You are here
Home > CSIRT SPECIFICATION FOR NATIONAL CERT – CERT.hr

CSIRT SPECIFICATION FOR NATIONAL CERT – CERT.hr

1. Introduction

This document contains information about the operation, constituency and description and services offered by National CERT / CERT.hr. The document complies with the requirements of RFC 2350 (https://www.ietf.org/rfc/rfc2350.txt), which outline the requirements and expectations of the Internet community for the best practices of CSIRTs in their operations.

1.1 Date of Last Update

This is version 5.3 published in December 2022.

1.2 Distribution List for Notifications

Currently, National CERT / CERT.hr has not established a mailing list to notify of updates to this document. Major update information is available on our website: https://www.cert.hr.

1.3 Locations where this Document May Be Found

The current version of this document is available from National CERT/CERT.hr website on the following link: https://www.cert.hr/cert_hr_rfc2350/

1.4 Authenticating this Document

1. Document title: CSIRT SPECIFICATION FOR NATIONAL CERT – CERT.hr
2. Version: 5.3
3. Document date: 14.12.2022.
4. Expiration: This document is valid until further notice.

This document has been signed with the National CERT’s PGP key.

Public PGP key of National CERT/CERT.hr is available at: https://www.cert.hr/wp-content/uploads/2019/02/ncert_asc.zip

Digitally signed document is available at: https://www.cert.hr/wp-content/uploads/2022/12/CERT_hr_RFC2350_v5.3_signed.zip

2. Contact Information

2.1 Name of the Team

National CERT / CERT.hr – National Computer Emergency Response Team

2.2 Address

Croatian Academic and Research Network - CARNET
Department for National CERT
Josipa Marohnića 5
10000 Zagreb
Croatia

2.3 Time Zone

CET – Central European Time UTC+0100
(Start: last Sunday in October at 02:00; End: last Sunday in March at 02:00)
CEST – Central European Summer Time: UTC+0200
(Start: last Sunday in March at 03:00; End: last Sunday in October at 03:00)

2.4 Telephone Number

+385-1-6661-650

2.5 Facsimile Number

+385-1-6661-767 (not to use for secure information)

2.6 Other Telecommunication

There’s none available.

2.7 Electronic Mail Address

cnre@tectrh.r – for general inquiries

niicedtnc@re.trh – for incident reporting – use of telephone and facsimile for reporting incidents should be avoided as much as possible

kz-sniicedtnc@re.trh – for the submission of reports about significant incidents from key service operators and digital service providers

2.8 Public Keys and Other Encryption Information

National CERT has a PGP key.
Primary User ID: Croatian National CERT
Key ID: 0xFCA254BB
Expiration: Never
Fingerprint:
E54B B60A C4D1 45E7 0FF4 CC5B E35C DB85 FCA2 54BB

The PGP key with a signature is available at Nacionalnog CERT’s / CERT.hr’s website (https://www.cert.hr/en/contact/) and at most of the popular key exchange servers.

2.9 Team members

The assistant of the principal for National CERT Nataša Glavor holds the position of the leader of National CERT/ CERT.hr within Croatian Academic and Research Network – CARNET.
There are two teams working within the National CERT / CERT.hr: Incident handling service and Services and infrastructure security team.

2.10 Other information

General information about the National CERT, as well as links to various recommended security resources can be found at: https://www.cert.hr . Most of the information is available only in Croatian.

Facebook page: https://www.facebook.com/CERT.hr/

Twitter profile: https://twitter.com/hrcert

2.11 Points of Customer Contact

The preferred method for reporting the incident is via e-mail to niicedtnc@re.trh, and also via fax.
The procedure of reporting an incident is described at:
http://www.cert.hr/en/report_incident.

Received reports about an incident will be handled by National CERT team.
National CERT recommends encryption of confidential information with PGP when reporting an incident.

If sending an e-mail is not possible (or not advisable due to security circumstances), incidents can also be reported via telephone during regular office hours.

Reports about incidents according to the Cybernetic Security Act on key service providers and digital service providers can be submitted to kz-sniicedtnc@re.trh. The instructions can be found on the link in chapter 6 of this document.

National CERT’s operating hours are generally restricted to regular business hours (09:00-16:00 Monday to Friday).

3. Charter

3.1 Mission Statement

The purpose of the National CERT is, firstly, to assist users of the Internet in Croatia by implementing proactive activities in order to reduce the risks of computer security incidents, and secondly, to coordinate responding to such incidents when they occur.

3.2 Constituency

National CERT’s constituency is the whole Croatian top level domain (.hr) and all IP ranges in Croatia, excluding the Government bodies.

National CERT/CERT.hr is coordinating significant incidents according to the Cybernetic Security Act on key services providers and digital service providers for the following sectors: banking, financing market infrastructure, digital infrastructure, business services for government bodies and digital service providers.

National CERT is also the CERT of Croatian Academic and Research Network – CARNET.

3.3 Sponsorship and/or Affiliation

National CERT is financed by the Ministry of Science and Education via Croatian Academic and Research Network – CARNET. National CERT is a department within CARNET. Croatian Academic and Research Network – CARNET is engaged in the development, construction and maintenance of the ICT infrastructure connecting Croatian academic and scientific research institutions into a private network.

National CERT is a member of the following organizations:
• FIRST (Forum of Incident Response Teams) – https://www.first.org/members/teams/cert-hr
• TF-CSIRT (Task Force on Cyber Security Incident Response Teams) – https://www.trusted-introducer.org/directory/teams/certhr.html
• EU CSIRT’s Network

3.4 Authority

National CERT was established in accordance with the Information Security Act of the Republic of Croatia and according to the Act CERT is a national body for prevention and protection from computer threats to the security of public information systems in the Republic of Croatia.

According to the Ordinance on the Work of National CERT, the Department deals with incidents if one of the parties to the incident is in the Republic of Croatia (i.e. if it is in the .hr domain or in Croatian IP address space).

According to the Cybernetic Security Act on key services providers and digital service providers (NN 64/18) National CERT/CERT.hr is declared as an authorized CSIRT for all key service operators which are operating in banking, financing market infrastructure, digital infrastructure, business services for government bodies (scope of government bodies competent for science and education) and digital service providers.

According to the Ordinance on the organisation and management of the national top-level domain (NN 38/10) National CERT has the authority to request a temporary suspension of a .hr domain if the domain is hosting malicious content (Phishing URL, Malware URL) and if there is no timely reaction to requests for removal of the malicious content.

In its field of jurisdiction, National CERT has rights to give directives, guidelines, recommendations, advices and opinions.

4. Policies

4.1 Types of Incidents and Level of Support

National CERT is authorized to handle all types of computer security incidents and threats that occur within its constituency.
Types of computer security incidents defined by National CERT are:
• Successfully compromised host
• Malicious website
• Attempt of unauthorized access
• Information Gathering
• Denial of Service
• Cryptojacking
• Unsolicited electronic messages, offensive content, harassment, misinformation
• Advanced persistent threat (APT)
• Fraud
• Other types of malicious attacks

National CERT engages with its resources in helping to resolve significant incidents that are defined according to the following priorities:
a) incidents that pose a threat to human lives
b) incidents that occur on the Internet infrastructure in Croatia
c) incidents of major importance
d) new types of malicious attacks
e) other incidents

National CERT is required to respond to a report within two working days (Monday-Friday).

4.2 Co-operation, Interaction and Disclosure of Information

National CERT co-operates with:

  • Office of the National Security Council (UVNS)
  • Information Systems Security Bureau (ZSIS)
  • Ministry of the Interior of the Republic of Croatia

National CERT modulates its activites within the area of computer security regulations in Croatia with the Office of the National Security Council (UVNS) and also cooperates with them regarding euro-atlantic integration matters. National CERT is also in co-peration with the Information Systems Security Bureau (ZSIS) and the Ministry of the Interior of the Republic of Croatia. Cooperation with foreign CERT teams is achieved through memberships in Forum of Incident Response and Security Teams (FIRST) and in TF-CSIRT working group.

4.3 Communication and Authentication

For communication with CERT teams and other authorities responsible for information security, National CERT uses Internet, telephone, fax, electronic media and written form. Other forms of communication are available in specific situations. When storing, publishing and sending data, it is ensured that data sources can be protected and verified using appropriate cryptographic and electronic signature methods. Other authentication methods include verification through members of the FIRST organization, use of WHOIS information service and data with the relevant registration authorities on the Internet, confirmation phone call and the return e-mail.

All communication is subject to the Privacy Notice, which can be found at https://www.cert.hr/NCOoPInc.

5. Services

5.1 Incident Response

National CERT gives support for the following technical and organizational aspects:

5.1.1. Incident Triage

  • determining whether the observed incident can be classified as a computer-security incident, i.e. whether it is a type of incident defined according to the National Taxonomy of Computer-Security Incidents
  • security warnings are created on the basis of collected information, and distributed publicly or privately
  • determining the extent of the incident  

5.1.2 Incident Coordination

Coordination of response to significant incidents involving at least one party from Croatia where, due to its scope and significance, several CERTs or other relevant bodies are involved.

5.1.3 Incident Resolution

Reactive measures of incident resolution:

  • Security warnings
  • Coordination during resolution of major incidents

In addition, the National CERT collects statistics on incidents related to its area of activity and, where appropriate, reports to the public in order to encourage and facilitate protection against certain known types of attacks. To assist and mediate in handling of computer-security incidents, a notification must be sent by e-mail to the National CERT address that complies with the parameters set out in Chapter 2.11.

Help and support of National CERT is provided according to chapter 4.1.

5.2 Proactive Measures

By taking proactive measures, National CERT acts before the occurment of incidents or other events which pose a threat to the security of information systems, with the aim of preventing or mitigating possible damage.

Information about proactive measures are publicly available.

Proactive measures are as follows:

Security warnings: Based on tracking of events and situations in the field of computer security, analysis of available data and by foreseeing trends, National CERT prepares and publishes security alerts to adequately prepare to prevent or mitigate damage.

Monitoring of computer security technologies: National CERT regularly monitors the field of computer security technologies and integrates the findings into disseminated information.

Dissemination of information in the field of computer security: National CERT collects, aggregates, produces and disseminates relevant information and documents, recommendations and instructions in the field of computer security.

Vulnerability assesment: National CERT offers a vulnerability assesment service separately (and technically separated) for:
• Croatian Academic and Research Network – CARNET
• institutions that are connected to the CARNET network via permanent connection

More information is available here: https://www.cert.hr/provjera_ranjivosti/

Rising awareness of the importance of computer security: through public action and promotional activities, National CERT works to educate the general public and raise awareness about the importance of computer security.

Computer security education and training: National CERT prepares and conducts educational campaigns for targeted groups of users through educational materials.

6. Important Notice

Instructions and forms for reporting incident according to the Cybernetic Security Act on key service providers and digital service providers is available at: https://www.cert.hr/zks-incident.

7. Disclaimer

While every precaution will be taken in the preparation of information, notifications and alerts, National CERT assumes no responsibility for errors or omissions, or for damages resulting from the use of the information contained within.

Top