Panel: Tips and Tricks to Run a CSIRT in Low-income and Fragile Contexts

Panel: Tips and Tricks to Run a CSIRT in Low-income and Fragile Contexts

Speakers: Ghislain de Salins (World Bank); Palakiyem Assih (CERT.tg); Sergio Guivala (National Institute of Information and communication Technology (INTIC)); Thank-You Hauwanga (Namibian CSIRT); Lawrence Muchilwa (Forum of Incident Response and Security Teams); Anat Lewin (Cybersecurity professional, World Bank)

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=ggQeVupA9xw

Overview

This compelling panel discussion at FIRSTCON, expertly moderated by Ghislain de Salins of the World Bank, delved into the formidable challenges and inspiring success stories of establishing and operating Computer Security Incident Response Teams (CSIRTs) in low-income and fragile contexts. The session brought together a diverse group of practitioners and experts from national CSIRTs in Mozambique, Namibia, and Togo, alongside representatives from FIRST and the World Bank. The central theme explored how nations grappling with civil unrest, extreme poverty, limited resources, and critical talent shortages can still build robust incident response capabilities essential for their digital transformation journeys.

The talk underscored that while setting up and running a CSIRT is inherently difficult, these challenges are magnified in environments where foundational infrastructure, stable governance, and economic resources are scarce. However, the panelists presented a powerful counter-narrative, highlighting that with strategic collaboration, innovative financing models, and a pragmatic approach, significant progress is not only possible but actively being achieved. The discussion aimed to distill practical advice and actionable strategies for nascent CSIRTs in these challenging environments, demonstrating that "perfection fights against progress" and that starting with limited resources is often the most effective path forward. The insights shared are particularly vital as these regions increasingly embrace digital services, making effective cybersecurity a non-negotiable component of national resilience and economic stability.

Background

▶ Watch: Introduction: Challenges for CSIRTs in fragile contexts (0:00)

The necessity for national CSIRTs has grown exponentially with the global expansion of digital infrastructure and services. However, the path to establishing and sustaining these critical entities is fraught with obstacles, particularly in what the World Bank terms "situations of fragility" or "low income." These contexts present a unique confluence of socio-economic, political, and technical impediments that can severely hamper cybersecurity initiatives.

Panelists consistently articulated several core challenges:

• Political and Governance Hurdles: Sergio Guivala from Mozambique highlighted the pervasive issue of lack of political support and fragmented mandates within governments, leading to disputes between organizations and hindering coordinated cybersecurity efforts. Anat Lewin of the World Bank echoed this, noting an "empowerment capacity dichotomy" where skilled individuals may lack authority, and vice versa. She also pointed out that when national CSIRTs are perceived as extensions of military or internal security apparatuses, they often face a lack of trust from civilian entities, particularly critical infrastructure operators like financial institutions, leading to underreporting of incidents.
• Financial Constraints: Limited funding is a recurring theme. Ghislain de Salins set the stage by describing scenarios where public debt is so high that governments cannot afford basic software licenses. Thank-You Hauwanga of the Namibian CSIRT (NamCERT) elaborated on the precariousness of government funding, subject to political shifts and economic pressures, leading to reduced budget allocations. A critical, often overlooked financial challenge mentioned by Hauwanga is that threat intelligence solutions and commercial tools are typically priced in US dollars or Euros, exposing local CSIRTs to exchange rate risk and making these essential resources prohibitively expensive. This forces reliance on less comprehensive, often manual, alternatives. Sergio Guivala stressed the need for sustainability, moving beyond reliance on external donor funding.
• Human Resource Deficiencies: A severe shortage of skilled cybersecurity specialists is a universal problem. Anat Lewin reframed this as an "affordability gap," asserting that while talent exists, it is often unaffordable for low-income and fragile countries. Palakiyem Assih of CERT.tg in Togo explained that local talent often prefers higher-paying jobs in the private or international sectors over government roles. Furthermore, the specialized nature of incident response means specific domains, such as industrial control systems (ICS) security, often lack local expertise.
• Technical and Operational Limitations: Many governments in these regions operate on legacy systems with unsupported software and missing patches, creating significant vulnerabilities (Anat Lewin). Thank-You Hauwanga noted that early incident handling and ticketing processes were often manual, relying on spreadsheets, which severely hampered operational efficiency. Anat Lewin also described scenarios of weak incident reporting mechanisms, poor evidence collection, and a profound lack of network visibility, making it difficult to trace the origin of attacks and coordinate responses.
• Lack of Trust and Collaboration: Palakiyem Assih vividly described the initial lack of trust from Togo's critical infrastructure, especially the financial sector, which viewed the nascent governmental CSIRT as inexperienced and potentially intrusive. Lawrence Muchilwa of FIRST emphasized that cybercrime is inherently transnational, necessitating cross-border collaboration and cyber diplomacy—capabilities often underdeveloped in fragile states.

These interconnected challenges paint a stark picture of the environment in which these CSIRTs operate, underscoring why innovative, context-specific solutions are not just desirable but absolutely essential for progress.

Key Findings

▶ Watch: Togo's innovative Public-Private Partnership (PPP) model for its CERT (13:58)

The panel discussion illuminated several crucial findings and successful strategies for overcoming the pervasive challenges faced by CSIRTs in low-income and fragile contexts:

1. Embrace Progress Over Perfection: Sergio Guivala's opening adage, "perfection fights against progress," became a central tenet. This philosophy advocates for starting with limited resources and taking incremental steps rather than waiting for ideal conditions. Mozambique, for instance, began by engaging directly with ministries and parliament to build political buy-in for cybersecurity, even with minimal funding.

1. Strategic Collaboration and International Networks are Pivotal: A consistent theme was the immense value of joining global and regional cybersecurity communities. Sergio highlighted how Mozambique leveraged resources from FIRST, Africa CERT, and GFCE to empower their processes. Thank-You Hauwanga similarly emphasized NamCERT's engagement with Africa CERT and the SADC task force, benchmarking with other regional CSIRTs to gain guidance and share knowledge. Lawrence Muchilwa articulated this as "riding on already established mechanisms" and avoiding "reinventing the wheel," stressing the importance of coordinated frameworks for regional resilience.

1. Legal Mandates and Sustainable Funding Mechanisms are Essential: Mozambique's experience, shared by Sergio, demonstrated the transformative power of legal frameworks. The recent approval of their cybersecurity law and cybercrime law provided a formal mandate for the national CERT, moving it beyond ad-hoc board decisions. Crucially, the law also established a cybersecurity fund, designed to be sustained by contributions from cybersecurity companies operating in the market, reducing reliance on external donors and ensuring long-term financial viability for capacity building.

1. Innovative Organizational Models, Particularly Public-Private Partnerships (PPPs), Drive Success: The "Togo model," presented by Palakiyem Assih, stands out as a unique and highly effective solution. Facing limitations in funding, human resources, and trust, Togo established its national CERT as a public-private partnership. By co-creating a local company, Cyber Defense Africa, with an experienced private partner (Asseco Data Systems, a Polish company), Togo managed to:

• Attract significant investment (e.g., a 10 million Euro loan for infrastructure).
• Generate revenue (6 million Euros/year) from proactive cybersecurity services offered to critical infrastructures, creating a market for cybersecurity.
• Retain and attract top local talent by offering competitive salaries.
• Build trust with the private sector by demonstrating high-quality service, even while the incident response function remains free. This model resulted in Togo being recognized by the ITU as the "fastest growing country in cyber maturity," achieving Tier 2 ranking from 2019 to 2024.

1. Embrace Open-Source Solutions: Given the high cost of commercial tools, Thank-You Hauwanga advised embracing open-source solutions. NamCERT successfully transitioned from manual incident tracking to using tools like RTIR for automation and leveraged platforms like Shadow Server for threat intelligence, often starting with Proof of Concepts (POCs) for commercial tools before reverting to open-source or community-driven alternatives.

1. Phased Approach to Capability Building: Anat Lewin recommended a phased approach to developing CSIRT capabilities. She cited Somalia's example, starting with a very basic service framework and gradually expanding to include a forensics lab in Phase 2. Similarly, in East Africa, countries opted to begin with a small regional ISAC before considering a full sub-regional CERT, illustrating the value of incremental development.

1. Creative Solutions for Talent Attraction and Retention: Addressing the "affordability gap" for skilled personnel requires innovative approaches. Anat Lewin highlighted examples such as Chile passing a law allowing public sector cybersecurity professionals to be paid market rates, or governments creating publicly-owned private companies or granting waivers to pay competitive salaries. She also strongly advocated for hiring women to fill talent gaps, recognizing their contributions as effective cybersecurity analysts.

1. Cyber Diplomacy and Transnational Collaboration are Non-Negotiable: Lawrence Muchilwa and Anat Lewin stressed that cybercrime knows no borders. Effective incident response, especially for complex transnational attacks, requires robust cyber diplomacy and seamless collaboration with neighboring CSIRTs and international partners. Anat Lewin provided an example where a lack of network visibility in one country allowed it to be used as an attack vector against another, necessitating diplomatic intervention to resolve.

These findings collectively present a blueprint for resilience, emphasizing adaptability, collaboration, and strategic innovation as the cornerstones for successful CSIRT operations in challenging environments.

Technical Deep Dive

▶ Watch: Annat on the 'affordability gap' for cybersecurity talent (18:50)

While the panel discussion primarily focused on policy, governance, and strategic approaches, several technical aspects and implications were woven throughout the conversation, highlighting the unique operational realities of CSIRTs in low-income and fragile contexts.

A fundamental technical challenge identified was the widespread reliance on legacy systems within government infrastructure. Anat Lewin pointed out that many countries operate on unsupported software for which no patches are available, creating a fertile ground for vulnerabilities. This necessitates a strategic overhaul and investment in modern, secure, and properly licensed software, which itself presents a significant financial hurdle.

In terms of operational tools, the high cost of commercial solutions often dictates an embrace of open-source alternatives. Thank-You Hauwanga from NamCERT explicitly mentioned the use of RTIR (Request Tracker for Incident Response) for automating incident handling and ticketing processes. This shift from manual spreadsheets to a structured, open-source ticketing system significantly enhances operational efficiency, tracking, and reporting. For threat intelligence, NamCERT initially relied on manually collecting, analyzing, and correlating data but later leveraged open-source resources like Shadow Server, a non-profit organization that provides free threat intelligence feeds and reports. This strategic adoption of open-source tools allows nascent CSIRTs to build foundational capabilities without prohibitive licensing costs.

The "Togo model" presented by Palakiyem Assih, while an organizational innovation, has direct technical implications. By creating Cyber Defense Africa, a local company operating the national CERT and delivering proactive cybersecurity services, Togo effectively built a local cybersecurity market. This market not only generates revenue but also fosters the development of local technical expertise and infrastructure, including Security Operations Centers (SOCs) and specialized services like operator cyber plans. The ability to attract and retain skilled engineers and technicians locally means that advanced technical capabilities, which might otherwise be outsourced or unavailable, can be developed and maintained within the country.

Rwanda's approach, mentioned by Anat Lewin, showcased a forward-thinking technical resilience strategy: simultaneously building backup capabilities for their national CSIRT and SOC. This involves establishing a geographically separate and redundant site to ensure continuous operation in the event of a catastrophic failure or attack on the primary facility – a critical consideration in fragile environments prone to instability.

The discussion also touched upon the necessity of specific technical capabilities, such as forensics labs. Somalia, in its phased approach to CSIRT development, is expanding to include a forensics lab in its second phase. This capability is crucial for in-depth incident analysis, evidence collection, and supporting legal proceedings related to cybercrime. However, establishing and staffing such a lab requires specialized equipment, software, and highly trained personnel, representing a significant technical investment.

Finally, the need for improved network visibility was highlighted as a critical technical requirement. Anat Lewin recounted an incident where attacks emanating from one country were actually controlled from a third, due to the lack of supervision and visibility over the networks in the originating country. Implementing network monitoring tools, intrusion detection/prevention systems, and robust logging mechanisms are fundamental technical steps to gain the necessary visibility to detect, analyze, and respond to threats effectively.

In essence, the technical deep dive in these contexts is less about deploying cutting-edge, proprietary solutions and more about strategically leveraging available, often open-source, technologies; building resilient, foundational infrastructure; and fostering local technical expertise to address persistent challenges like legacy systems and limited visibility.

Demo / Proof of Concept

▶ Watch: Togo's PPP model created a thriving cybersecurity market (32:00)

This panel discussion did not feature a live technical demonstration or a software proof of concept in the traditional sense. However, the talk itself served as a powerful proof of concept for innovative organizational models, policy reforms, and collaborative strategies that have demonstrably succeeded in enhancing cybersecurity resilience in challenging environments.

The most compelling "proof of concept" presented was the Togo model for establishing a national CSIRT through a public-private partnership (PPP). Palakiyem Assih detailed how this unique structure, embodied by Cyber Defense Africa, transformed Togo's cybersecurity landscape. Before this model, Togo lacked a national CSIRT and faced profound challenges related to funding, talent, and trust from critical infrastructure. The success of Cyber Defense Africa, generating 6 million Euros in annual revenue and enabling Togo to achieve a Tier 2 ranking in the ITU Global Cybersecurity Index, stands as a concrete demonstration that such an innovative approach can overcome severe limitations and drive rapid maturity. This model proves that by addressing the "affordability gap" for talent and creating a sustainable local market, a nation can build robust cybersecurity capabilities.

Similarly, Mozambique's recent legislative achievements, as shared by Sergio Guivala, serve as a proof of concept for the impact of strong policy and legal frameworks. The approval of a cybersecurity law and cybercrime law, which formally mandate the national CERT and establish a cybersecurity fund, demonstrates how political will and strategic legislative action can lay the groundwork for long-term sustainability and operational legitimacy. This shows that even with limited initial resources, a nation can build a resilient foundation by prioritizing governance and financial mechanisms.

The World Bank and FIRST also co-published a report titled "Digital First Responders," which focuses specifically on establishing and running CSIRTs in low-income and fragile environments. This report, mentioned by Ghislain de Salins, acts as a comprehensive documentation and validation of the concepts and success stories discussed, serving as a broader "proof of concept" and a guide for other nations facing similar predicaments. While not a live demo, these examples and resources provide tangible evidence of what can be achieved through strategic, context-aware approaches.

Defensive Implications

▶ Watch: Palakiyem on the 'brutally honest' mindset for CERT autonomy (36:00)

The insights from this panel offer crucial defensive implications for various stakeholders, from national CSIRTs in low-income and fragile contexts to international aid organizations and private sector partners.

For CSIRTs operating in low-income and fragile contexts, the key defensive strategies include:

• Prioritize Collaboration and Information Sharing: Actively engage with regional and international cybersecurity communities such as FIRST, Africa CERT, GFCE, and regional task forces (e.g., SADC task force). This provides access to shared threat intelligence, best practices, training resources, and peer support, which are invaluable when internal resources are scarce. As Lawrence Muchilwa emphasized, this avoids "reinventing the wheel."
• Embrace Open-Source Tools: Given budget constraints, leveraging open-source solutions like RTIR for incident management and Shadow Server for threat intelligence is not just a cost-saving measure but a strategic necessity. These tools enable foundational defensive capabilities without incurring prohibitive licensing fees.
• Advocate for Strong Legal and Policy Frameworks: Push for the establishment of cybersecurity laws that provide clear mandates for the national CSIRT, define its scope, and ensure its operational independence and authority. Furthermore, advocate for sustainable funding mechanisms, such as a cybersecurity fund supported by local industry contributions, to ensure long-term resilience and investment in defensive capabilities.
• Focus on Building Trust: For governmental CSIRTs, actively work to establish trust with critical infrastructure sectors, especially financial institutions. This can involve ensuring the CSIRT operates as a civilian entity, demonstrating high-quality service, and maintaining strict confidentiality. Without trust, incident reporting will remain weak, hindering collective defense.
• Adopt a Phased and Modular Approach: Begin with foundational services and gradually expand capabilities. For example, start with basic incident handling and then progress to more advanced functions like establishing a forensics lab or a Security Operations Center (SOC). This allows for incremental investment and skill development, avoiding overwhelming initial requirements.
• Address the Talent Gap Creatively: Implement strategies to attract and retain skilled cybersecurity professionals. This could involve advocating for market-rate salaries for public sector roles, exploring public-private partnership (PPP) models like Togo's to offer competitive compensation, or actively recruiting and training underrepresented groups, such as women.
• Mitigate Legacy System Risks: Proactively identify and address vulnerabilities in legacy systems that lack patches and vendor support. While full replacement may be costly, interim measures like isolation, compensating controls, and continuous monitoring are crucial defensive steps.
• Enhance Network Visibility: Invest in tools and processes to gain better visibility over national networks. This is critical for detecting anomalies, tracing attack origins, and preventing local infrastructure from being exploited as launchpads for attacks against other nations.
• Engage in Cyber Diplomacy: Recognize that cyber threats are transnational. Actively participate in cyber diplomacy efforts to foster cross-border intelligence sharing and coordinated incident response with neighboring countries and international partners.

For international organizations and donors like the World Bank and FIRST, the implications suggest:

• Provide Practical Hand-Holding: Beyond offering frameworks and advice, actively support countries in implementing these best practices, providing tailored guidance and technical assistance.
• Support Sustainable Models: Prioritize funding and initiatives that foster long-term sustainability, such as cybersecurity funds and PPPs, rather than short-term project-based aid.
• Facilitate Regional and Language-Specific Collaboration: Promote initiatives that break down language barriers and encourage collaboration among countries with shared linguistic or regional contexts.

Overall, the defensive posture in these environments must be adaptive, collaborative, and strategically oriented towards building self-sustaining capabilities, rather than relying solely on external support or attempting to replicate models from high-resource nations directly.

Key Takeaways

• Collaboration is Paramount for Resource-Constrained CSIRTs: Joining international and regional networks like FIRST, Africa CERT, and GFCE is crucial for leveraging shared resources, knowledge, and collective defense strategies, preventing the need to "reinvent the wheel."
• Innovative Funding and Organizational Models Drive Sustainability: Public-Private Partnerships (PPPs), exemplified by Togo's Cyber Defense Africa, and legally mandated cybersecurity funds, as established in Mozambique, offer viable pathways to financial independence and talent retention, moving beyond reliance on external aid.
• Embrace Pragmatism and Open-Source Solutions: Start small, focus on progress over perfection, and strategically adopt open-source tools (e.g., RTIR, Shadow Server) to build foundational capabilities cost-effectively when commercial solutions are unaffordable.
• Policy and Trust are Foundational Pillars: Strong legal frameworks that mandate CSIRT operations and establish sustainable funding mechanisms, coupled with deliberate efforts to build trust with critical infrastructure sectors (e.g., through civilian CSIRTs), are essential for effective incident reporting and national cybersecurity maturity.
• Address Talent Gaps Creatively: Overcoming the "affordability gap" for skilled cybersecurity professionals requires innovative solutions, such as offering market-rate salaries in the public sector, creating public-owned private entities, or actively recruiting diverse talent, including women.
• Cyber Diplomacy and Phased Development are Critical: Recognizing the transnational nature of cybercrime necessitates active engagement in cyber diplomacy for cross-border collaboration. Furthermore, adopting a phased approach to capability building allows for incremental growth and efficient resource allocation.

About the Speaker(s)

• Ghislain de Salins (World Bank): Part of a team dedicated to cybersecurity at the World Bank, he has been instrumental in helping over 50 countries develop their national CERTs and establish sectoral CERTs. He has personally worked with governments in Grenada, Haiti, and Liberia, among others, to set up national CSIRTs.
• Palakiyem Assih (CERT.tg): The head and co-founder of the national CSIRT in Togo (CERT.tg), Palakiyem is a key architect of the acclaimed "Togo model," a unique public-private partnership that has significantly advanced Togo's cybersecurity maturity.
• Sergio Guivala (National Institute of Information and communication Technology (INTIC)): Representing Mozambique's ICT regulator, Sergio has been actively involved in setting up the national CERT ecosystem in his country, collaborating with international partners like FIRST and the World Bank to overcome significant challenges.
• Thank-You Hauwanga (Namibian CSIRT): As a representative of the Namibian CSIRT (NamCERT), Thank-You shared valuable insights into operating a government-funded CSIRT in a low-income context, particularly on leveraging open-source solutions and regional collaboration.
• Lawrence Muchilwa (Forum of Incident Response and Security Teams): An experienced figure within the cybersecurity community, Lawrence served as the first liaison for FIRST to East Africa. His expertise lies in cyber diplomacy and fostering collaboration among nations to build resilient incident response capabilities.
• Anat Lewin (Cybersecurity professional, World Bank): With extensive experience advising CSIRTs in low-income countries, Anat brings a wealth of knowledge on governance, talent acquisition, and operational challenges, having witnessed firsthand the impact of cybercrime in fragile economies.