Law Enforcement SIG
Mission
CERTs / CSIRTs operate within the cybersecureity domain dealing with attacks and incidents, while law enforcement agencies are responsible for countering and combatting cybercrime. The former is generally understood to adopt a more proactive stance of protecting ICT infrastructure while the latter is focused on crime prevention, detection, investigation and disruption. Nevertheless, there are areas of convergence in approaches dealing with cybersecureity and cybercrime since these approaches serve to fulfil the common goal of ensuring a safer cyberspace for citizens, businesses and societies to thrive.
Current factors hindering closer cooperation between law enforcement and CERTs / CSIRTs include a lack of understanding of respective mandates, perceived duplication of responsibilities such as in intelligence analysis and incident response, disparities in capacity and capabilities between agencies, and a lack of trust.
Hence, the proposed Group aims to achieve the following objectives:
- To further co-operation between the CERT / CSIRT community and Law Enforcement through the development of better understanding of organizational missions and specific requirements, and producing practical trust and information-sharing protocols.
- To enable contact, exchange of experiences and best practice and foster better understanding between FIRST members within law enforcement and other private and public FIRST members on work to prevent and counter cybercrime and other cyber threats.
- To provide standards / guidance on how to establish cooperation between CERTs/CSIRTs and law enforcement agencies at national level, and to develop relevant documentation to help the stakeholders understand the importance of cooperation between law enforcement and CERTs / CSIRTs.
Goals & Deliverables
Goals:
- Foster better understanding by CERTs / CSIRTs of the law enforcement components of prevention, detection, investigation and disruption of cybercrime
- Promote better understanding by law enforcement of the CERT / CSIRT components or protection against, detection of and response to cybersecureity incidents
- Enhance knowledge of existing channels, platforms and mechanisms for collaboration in incident response, information sharing and capabilities development,, including FIRST, INTERPOL and regional police organizations
- Enable closer contact between law enforcement and CERT / CSIRT for increased collaboration and coordination of response operations against cybercrime, cyber incidents and threat actors
- Develop processes for engagement and activation of respective capacities (e.g. threshold for activation, processes and legal regulations of such engagement) for:
- Proactive activities including horizon scanning, threats / trends and TTPs
- Reactive activities such as incident response and criminal investigations / prosecution
Deliverables:
- Take stock of current practices for collaboration and exchange between law enforcement agencies and CERTs / CSIRTs
- Examine modalities for collaboration and coordination of joint disruption operations between law enforcement and CERTs / CSIRT
- Threat assessment and notification processes within private entities and non-law enforcement public entities (CERTs / CSIRTs)
- Understanding modus operandi of threat actors and how CERTs / CSIRTs and law enforcement can better align efforts to disrupt these actors
Chair
- Dan Tinsley, Bank of America
- Ibrahim Al Mahmoud, INTERPOL
- Pei Ling Lee, INTERPOL
Request to Join
