The Use of Public Data and Free Tools in National CSIRTs' Operational Practices: A Systematic Literature Review

TL;DR

This systematic literature review examines how national CSIRTs utilize and perceive public data and free tools in incident response, revealing significant gaps in understanding and emphasizing the need for more empirical research to enhance operational effectiveness.

Contribution

The paper provides a comprehensive synthesis of existing research and reports on the limited understanding of national CSIRTs' perceptions and use of public data and free tools.

Findings

Most discussions are incomplete or fragmented.

Lack of insights into staff perceptions of usefulness.

Highlights need for more empirical studies.

Abstract

Many CSIRTs, including national CSIRTs, routinely use public data, including open-source intelligence (OSINT) and free tools, which include open-source tools in their work. However, we observed a lack of public information and systematic discussions regarding how national CSIRTs use and perceive public data and free tools in their operational practices. Therefore, this paper provides a systematic literature review (SLR) to comprehensively understand how national CSIRTs use and perceive public data and free tools in facilitating incident responses in operations. Our SLR method followed a three-stage approach: 1) a systematic search to identify relevant publications from websites of pertinent CSIRT organisations, 2) a conventional SLR into the research literature, and 3) synthesise data from stages one and two to answer the research questions. In the first stage, we searched the websites of 100 national CSIRTs and 11 cross-CSIRT organisations to identify relevant information about national CSIRTs. In the second stage, we searched a scientific database (Scopus) to identify relevant research papers. Our primary finding from the SLR is that most discussions concerning public data and free tools by national CSIRTs are incomplete, ad hoc, or fragmented. We discovered a lack of discussions on how the staff of national CSIRTs perceive the usefulness of public data and free tools to facilitate incident responses. Such gaps can prevent us from understanding how national CSIRTs can benefit from public data and free tools and how other organisations, individuals and researchers can help by providing such data and tools to improve national CSIRTs' operation. These findings call for more empirical research on how national CSIRTs use and perceive public data and free tools to improve the overall incident responses at national CSIRTs and other incident response organisations.