CSIRT RFC 2350
1. About this document Post CSIRT profile established according to RFC 2350 Version: 1 Date: Tue, 23 Feb 2021 16:00:00 +0100 Author: csirt@post.at 1.1 Date of Last Update Date: Mon, 22 Mar 2021 11:00:00 +0100 1.2 Distribution List for Notifications There are no distribution/mailing lists defined for the notification about updates to this document. 1.3 Locations where this document may be found The current version of this Post CSIRT description document is available at: https://post.at/rfc2350 2. Contact Information 2.1 Name of the Team Post CSIRT: Computer Security Incident Response Team of Österreichische Post AG 2.2 Address Österreichische Post AG Rochusplatz 1 1030 Vienna AUSTRIA 2.3 Time Zone Central Europe Time (UTC+0100, UTC+0200 from last Sunday in March to last Sunday in October) 2.4 Telephone Number +43 664 6247117
2.5 Facsimile Number None. 2.6 Other Telecommunication None. 2.7 Electronic Mail Address csirt(at)post.at 2.8 Public Keys and Encryption Information Post CSIRT uses a master signing key to sign all keys used for operational purposes. Do NOT use it for communication with Post CSIRT. The master signing key is:
pub rsa4096/F110B051 2021-03-04 [SC] [expires: 2043-03-06] F159 0843 4C29 3290 52BB B806 89A1 982B F110 B051 uid Master Signing Key <signing-only-key-no-mail@post.at> sub rsa4096 2021-03-04 [E] [expires: 2043-03-06]
Encrypted communication to Post CSIRT is possible with the following team key:
pub rsa4096/1C1D2AC3 2021-03-04 [SC] [expires: 2033-03-04] 4576 747B 6918 5E46 3B53 7535 8518 4032 1C1D 2AC3 uid Post CSIRT <csirt@post.at> sub rsa4096 2019-02-25 [E] [expires: 2033-03-04]
Encrypted communications with Post CSIRT should use this – and only this-operational key.
2.9 Team Members No information is provided in public. 2.10 Other Information Post CSIRTs e-mail address is csirt(at)post.at. This is the preferred channel for reporting incidents and communication with Post CSIRT If it is not possible or appropriate, you can reach Post CSIRT via telephone (see Ch. 2.4) Post CSIRT's hours of operation are our regular business hours (09:00-16:00 Monday to Friday except public holidays). 3. Charter 3.1 Mission Statement The Post CSIRT is the contact for technical issues in information security of Österreichische Post AG. The goal of the Post CSIRT is the mitigation of security issues affecting the Österreichische Post AG. 3.2 Constituency Post CSIRT’s services are available to Österreichische Post AG and their network/datacenter affiliated companies or subsidiaries. Austrian Post CSIRT has authority over ASN AS206322. 3.3 Sponsorship and/or Affiliation Post CSIRT is located at IT department of Österreichische Post AG Headquarter. Post CSIRT is part of and funded by Österreichische Post AG 3.4 Authority In case of security incidents (see Ch. 4.1), Post CSIRT cooperates with representatives of its constituency (see Ch. 3.2). Post CSIRT is in charge of proactive and reactive IT security measures within Österreichische Post AG. 4. Policies 4.1 Types of Incidents and Level of Support Post CSIRT is authorized to address computer security incidents which occur in its constituency (cf. 3.2) 4.2 Co-operation, Interaction and Disclosure of Information Post CSIRT cooperates with the relevant public authorities and regulatory bodies. The Post CSIRT cooperates at national level with other CERTs(CERT.at). Post CSIRT does not disclose any internal information related to its constituency. 4.3 Communication and Authentication For normal communication not containing sensitive information Post CSIRT will use conventional methods like unencrypted e-mail or fax. For secure communication PGP-Encrypted e-mail will be used. If it is necessary to authenticate a person before communicating, this can be done either through existing webs of trust or by other methods like call-back, mail-back or even face-to-face meeting if necessary.
5. Services 5.1 Incident Response Post CSIRT coordinates incident prevention, handling and response within its constituency. 5.1.1 Incident Triage - Determine wether an incident is authentic - Assessing and prioritizing the incident - Determine the involved applications and departments 5.1.2 Incident Coordination - Contact involved departments and ask them to investigate and take appropriate mitigation steps - Notify other departments if appropriate - Facilitating contact to other parties which can help resolve the incident - Send reports to other CERTs if appropriate 5.1.3 Incident Resolution Advise local security teams on appropriate actions - Follow up on the progress of the concerned local security teams - Ask for reports - Report back Post CSIRT collects statistics about incidents within its constituency.
5.2 Proactive Activities Post CSIRT provides the following proactive services: - Maintain contact information of local security teams - Raise security awareness in its constituency - Publish announcements concerning serious security threats to its constituency - Observe current trends in technology - Distribute relevant knowledge to the constituency - Vulnerability management within its constituency 6. Incident Reporting Forms No specific requirements.
7. Disclaimers While every precaution will be taken in the preparation of information, notifications and alerts, Post CSIRT assumes no responsibility for errors or omissions, or for damages resulting from the use of the information contained therein.
