What's changed: Initial version
3.3Incident response and organizations
Covers the division of roles between CSIRT, which handles incidents within an organization, and SOC, which handles monitoring and detection; the flow of incident handling from detection to reporting (including triage); the roles of Japan's core organizations JPCERT/CC, NISC, and IPA; the bug bounty vulnerability-reward program; and inter-organization information-sharing frameworks such as J-CSIP.
No matter how thoroughly controls are built out, incidents cannot be reduced to zero. What matters is how quickly an incident is noticed, how correctly it is prioritized, and how much the damage is minimized. This section covers the functions of the CSIRT and SOC that carry out this role within an organization, the actual flow of incident response, and coordination with Japan's information-security-related organizations. In particular, the judgment involved in triage (prioritization) is one of the most heavily tested practical skills for a Registered Information Security Specialist.
3.3.1The division of roles between CSIRT and SOC
- A CSIRT (Computer Security Incident Response Team) is the team that handles the actual response to security incidents within an organization—receiving reports, triaging, investigating, restoring service, and devising recurrence-prevention measures. It also functions as a coordination point with legal, public relations, and management, not just the technical department.
- A SOC (Security Operation Center) is a function or organization specialized in monitoring and detecting logs and alerts around the clock, every day. When a SOC detects an anomaly using tools such as a SIEM, it typically hands that information off to the CSIRT, which owns the actual response (incident response)—a division of labor between monitoring and response that is the typical arrangement.
3.3.2Incident handling and triage
- The typical flow of incident handling is: (1) detection (via SOC monitoring, a user report, etc.), (2) triage intake (the CSIRT receives and logs the initial information), (3) triage (assessing the urgency and importance of multiple candidate incidents to decide the order of response), (4) incident response (containment, eradication, recovery), and (5) reporting (to management, stakeholders, and external bodies if required).
- The criteria for triage combine the scope of impact (how many items, which assets), severity (leakage of confidential data versus a mere anomalous access attempt), and the speed of escalation (how quickly damage would spread if left unaddressed), to prioritize assigning limited personnel to the most urgent and important cases first. It is important that this is not simply "first come, first served."
Most-tested: the division of labor "SOC = monitoring/detection" versus "CSIRT = the actual response", and "triage = prioritization combining scope of impact, severity, and speed of escalation." Expect scenario-based questions asking "which should be handled first when multiple alerts arrive simultaneously," testing the soundness of a judgment such as prioritizing a suspected confidential-data leak over a routine anomalous access attempt.
Suppose a company's CSIRT member, on the night shift, receives three alerts simultaneously: (1) repeated failed login attempts against an internal business system (no account lockout has occurred yet), (2) a large data transfer from the customer database server outside normal business hours (a communication pattern never seen before), and (3) defacement of an internal wiki page (a minor, typo-level change containing no confidential information). Deciding which to tackle first with limited overnight staff follows triage criteria. Alert (2) involves the possibility that highly confidential customer personal data is leaking externally in an unusual pattern, and scores high on scope of impact (many customers), severity (personal-data leakage), and speed of escalation (the transfer is happening right now)—it is the incident that must be contained first (e.g., cutting off the server's network communication). Alert (1) has ongoing login attempts but has not yet resulted in a lockout, meaning damage has not yet materialized, so it is the next priority: strengthen monitoring in parallel with handling (2), and address it once (2) is under control. Alert (3) involves only a minor change containing no confidential information, so it can be judged as sufficient to handle during the next business day rather than as an overnight emergency. Triage is thus not "first come, first served" but a decision that weighs the actual harm to confidentiality/integrity/availability against how much the damage would grow if response were delayed, to allocate limited resources to the most urgent case first.
| Organization | Role |
|---|---|
| CSIRT | Handles the actual incident response within the organization (intake, triage, investigation, recovery) |
| SOC | Specialized in round-the-clock monitoring and detection |
| JPCERT/CC | Japan's coordinating body for information security incident response (including cross-border coordination) |
| NISC | The command center for government information security policy (National center of Incident readiness and Strategy for Cybersecurity) |
| IPA | Awareness raising, vulnerability report intake, and human resource development for information security |
3.3.3Bug bounty programs and information sharing
- A bug bounty program is a scheme where an organization pays a reward to external researchers who discover vulnerabilities in its own products or services. The aim is to leverage outside expertise to find and fix vulnerabilities early that internal resources alone might miss.
- J-CSIP (the Initiative for Cyber Security Information sharing Partnership of Japan) is a framework operated by IPA for sharing information about cyberattacks among companies related to critical infrastructure. Sharing one company's incident information within the industry aims to prevent similar attacks from harming other companies.
Trap: "the SOC also carries out incident recovery work" is wrong—the SOC's primary function is monitoring and detection; the actual response (containment, eradication, recovery) is the CSIRT's role (some organizations combine the two functions, but they remain functionally distinct). Also wrong: "triage means responding to reports in the order received"—triage is prioritization based on assessing scope of impact, severity, and speed of escalation.
3.3.4Section summary
- SOC specializes in monitoring/detection, and CSIRT handles intake, triage, response, and recovery. Handing off from SOC to CSIRT after detection is typical
- Triage is prioritization combining scope of impact, severity, and speed of escalation (not order of receipt)
- Japan's organizations have distinct roles: JPCERT/CC (coordination), NISC (government policy), and IPA (awareness, report intake). Bug bounty programs and J-CSIP are mechanisms for leveraging external expertise and inter-industry information sharing
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. During the night shift, a CSIRT member simultaneously receives an alert about a large data transfer from the customer database server to the outside during off-hours, and an alert about a minor defacement of an internal wiki page (no confidential information involved). With limited staff, which response should be taken up first?
Q2. Which statement about the division of roles between the SOC and the CSIRT is most appropriate?
Q3. A company believes it cannot find all vulnerabilities in its own product using internal resources alone, and wants to introduce a program that pays external researchers to discover and report vulnerabilities. What is this program called?