Stakeholders of TWCERT/CC-Online Survey

 TWCERT/CC Newsletter Subscriber

& Taiwan CERT/CSIRT Alliance

Expectations and Recommendations

Most of the newsletter subscribers and the alliance members hope that TWCERT/CC could offer more cybersecurity case studies sharing and educational training. This includes expanding influence through online courses, as well as hands-on drills and onsite advocacy, to help businesses better understand cyber attacks, their impact, and response strategies. They also emphasize the optimization of existing services, expressing an expectation for TWCERT/CC to continually enhance various services, making interfaces more user-friendly and efficient, and improving the speed of reporting and information updates.

Source: Online Survey (2023)

Taiwan CERT/CSIRT Alliance - In depth Interview

Assisting in grasping diverse cybersecurity threats, expanding the scope of intelligence

Stakeholders have expressed positive feedback on the TWCERT/CC's service quality such as cybersecurity notifications. They believe that since major enterprises already have the ability to search for the public cybersecurity information autonomously, CERT/CC could share more about de-identified attack methods, in addition to indicators of compromise (IOC). By doing so, enterprises could be assisted in developing specific defensive strategies through cooperative information sharing. Furthermore, stakeholders suggest that, if feasible, they could collect leaked intelligence from the dark web, provide critical information to private enterprises in advance, thereby bolster the joint cybersecurity defense.

They share threat intelligence with enterprises. Generally speaking, I think the information they provide is relatively up-to-date, …The intelligence they provide, such as indicators of compromise (IOC), is very clear, which is pretty good.

We are more concerned about the attack method. …Since these are real cases of victimized enterprises, there should be a way to share the attack method after de-identification, …or perform some analysis or explanation about some active advanced persistent threat (APT) groups to inform Taiwanese enterprises about the key focus areas and directions to pay attention to.

Consolidating cybersecurity systems, continuously upgrading automated systems

Regarding the cybersecurity incidents reporting and threat intelligence sharing, stakeholders expect CERT/CC to establish more automated systems, on top of the existing services, bolstering communication efficiency and is a more economically scalable approach.

The attacks can occur at night, so sometimes you may find 40 to 50, or even 80 reports when you get into the office, which is not very efficient if they all need to be dealt with manually. That's why the API was proposed, to screen the reports received, organize them, and communicate about that directly through the system.

Nowadays, threat intelligence is sent via email, it can be automated, right? Otherwise, I have to download the file, extract the Excel file or article manually, then find the URL and IP, and finally write a program to copy the information, every time. I hope to automate all these processes and the API could detect and process them in real-time.

Information sharing through workshop, long-term cultivating of cybersecurity talents

Stakeholders are aware of the shortage of cybersecurity professionals in the industry and hope that TWCERT/CC can continuously cultivate cybersecurity talent through workshops and courses. As long as the sessions are led by experts, enterprises are willing to pay for participating. Stakeholders specifically mention the importance of balanced development between south and north Taiwan, suggesting more workshops and managing the cybersecurity center in the south.

Ask private enterprises to briefly explain the risks and problems they encounter, the attacks they have already witnessed, how the intrusions take place, using what methods, and their corresponding processes.

I hope that those workshops can be held both in southern and northern Taiwan. …There should be a balanced development between the north and the south. Some workshops are not suitable online, so I think a cybersecurity center is needed in the south to accommodate those in central and southern Taiwan.

I think that TWCERT or the Ministry of Digital Affairs have been conducting talent cultivation courses in recent years, offering some intermediate and advanced courses in both northern, central, and southern Taiwan. I think this is a good approach. The next step is to make sure that these courses can be made continuous and recurring to maintain their impact.