Information Sharing between the Computer Security Incident Response Team and its Members: An Empirical Study

Abstract

The number of cyber incidents is steadily increasing in all sectors. Not all sectors have access to cybersecurity personnel with domain-specific knowledge, which further motivates the need for a Computer Security Incident Response Team (CSIRT). However, for a CSIRT to function as intended, effective digital communication should be at the forefront. This paper explores the communication practices between the CSIRT and its members by using a case from the Norwegian municipality sector. Ten semi-structured interviews with eleven participants representing the CSIRT and the municipalities were conducted. The findings include the most used communication channels and the members' perceptions of information sharing. Key factors limiting information sharing are the size of the municipality and access to critical resources, geographical location, and the lack of personal networks. Future work should investigate the generalizability of the findings in other sectors and countries.