Cybersecurity Culture in Computer Security Incident Response Teams: Investigating difficulties in communication and coordination

Abstract

This study aims to identify the factors related to developing a cybersecurity culture at an organizational context
and the difficulties faced in communicating and cooperating within a CSIRT. Specifically, our aim is to identify: 1) The issues
which may limit the communication and the coordination of incident management process inside a CSIRT, 2) the issues
which may limit the cooperation from top management to employees and reverse and 3) approaches towards addressing
the issues that limit the communication and the cooperation of a CSIRT. The research was conducted using an online survey and study participants were experts within the existing CSIRT community. In total, 25 participants responded to the
questionnaire, from 23 different countries in the world. The questions of the survey queried the personal knowledge and
experience of participants regarding CSIRTs. In our analysis, issues such as communication, cooperation, coordination, trust
and information sharing are discussed as crucial factors that affect the development of a cybersecurity culture. Several issues and weaknesses in terms of communication, coordination and cooperation within CSIRT are outlined and a set of
recommendations and key elements are defined.