads of Government Meeting in April 2018.

Context

At the Commonwealth Heads of Government Meeting in 2018, the UK and Singapore signed a Memorandum of Cooperation on Cyber Security Capacity Building in support of the UK’s Commonwealth Cyber Programme and Singapore’s Cyber Capacity Programme.  Following this Singapore co-funded with a project with the UK to build a community of Commonwealth cyber security incident response teams to provide training and mentoring, and promote the sharing of knowledge and skills.

In Phase 1 (April 2018 to March 2020), through the ‘Commonwealth Cyber Security Incident Response Team Workshops with UK and Singapore’ project, Torchlight ran four workshops with representation from 40 Commonwealth countries.  Details of what was covered in the workshops and the impact are captured in the best practice guide available on GOV.UK, together with the promotion video and case studies.

In Phase 2 (August 2020 to March 2021), through the ‘Commonwealth CSIRT community – Extension’ project, Torchlight created a virtual platform to maintain training support, give access to online resources and facilitate collaboration within the Commonwealth CSIRT community during the COVID pandemic.  Thirty countries signed up to the platform.  Ten webinars were held and recorded on a range of technical themes, including CSIRT frameworks and implementation plans, standards, incident response procedures, and skills and resources.  Ten countries were also selected for mentoring support to help development national CSIRT plans and roadmaps for implementation.

Phase 3 was  covered a four-month period between May and August 2021 (April and September as planning and project close) and delivered a series of webinars on key cyber security themes, conducted a programme of mentoring activities with four selected nations and delivered a number of enhancements to the CSIRT platform.

This project page covers Phase 4 (November 2021 to 30 April 2022), in which Torchlight delivered a programme of cyber capacity building activities aimed at creating a network of international partners with the capacity to resolve to detect, respond to and deter malicious cyber threats. Activities included a workstream focused on global leadership, influence & sustainability, specific media on cyber threat intelligence, community cohesion activities, promoting FIRST (Forum of Incident Response and Security Teams), bringing forward the equality, diversity & inclusion agenda, facilitating & co-delivering a multi-nCSIRT cyber exercise and supporting online awareness campaigns, skills & education.

Outcomes (Phase 4)

A Commonwealth CSIRT Community that reports having:

• new and beneficial knowledge as a result of the project,
• an increased ability to develop nCSIRT capabilities, and
• an improved sense of community and cohesion.

Outputs

• A broad programme of nCSIRT capacity development activities delivered across the Commonwealth nCSIRT community.
• A specific mentoring programme on capacity development in the planning, creation and operation of a national CSIRT capability for four Commonwealth nations.
• Integration and collaboration with regional and international organisations in nCSIRT capacity building.
• Improved awareness of the Equality, Diversity and Inclusion agenda.
• The inclusion of community cohesion activities across the project.

Activities

The activities of the project included:

• A webinar series informed by international best practice and feedback from the Commonwealth nCSIRT community.
• Specialist mentoring in nCSIRT capacity building for four nations, building on the success from previous phases.
• Indexing and curation of the online platform content and resource bank, including project-created media alongside selected materials from UK, national, regional and international partners.
• A bespoke nCSIRT cyber exercise, co-created and delivered with BAE Systems.
• An international nCSIRT development seminar with inputs from the Commonwealth Secretariat, FIRST, the Organization of American States, CERT-NZ, CERT-GH, Seychelles, St Lucia, UK NCSC and Home Office.
• Liaison with regional and international cyber capacity building organisations.