CSIRT Mentoring
Starting or developing a CSIRT can sometimes seem a daunting step. Although there is a considerable amount of published material available, for example from the CERT Co-ordination Center's (CERT/CC) new teams support group in America and TERENA's CSIRT Task Force (TF-CSIRT) in Europe, new teams may also find it helpful to be able to talk to someone from an existing CSIRT for either information or reassurance. Many CSIRTs have offered an informal mentoring service for some time: this website aims to provide a single source of information about mentoring for new teams, particularly in Europe and neighbouring countries.
Mentor Teams
There are already a large number of national and international CSIRTs in Europe, covering education, government and commercial sectors. Although their first priority is to protect and inform their own constituencies, many of them are also prepared to volunteer some of their staff's time to help others who are trying to establish or develop their own teams. This help might cover, for example, informal advice when planning or establishing a team or help with the Trusted Introducer or FIRST membership processes. Depending on the mentor team, help might be provided by e-mail or telephone or by face-to-face meetings.
The Trans-European Research and Education Networking Association (TERENA) has agreed to act as a point of contact for offers of and requests for mentoring. Teams that are prepared to act as mentors are invited to contact TERENA (csirt-mentoring@terena.nl) giving details such as their areas of expertise, type(s) of teams they are able to help, any countries or languages with which they have a particular connection, and any other information that will help TERENA to identify requests for mentoring that may be appropriate for the team. A contact point (e-mail and phone, if possible) in the team should also be given: this will only be used by TERENA to inform the team of requests for mentoring. Teams volunteering for the list are not committing themselves to providing mentoring: they may, as they wish, accept or decline each individual request that may be forwarded to them.
Requests for Mentoring
Since the teams offering mentoring are mostly responsible for large, national constituencies, their assistance is most likely to be useful to teams with a similar scale. The activities of TF-CSIRT are focused on Europe and neighbouring countries, though requests from other regions may be considered. Those requesting mentoring must be committed to establishing or developing a CSIRT and have the support of the organisation that will host the team. Most mentor teams will be prepared to provide a certain amount of assistance by e-mail or telephone, so long as this can be fitted in to their existing commitments, but if face-to-face meetings are required then the requesting team will normally be expected to cover all travel and accommodation costs for their mentors. It is also expected that teams that benefit from mentoring will in turn contribute to the European CSIRT community, for example by submitting their details to the Trusted Introducer directory, by promoting CSIRTs in their country and sector and attending and contributing to TF-CSIRT meetings (which are in any case an excellent opportunity for discussions with other teams).
Teams seeking a mentor should send a request by e-mail to TERENA (csirt-mentoring@terena.nl) giving as much detail as possible about their team, in particular the stage of planning or implementation that has been reached, the type of host organisation and the constituency the CSIRT is intended to help, and the type of assistance sought.
Process
When TERENA receives a request for mentoring, it will confirm by e-mail that the request has been received. TERENA will then attempt to identify a team that is able to help with the request. If such a team is found, the request will be passed to the mentor team who will contact the requester direct to discuss details of the help that is required and can be given. Mentor teams are asked to provide feedback to TERENA to help them in allocating future requests. We would also welcome feedback from teams requesting mentoring so that we can improve the process and the help provided.
TERENA may, on occasion, be unable to find a suitable mentor either because there is no appropriate experience among the volunteer teams or because all suitable teams have insufficient spare effort at the time. In this case the requesting team will be informed of the problem and alternative sources of assistance may be suggested.
Disclaimer
The offer of mentoring is made on a strictly volunteer and best efforts basis, for the good of the CSIRT community. Neither TERENA, the mentor team, nor their organisations is expected to incur any binding commitment as a result of the mentoring process, though, of course, it is hoped that strong informal relations will be established. Information exchanged by the parties to mentoring should be considered confidential and not disclosed without the permission of the owner of the information.