What is a Cyber Incident Response Team (CIRT)?

Today, cyber threats have become an increasing concern for organisations and individuals. In this context, the question ‘What is CIRT?’ gains importance. Cyber Incident Response Teams (CIRTs) are special units created to protect the digital assets of organisations and respond quickly to cyber incidents. These teams play a critical role in cyber security, helping to keep organisations’ digital infrastructures secure.

CIRT service offers organisations the opportunity to adopt a proactive approach against cyber threats. In this article, the definition and purpose of CIRT, its organisational structure and basic functions will be discussed. In addition, detailed information about the importance of Corporate CIRT and cyber incident response processes will be presented. This information will help organisations to develop their cyber security strategies and be prepared for possible threats.

You can review our detailed cyber security training programmes prepared for those who want to learn the basics of cyber security.

Definition and Purpose of CIRT

What is CIRT?

Cyber Incident Response Teams (CIRTs) are special units created to protect the digital assets of organisations and respond quickly to cyber incidents. These teams were established within the scope of the National Cyber Security Strategy and 2013-2014 Action Plan. CIRTs are expected to be established in public institutions and organisations and private sector organisations operating critical infrastructure.

CIRT are divided into three main categories:

1. National Cyber Incident Response Centre (TR-CERT)
2. Sectoral CIRT
3. Corporate CIRT
   

TR-CERT was established on 27 May 2013 and its main duty is coordination and cooperation. Sectoral CIRTs regulate the communication activities of the Corporate CIRTs affiliated to them with TR-CERT and determine the communication methods to be used within the sector. Corporate CIRTs are the teams recommended to be established as a separate unit within the organisation.

Main tasks of CIRT

The main tasks of CIRT are:

1. Intervening in cyber incidents
2. To ensure coordination within the institution
3. Performing or having cyber security tests
4. To take necessary precautions before, during and after the cyber incident

Corporate CIRTs perform or have routine security tests performed on IT assets prior to a cyber incident. During the cyber incident, it manages the response of the IT unit and coordinates the relevant personnel. After the incident, it identifies the vulnerabilities that caused the incident and records the lessons learned.

Importance in terms of cyber security

CIRTs play a critical role in ensuring national cyber security. It is essential that public institutions and organisations comply with the plans, programmes, procedures, principles and standards published by the Ministry of Transport, Maritime Affairs and Communications. In this context, CIRTs help organisations develop their cyber security strategies and be prepared for potential threats.

CIRT employees must be available 24/7. This constant readiness ensures a fast and effective response to cyber threats. In addition, it is recommended to contact TR-CERT for cyber incidents with foreign connections and to resolve cyber incidents through TR-CERT.

Organisational Structure of CIRT

National CIRT (TR-CERT)

The National Cyber Incident Response Centre (TR-CERT) is the highest level unit of the cyber security structure. TR-CERT coordinates the management of cyber incidents at national level and ensures cooperation. This centre conducts malware analyses and shares its findings with CIRTs and other relevant stakeholders. In addition, TR-CERT works with public institutions, internet service providers and private sector organisations in our country.

Sectoral CIRT

Sectoral CIRTs are units that coordinate cyber security activities in a specific sector. These units form a sectoral working group with the participation of companies in the sector, public institutions and TR-CERT. The main tasks of Sectoral CIRTs are as follows:

1. Preparing and reviewing cyber security legislation within the sector
2. Determining minimum cyber security criteria for the sector
3. Determining the method and scope of risk analyses requested from Corporate CIRTs
4. Establishing and testing sectoral cyber incident response procedures
5. Organising sector-specific cyber security drills together with TR-CERT

Sectoral CIRTs also communicate the sector-specific cyber security measures they receive from TR-CERT to Corporate CIRTs and manage communication with the media when necessary.

Corporate CIRT

Corporate CIRTs are units created to respond to cyber incidents within the organisation. These units work in constant communication with TR-CERT and the Sectoral CIRT to which they are affiliated. The main responsibilities of Corporate CIRTs are as follows:

1. Having personnel available 24/7 and forwarding contact information to TR-CERT and Sectoral CIRT
2. To determine the duties and responsibilities before, during and after the cyber incident
3. To prepare cyber incident management instructions
4. Taking measures to prevent unauthorised access to information systems during incident response
5. Reporting information on cyber incidents to TR-CERT and Sectoral CIRT

This three-level structure contributes to national cyber security by ensuring the coordinated operation of TR-CERT, Sectoral CIRTs and Corporate CIRTs.

Basic Functions of CIRT

The core functions of CIRT are designed to respond quickly and effectively to cyber security incidents. These teams play a critical role in the detection, analysis and elimination of cyber attacks. The main tasks of the CIRT include incident detection and analysis, incident response, threat intelligence and security assessments.

Incident detection and analysis

CIRT Teams use various tools and methods to detect and analyse cyber attacks. This process includes monitoring network events, security events and endpoint events through software running on the security stack. CIRT members identify events and their scope by examining log files, monitoring tools, error messages, intrusion detection systems (IDS, IPS, etc.) and firewall logs.

Incident response

Incident response refers to the process by which an organisation manages the consequences of an attack or breach.CIRT teams manage the response of the IT unit during the incident and coordinate the relevant personnel. The response process includes limiting the damage, cleaning the systems and returning to normal operations. CIRT teams re-secure the systems after the incident and take necessary measures to prevent the recurrence of similar incidents.

To learn more technical details of incident response, you can review our article ‘What is Incident Response?

Threat intelligence

CIRT teams detect both known and unknown threats using threat intelligence. According to surveys, 22% of CIRT teams consider cyber threat intelligence as an important factor. This intelligence helps to take a proactive approach to attacks and identify potential threats in advance.

Learn more about our professional Cyber Threat Intelligence Training offered to specialise as CIRT members.

Safety assessments

CIRT Teams continuously assess the cyber security status of organisations. In this context

1. Makes risk analysis and assessment
2. Performs vulnerability assessment (Vulnerability Assessment)
3. Applies Penetration Testing
4. Monitors security metrics and indicators
5. Evaluates security policies

These assessments contribute to the development and improvement of the organisation’s cyber security strategy.

Another important task of CIRT teams is to increase cyber security awareness within the organisation. In this way, employees become more prepared for potential threats and the overall cyber security posture of the organisation is strengthened.

Conclusion

Cyber Incident Response Teams (CIRTs) play a crucial role in ensuring the digital security of organisations. These teams are units specialised in detecting, analysing and countering cyber threats, and are constantly on the alert to protect organisations’ digital assets. The three-tier structure of CIRTs – National, Sectoral and Corporate – ensures that cyber security is addressed at all levels, creating a strong line of defence across the country.

The success of CIRTs depends on continuous training and development. As cyber threats are constantly changing, it is very important for CIRT members to keep their knowledge up to date and learn new technologies. Attending cyber security trainings is a great way to improve yourself in this field. In conclusion, CIRTs play a vital role in securing our digital world and will continue to be our most important line of defence against cyber threats in the future.

Frequently Asked Questions About CIRT

References

[1] – https://www.btk.gov.tr/usom-ve-kurumsal-siber-olaylara-mudahale-ekibi
[2] – https://www.usom.gov.tr/
[3] – https://bilgem.tubitak.gov.tr/sge/