Cybersecurity Culture in Computer Security Incident Response Teams: Investigating difficulties in communication and coordination

This study aims to identify the factors related to developing a cybersecurity culture at an organizational context and the difficulties faced in communicating and cooperating within a CSIRT. Specifically, our aim is to identify: 1) The issues which may limit the communication and the coordination of incident management process inside a CSIRT, 2) the issues which may limit the cooperation from top management to employees and reverse and 3) approaches towards addressing the issues that limit the communication and the cooperation of a CSIRT. The research was conducted using an online survey and study participants were experts within the existing CSIRT community. In total, 25 participants responded to the questionnaire, from 23 different countries in the world. The questions of the survey queried the personal knowledge and experience of participants regarding CSIRTs. In our analysis, issues such as communication, cooperation, coordination, trust and information sharing are discussed as crucial factors that affect the development of a cybersecurity culture. Several issues and weaknesses in terms of communication, coordination and cooperation within CSIRT are outlined and a set of recommendations and key elements are defined.