-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 CTIR Gov RFC2350 1. Document Information 1.1 Date of Last Update This is version 1.3, published 2024/07/26. 1.2 Distribution List for Notifications There is no distribution list for notifications of new versions of this document. 1.3 Locations Where This Document May Be Found The current version of this document can be found at https://www.gov.br/ctir/pt-br/assuntos/rfc-2350 1.4 Authenticating this Document For validation purposes, a GPG signed ASCII the English version of this document, located at https://www.gov.br/ctir/pt-br/assuntos/media/rfc2350-ctirgov.txt The key used for signing is the CTIR Gov key as listed under 2.8. 2. Contact Information 2.1 Name of the Team In English: CTIR Gov - Cyber Incident Prevention, Handling and Response Center of Brazilian Government. In Brazilian Portuguese: CTIR Gov - Centro de Prevenção, Tratamento e Resposta a Incidentes Cibernéticos de Governo. 2.2 Address CTIR Gov Palácio do Planalto - Anexo III - Ala A - sala 107 CEP: 70150-900 - Praça dos Três Poderes - Brasília, DF - Brazil. 2.3 Time Zone America/Sao_Paulo (GMT-0300). 2.4 Telephone Number Not applicable. CTIR Gov does not accept incident reports via telephone. 2.5 Facsimile Number None available. 2.6 Other Telecommunication iNOC-DBA: 266031*800 (see https://inoc.nic.br/). 2.7 Electronic Mail Address Incident reports should be sent to . 2.8 Public Keys and Other Encryption Information The CTIR Gov has a PGP key, whose KeyID is 221BFF78 and whose fingerprint is 2BBE CB49 EC3A D4FE 5C4D 9FF9 BD0F 2FF0 221B FF78 and can be found at: https://www.gov.br/ctir/pt-br/media/ctir-site.asc/@@download/file/ctir-site.asc 2.9 Team Members No public information is provided about CTIR Gov members. 2.10 Other Information For additional information about how to contact CTIR Gov, see: https://www.gov.br/ctir/en/service_channels/contact-info. Links to alerts and recommendations can be found at: https://www.gov.br/ctir/pt-br/assuntos/alertas-e-recomendacoes 2.11 Points of Customer Contact The preferred method for contacting the CTIR Gov for administrative matters is via email at contato@ctir.gov.br. CTIR Gov operates from Monday through Friday, from 09:00 to 19:00, GMT-0300. 3. Charter 3.1 Mission Statement Cyber Incident Prevention, Handling and Response Center of Brazilian Government (CTIR Gov) coordinates responses to cyber security incidents related to networks belonging to the Brazilian Federal Public Administration. 3.2 Constituency Networks belonging to the Brazilian Federal Public Administration. 3.3 Sponsorship and/or Affiliation CTIR Gov was formally created in 2006, by initiative of the Brazilian Government through Institutional Security Office (GSI). GSI is the executive cabinet office of the federal government of Brazil that is responsible for national security and defense policy. The activities performed by CTIR Gov are in accordance to the Secretary of Information Security and Cybernetics of GSI attributions, as defined in the Presidential Decree 10748 [1], from 2021: I - to coordinate the activities of the cyber incident prevention, treatment and response teams of the members of the Federal Cyber Incident Management Network related to the prevention, treatment and response to cyber incidents; II - articulate with the Government ETIR for prevention, treatment and response referred to in item I, using a dedicated computational platform to coordinate them; III - to create, update and publish the cyber incident management plan for agencies and entities of the Federal Public Administration; IV - to establish a working relationship with related agencies from other countries; V - to seek international cooperation, with an emphasis on sharing information about cyber threats, vulnerability and incidents; VI - to share alerts, recommendations and statistics related to cyber incidents to members of the Federal Cyber Incident Management Network; and VII - to keep updated the website of the CTIR Gov with alerts, recommendations and statistics about cyber incidents. Reference (in Portuguese): [1] http://www.planalto.gov.br/ccivil_03/_Ato2019-2022/2021/Decreto/D10748.htm 3.4 Authority CTIR Gov has no authority over its constituency. All activities are based on collaborative relationships with other entities. 4. Policies 4.1 Types of incidents and level of support CTIR Gov provides a single point for Brazilian Government incident notification, providing the coordination for organizations involved in incidents, including: Support in the analysis of compromised systems and in their recovery process; Establish collaborative relationships with other entities, such as other CSIRTs, universities, Internet service and access providers and telecommunication companies; Maintain public statistics of incidents handled; CTIR Gov is also committed to keeping its constituency informed of new trends and threats through alerts, recommendations and mailing list. 4.2 Co-operation, interaction and disclosure of information CTIR Gov treats all information as confidential by default, but will use the information shared to help solve security incidents. Information might be distributed forward to other teams/organizations on a need-to-know basis. Information will be anonymised whenever it is feasible. CTIR Gov adheres to the Information Sharing Traffic Light Protocol according to the FIRST Standard Definitions and Usage Guidance: https://www.first.org/tlp/docs/v2/tlp-pt-br.pdf. Information that is labelled with the tags WHITE, GREEN, AMBER, AMBER+STRICT or RED will be handled appropriately (see: https://www.gov.br/ctir/pt-br/assuntos/tlp). 4.3 Communication and authentication For normal communication not containing sensitive information CTIR Gov uses conventional methods like unencrypted e-mail. Please refer to sections 2.7. For sensitive information, the use of PGP encryption is strongly encouraged (see section 2.8). If it is necessary to authenticate a person before communicating, this can be done either through other methods like call-back, mail-back or even face-to-face meeting if necessary. 5. Services 5.1 Incident response CTIR Gov will provide assistance to other teams in handling the technical and organizational aspects of incidents related to networks belonging to the Brazilian Federal Public Administration. 5.1.1 Incident triage CTIR Gov will help to validate the incident, as well as to assess it, does the correlation and prioritise it. 5.1.2 Incident coordination The most valuable service we can provide is to act as an coordinator, which knows where to send the right incident reports to in order to help and facilitate the resolution of security incidents. The CTIR Gov encourages all teams to directly contact the most specific CSIRT or security team as possible, and to maintain CTIR Gov in the copy of the communication. CTIR Gov will then: Determine if all involved organizations where contacted and if any additional contact needs to be made; Facilitate contact to other parties which can help resolve the incident; and If any help is needed, it will contact the involved organizations to help them to take the appropriate steps. Due to staffing constraints, we can not guarantee we can reply to all incident notifications received. If the incident has already been submitted to ctir@ctir.gov.br, CTIR Gov will register the incident for statistical purposes, but it might not send any reply. If you haven't received any feedback to a notification but need any further action by CTIR Gov staff, please contact us again, clearly indicating the type of help needed. 5.1.3 Incident resolution As CTIR Gov is a coordinating team, this means we do not have any authority to enforce the request of takedowns, shutdowns or any other specific action. To the best of our ability we will: Advise local security teams and system administrator on appropriate actions; Identify any new type of incident that could require the dissemination of best practices for prevention of future incidents; and Collect and publicly disclose statistics on incidents and trends, as a way to gain situational awareness for the GSI. 5.2 Proactive activities CTIR Gov promote prevention actions in order to assist the constituency to handling better cyber incidents. In that context, the following initiatives are executed: Validation and notification of vulnerabilities; Publication of relevant knowledge as Alerts, Recommendations and Mailing List; and Statistical analysis. 6. Incident reporting forms There are no forms available. Please refer to section 2.7. 7. Disclaimers While every precaution is taken in the preparation of information and notifications, CTIR Gov assumes no responsibility for errors or omissions, or for damages resulting from the use of the information provided. -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEK77LSew61P5cTZ/5vQ8v8CIb/3gFAmaj4bwACgkQvQ8v8CIb /3hMYA/9GINFFBYtJLVK6nDdnOPJZrOsOTxlJaj3OGO+iWlqi1ebokdAc6IafpRb Px+tSb+Tv5qtTdSMgrJ7tfqfdUu8InJ7wE3YqeBbYUEPdvy7lxsfPaJpXWmwUHi1 0vGtak3nV0lKlkHVJgourmYCuBQ8DcBCnG0Va1DCLtht5uCoKGpHoVtZiQt4H3ia PLLIMalt3lDNIDzCoApVD7arl7oi8ONYvcWqF/u6+B72y21LVHylCEOQAVtJ/mdw CFIrF9hbVBcxKHYJdu5Fcne2N2vNjUR5ufcIvLkTZ9co2PeamQOWrJbvQVT44u0F e8pK5TXXFcis143JW3Xed4uUWO8gRqVxjCXXYq7MXixbc3OpKWDHU8pWoHMrG0Vw g27ka7oBfD/NjkMRkWHGpJTd96mFVeSTgWCEYe824nEUWvK7ehbiNEGhaWRsVdvL 0Gh1g6JwjF4lRj6hRNC9mZjkoc6VeLOyYmjp+4E1ostW9Sq0TZC7xIHi+GK+/0Yj 1YdxuS33zvBmRSjoyjElpXN6t4lg0KJIMqZrp+wKYuaG+GZUE/sAH5VPyxudmX1x YHARGSRdV420zjmzXYG1vtME8HxOjfK/lUbKze3pm0VDhE2xerLkC0Fp+i33CmTe SaURf09gHdP7ErzsDow/Cq4R7h9peBpw/s7suVLFAas4/f0CvRQ= =dulK -----END PGP SIGNATURE-----