Building a Regional ISAC for West Africa that Works: Governance, Tools and Community Maturity

Building a Regional ISAC for West Africa that Works: Governance, Tools and Community Maturity

Speakers: Don Stikvoort (Open CSIRT Foundation); Miroslaw Maj (Open CSIRT Foundation)

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=KpSfYvf2dO8

Overview

This talk, delivered by Don Stikvoort and Miroslaw Maj of the Open CSIRT Foundation at FIRSTCON, addresses the intricate challenges of establishing effective regional cybersecurity cooperation, particularly within developing regions. Titled "Building a Regional ISAC for West Africa that Works: Governance, Tools and Community Maturity," the presentation delves into the strategic decision to pursue a regional Information Sharing and Analysis Capability (ISAC) for the Economic Community of West African States (ECOWAS), rather than a traditional regional Computer Security Incident Response Team (CSIRT) or CERT. The speakers meticulously outline the historical context, the rationale behind this choice, the project's implementation, and the critical lessons learned from their work in the 12 ECOWAS countries.

The core of the discussion revolves around the necessity of a structured, trust-based approach to cyber threat intelligence sharing among nations with varying levels of cybersecurity maturity and resources. Stikvoort and Maj highlight the pitfalls of previous attempts at regional incident handling (such as the historical Eurosert initiative) and argue for an ISAC model that focuses on analysis and recommendations, leaving incident response to national entities. This distinction is crucial for fostering collaboration without impinging on national sovereignty or the reluctance to "wash dirty linen in public."

The importance of this talk extends beyond the West African context, offering a blueprint for multinational cybersecurity initiatives globally. It underscores that successful regional cooperation hinges not just on technology, but profoundly on governance, the deliberate cultivation of trust, and the pragmatic application of established frameworks like the FIRST Services Framework. For policymakers, cybersecurity leaders, and practitioners in both developed and developing nations, the insights shared provide a valuable roadmap for building resilient, collaborative cyber defenses that respect national boundaries while leveraging collective intelligence.

Background

▶ Watch: Introduction and speaker backgrounds (0:00)

The journey towards building effective cybersecurity capabilities has been marked by a continuous evolution of terminology and organizational structures. Don Stikvoort and Miroslaw Maj initiated their talk by tracing this history, noting the emergence of early incident response teams like CERT/CSIRT around the time of the Morris worm in 1988. Over the decades, a proliferation of names—including PERT (Product Security Team), ISAC (Information Sharing and Analysis Capability), SOC (Security Operation Center), GOC (Governmental SOC), and Cyber Defense Center—led to significant confusion. To address this, the speakers, as members of the FIRST Framework SIG, contributed to standardizing four core team types: CERT/CSIRT, ISAC, SOC, and PERT, grounding them in the FIRST Services Framework. This framework delineates five service areas, each with specific services and functions, and defines the minimum "must-provide" services for each team type. For an ISAC, these must-haves fall squarely within the situational awareness service area, emphasizing its role in collecting, analyzing, and sharing information without directly engaging in incident handling.

The necessity for regional cooperation stems from the inherent difficulties faced by national incident management teams. The speakers highlighted that national CSIRTs typically range from a modest 10 people in smaller economies (e.g., Mauritius, a country of 1 million people with 10 CSIRT staff) to hundreds in larger ones (e.g., the Netherlands, 18 million people with 500 CSIRT staff). Countries with higher poverty rates or smaller GDPs often struggle immensely to provide the full spectrum of required cybersecurity services. Miroslaw Maj shared the example of Poland's CSIRT.pl, which grew from 15 to 110 people post-2018 due to the NIS directive, illustrating the significant resources required for comprehensive national incident response. This disparity underscores the value of collaboration, especially with neighboring countries.

However, the path to regional collaboration is fraught with historical pitfalls. An early attempt in Europe, Eurosert, launched around 1997 with EU funding, aimed to handle incidents on a European scale and build a community. While the community-building aspect was a "magnificent" success, leading to the formation of the TFC (Trusted Introducer for CSIRTs) community, the incident management part failed. The reason: a lack of incident reporting. As Stikvoort candidly explained, "you don't wash your dirty linen in public." Nations were unwilling to report sensitive government incidents to a regional entity. Similar speculations about regional CERTs in Africa since 2020 met the same skepticism. This history led to the crucial insight that a regional ISAC, focused on information sharing and analysis rather than direct incident handling, would be a more viable and palatable solution for the ECOWAS community in West Africa.

Key Findings

▶ Watch: Why regional CSIRTs fail; ISAC as a viable solution (12:00)

The talk presents several pivotal findings derived from the practical experience of building a regional ISAC for West Africa:

1. Regional ISACs are a Viable and Sound Solution: The core finding is that a regional ISAC, distinct from a regional CERT, offers an effective model for multinational cybersecurity cooperation. By focusing on collecting, analyzing, and sharing aggregated information, recommendations, and threat intelligence, an ISAC avoids the pitfalls of national reluctance to share sensitive incident details, allowing national CSIRTs to retain ownership of incident handling. This model is particularly suited for regions like West Africa, where individual countries may have limited resources.

1. Trust is the Foundation of Information Sharing: The speakers emphasized that trust cannot be assumed but must be actively built and maintained. Live, in-person meetings were identified as "crucial" for establishing the personal connections necessary for participants to trust each other. This human element, involving "faces with names," is paramount for overcoming inherent skepticism and fostering a collaborative environment, especially in diverse multinational settings.

1. Clarity in Terminology and Service-Oriented Design is Essential: The pervasive "name confusion" in cybersecurity necessitates adherence to standardized terminology, such as that provided by the FIRST Services Framework. Clearly defining what an ISAC does (situational awareness) versus a CERT (incident management) sets correct expectations. Furthermore, designing the ISAC's operations around well-defined services allows for a clear understanding of objectives, required effort, and resource allocation.

1. Information Sharing Processes Must Be Simple and Enabling: Complex or overly bureaucratic processes for information exchange will inevitably hinder cooperation. The principle of "keep it simple" (KISS) was highlighted as vital for designing processes and quality controls that facilitate sharing rather than blocking it. This includes making it easy for participants to contribute and access actionable intelligence.

1. Empowering Local Participants Ensures Sustainability: For any regional initiative to thrive long-term, ownership must reside with the local community. The project deliberately shifted responsibility to West African participants, encouraging them to lead discussions, develop ideas, and eventually run the ISAC independently. This approach not only builds capacity but also fosters commitment and ensures the ISAC's continued relevance and adaptation to local needs.

1. Political Will and Formal Mandates are Non-Negotiable: While grassroots community building is important, formal, high-level political endorsement is critical for institutionalizing regional cooperation. Obtaining ministerial-level signatures on Memoranda of Understanding (MoUs) from all participating countries, though challenging and time-consuming, provides the necessary mandate for information sharing and operational continuity. Overcoming initial reluctance from "higher layers" to share information, by emphasizing technical vectors over confidential content, was a significant hurdle successfully addressed.

Technical Deep Dive

▶ Watch: Practical tools and methods for information exchange (MISP) (24:00)

The technical foundation of the West African regional ISAC project is deeply rooted in established cybersecurity frameworks and pragmatic tooling choices. The core distinction, as articulated by the speakers, lies in the functional separation between an ISAC and a CERT. While a CERT is primarily responsible for incident management, actively responding to and resolving cyber incidents, an ISAC focuses on situational awareness. This means an ISAC collects raw information, analyzes it to identify trends, threats, and vulnerabilities, draws conclusions, and disseminates actionable recommendations to its constituents. It explicitly "doesn't do the actual incident handling part," nor does it dictate specific remediation actions like "patch this." Instead, it empowers national CSIRTs and critical infrastructure teams to act on shared intelligence.

The project itself is a collaborative effort involving several key partners. The ECOWAS community of 12 West African countries (excluding Mali, Burkina Faso, and Niger due to political instability) is the beneficiary. Funding and support primarily come from GIZ (Deutsche Gesellschaft für Internationale Zusammenarbeit) and the European Union. The implementation and technical expertise are provided by a consortium including the Open CSIRT Foundation, the Cyber Security Foundation (Miroslaw Maj's NGO), and DFN-CERT from Germany.

A critical aspect of the methodology involved a service-oriented design, heavily leveraging the FIRST Services Framework. This framework provided a common language and structure for understanding and defining the ISAC's operational scope. By breaking down the ISAC's mission into specific services, the project could accurately estimate effort, allocate resources, and communicate objectives effectively to stakeholders. The roadmap for this ISAC extends until at least the end of 2027, indicating a long-term strategic vision.

A key technical deliverable was the design of an information sharing matrix. This matrix, developed through collaborative discussions with regional participants, explicitly outlines which types of information are valuable to share and the appropriate tools for their exchange. Examples of information types could include indicators of compromise (IoCs), attack vectors, malware samples, and observed techniques. The tooling recommended for sharing included:

• MISP (Malware Information Sharing Platform): This was identified as one of the first and most critical operational decisions, with a dedicated MISP platform established as the "blast circulation" mechanism for the entire community. The emphasis was on "actionable information sharing," and MISP's structured data format and sharing capabilities are central to this.
• OpenCTI: Another platform for cyber threat intelligence management, offering capabilities for visualizing and organizing threat data.
• Mailing lists: A simple yet effective communication channel for less structured or urgent notifications.
• GitHub: Potentially used for sharing code, scripts, or documentation related to tools and processes.

The speakers also highlighted the importance of standard protocols and practices like the Traffic Light Protocol (TLP) for secure and controlled information exchange, ensuring that sensitive data is shared only with appropriate parties. The goal was to make sharing "easy and not to block it," adhering to a "keep it simple" philosophy for processes and quality control. This technical infrastructure, combined with robust governance and trust-building, forms the backbone of the West African regional ISAC.

Demo / Proof of Concept

▶ Watch: Key lessons: building trust, simple processes, participant ownership (30:00)

While the talk did not feature a traditional software demonstration or a live "demo" in the common sense, the project incorporated a highly effective form of practical validation: cyber exercises. These exercises served as crucial proof-of-concept demonstrations for the proposed ISAC model, allowing participants from the 12 ECOWAS countries to actively engage in simulated scenarios and experience the benefits of collaborative information sharing firsthand.

The speakers explicitly mentioned that for each of the four to five project meetings held, tailored exercises were prepared. These exercises were designed to simulate real-world regional cybersecurity problems, such as a widespread "phishing campaign in the region." The platform used for these exercises was Cyberbus, which enabled the creation and execution of realistic scenarios.

The purpose of these hands-on sessions was multi-fold:

1. Foster Cooperation: By working together to resolve a common simulated problem, participants built practical cooperation skills and relationships.
2. Test Sharing Mechanisms: The exercises provided a live testing ground for the designed information sharing processes and tools, particularly the newly established MISP platform. Participants could practice sharing indicators, analyses, and recommendations as they would in a real incident.
3. Identify Needs and Gaps: Through these simulations, the project team and participants could better understand their collective needs, identify potential operational challenges, and refine the ISAC's services and processes. For instance, an exercise might reveal the need for specific types of information to be shared via MISP.
4. Build Confidence and Understanding: Engaging in practical scenarios helped participants, many of whom were new to this level of multinational cooperation, to understand the tangible benefits of a regional ISAC and how their individual contributions could enhance collective security.

This approach moved beyond theoretical discussions, providing concrete, experiential learning that validated the ISAC's operational model and reinforced the importance of shared tools and collaborative efforts. The exercises were described as "very very successful" in terms of helping participants understand future collaborative work and the necessity of tools like MISP for effective threat intelligence exchange.

Defensive Implications

▶ Watch: Q&A: Defining success for the West African ISAC (36:00)

The establishment of a regional ISAC in West Africa carries profound defensive implications for the participating nations and the broader cybersecurity landscape of the region. By centralizing the collection, analysis, and dissemination of cyber threat intelligence, the ISAC significantly enhances the defensive posture of individual countries, many of which operate with limited resources.

Firstly, the ISAC provides a critical layer of situational awareness that would be difficult for any single national CSIRT to achieve independently. By aggregating data from 12 countries, the ISAC can identify regional threat trends, common attack vectors, and emerging malware campaigns that might otherwise go unnoticed or be perceived as isolated incidents. This proactive intelligence allows national teams to anticipate threats and implement preventative measures before they manifest widely.

Secondly, the focus on actionable threat intelligence means national CSIRTs and critical infrastructure operators receive specific indicators of compromise (IoCs), attacker techniques, and recommendations. This directly informs their defensive strategies, enabling them to:

• Improve Detection: Configure security tools (SIEMs, EDRs) to detect threats relevant to the region.
• Enhance Prevention: Implement patches, update firewalls, and apply security controls based on shared vulnerabilities and attack patterns.
• Optimize Incident Response: Leverage collective knowledge to respond more efficiently and effectively to incidents, benefiting from analyses of similar events in neighboring countries.

Thirdly, the ISAC fosters a much-needed community of trust among cybersecurity professionals in the region. This trust is invaluable during crises, facilitating informal communication and collaboration that extends beyond formal channels. It creates a network where national teams can seek advice, share insights, and collectively strategize against sophisticated adversaries, effectively amplifying their individual defensive capabilities.

Furthermore, the project's emphasis on standardized terminology and frameworks (like the FIRST Services Framework) promotes interoperability and a shared understanding across the region. This harmonization reduces communication barriers and ensures that intelligence shared by the ISAC is consistently interpreted and acted upon by diverse national entities.

Finally, the ISAC model offers a pathway for resource optimization and capacity building. Instead of each country having to build exhaustive threat intelligence capabilities from scratch, they can leverage the centralized analysis of the ISAC. Additionally, project activities like SIM3 auditor training (mentioned for Togo) directly contribute to elevating the cybersecurity maturity of the region, ensuring that local teams are better equipped to utilize the ISAC's output and contribute to its intelligence pool. In essence, the regional ISAC transforms individual defensive efforts into a more cohesive, informed, and resilient collective defense against an ever-evolving cyber threat landscape.

Key Takeaways

• Regional ISACs are a Viable Model for Multinational Cooperation: In contrast to regional CERTs, which have historically struggled due to reluctance to share sensitive incident data, a regional ISAC focused on aggregated information sharing and analysis provides a practical and effective solution for enhancing collective cybersecurity, especially in resource-constrained environments.
• Trust is Paramount and Requires Direct Engagement: Effective information sharing hinges on established trust among participants. This trust is primarily built through in-person meetings and direct interaction, fostering personal relationships that overcome inherent national hesitations and facilitate open communication.
• Clear Terminology and Service-Oriented Design are Foundational: Adhering to standardized terminology, such as that provided by the FIRST Services Framework, is crucial for setting clear expectations and defining the scope of an ISAC's services. This structured approach ensures efficient resource allocation and a shared understanding of objectives.
• Actionable Intelligence Requires Simple Processes and Dedicated Tools: Information sharing mechanisms must be designed for simplicity to encourage participation and prevent bottlenecks. Tools like MISP (Malware Information Sharing Platform) are critical for structured, actionable threat intelligence exchange, serving as a central hub for indicators and analyses.
• Empowering Local Ownership Ensures Long-Term Sustainability: For any regional initiative to be successful in the long run, it must be driven and sustained by the local community. Gradually transferring responsibility to regional participants fosters ownership, builds capacity, and ensures the ISAC remains relevant and responsive to local needs.
• Formal Political Mandates are Essential for Institutionalization: While community building is vital, securing high-level political buy-in and formal ministerial-level agreements across all participating nations provides the necessary mandate for information sharing and guarantees the ISAC's institutional longevity and operational continuity.

About the Speaker(s)

Don Stikvoort is a highly experienced and recognized figure in the global cybersecurity community, with a career spanning since 1989. He is regarded as one of the pioneers in the CERT/CSIRT community in Europe, having started numerous incident response teams. Stikvoort is also the creator of the SIM3 maturity model, a widely used framework for assessing and improving the capabilities of security teams, which has been in use since 2008. His contributions to the field have earned him a place in the Hall of Fame. He is a co-founder of the Open CSIRT Foundation, which hosts the SIM3 activity and, since 2022, the TFC (Trusted Introducer for CSIRTs) community.

Miroslaw Maj brings extensive experience from Poland's cybersecurity landscape. He previously served as the head of CSIRT.pl, Poland's national CSIRT, an organization established in 1996. Maj is also the founder of the Cyber Security Foundation, an NGO, and is actively involved with the Open CSIRT Foundation. His expertise includes national-level cyber exercises and various international projects, providing a strong background in practical incident management and community building, particularly in the context of national and regional cybersecurity development.