CSIRT.ID – Cyber Security Independent Resilience Team of Indonesia.

MULA by Galeria
Jl. TB Simatupang kav.17
Cilandak Townsquare
Jakarta 14320 - Indonesia

• We are located in Asia, Jakarta - Indonesia Western Time that is UTC +07:00.
• No daylight saving time. UTC is considered similar to GMT.
• Indonesia time format is HH:MM:SS in 24 hours notation – without AM/PM.

Time reference host:

• server 0.id.pool.ntp.org
• server 1.id.pool.ntp.org
• server 2.id.pool.ntp.org
• server 3.id.pool.ntp.org

+62 21 7592 0274

+62 21 7592 0274

Instant Messaging, Voice and Video Conferencing uses Telegram ID @CSIRTID

• Please send incident related reports to incident [at] csirt.id
• Non-incident related mail should be addressed to info [at] csirt.id

CSIRT.ID uses this address team [at] csirt.id and signed with PGP key :
Fingerprint : D5CA DABB 4D14 BB8B AD9D 3566 0B68 6DD1 88BC 57EB

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1

mQENBF8qgBgBCAC4Vtr+azgDedHUlQcwCCEBVrEW+6V1fVyxcJn3FQq+DgvJEGIy9h9fri59dEqFONrAeD9xA0iIxcx6a5/aafNrIibcFs4N69/8hlNB8uBPZJNjXNa5Aa06dCimB2rcR8aNg5g2q0FxDAbDFAV1Dr4bJGDq/vdr/sf+vWsL0sos+v4GALwxNx3aovD3NwKPIF+dJCPZIebIQPrhieJmc3BnUJzY2Cxi+wnYoRBck+C10x2vUd98oXCuJ3ckRI25+Ls+E3S1RO7KfPsPbj/tyAFJhs5fS7zG1ZwR/p1H+4cdhUUtX1xolDjcvLcX7Ux9Bf4eAej8NfNDoANcz7w1ycqJABEBAAG0JyJDU0lSVC5JRCBUZWFtIE1lbWJlcnMiIDx0ZWFtQGNzaXJ0LmlkPokBNQQQAQgAHwUCXyqAGAYLCQcIAwIEFQgKAgMWAgECGQECGwMCHgEACgkQC2ht0Yi8V+vQBQgArIIEDsV2IqdkdBAsq03J8+NHtMLqFknidr7hcLmMIqfETO4sYX9+xB2YNBWmRMWaEDkAdS4IhUlLA1R283N9nCNbY2wn47iiqcjE7reG1IpDIc4M08XcgrImtwW+2PfkvsnpruUy3ZzTv1bbUoJO7IwWjGWjVJkl43AZt4IFqQGeKg/4Mvbk4xr/iLScXOJZDoc5PEdN0PdWz4A8yqJ40rBJOMmbur+9cLnFx13hEmBhaTSkYNpIzO4p71gwKaJNR8KzlKF4yWBU36rJNCqA7zPVOxv4NT1tIXLFyVMiKRDi9ZTii6cxbO4UBZ5DcmgdGuabJ1zmmW6jSsscYEGx0LkBDQRfKoAYAQgAzS/8BfHTn6iK5eL5WxfGlwU76xxYj8VFQehIF74b+6DO7QPX/qEvO6Pv9i5xzOAmhaITbblUCqalA7TTFwgr87p4Ed4bnQEiv67m5XMZKBnh8c/tmDeTr91w/X3XAHNcupmDdPZPO1N9wPzfiRqaJy8W6Af/gbaY4yh7NNi1r8ora3jxT8A4MdJzvqCJ+ukfrqpRggFruy2AxZUAfc3WVPZh+5h/6QftldFlepdrLHFcQz8+aQKwKWhhjBAWxawlilmSGTF6iyBSJrhJk7ay/1e0SjE3f7Qf96egJ2XDrGjuM/HA91xW+u2PZ46wXVWm9QaDF8yqNfjQmpvsBeH8KQARAQABiQEfBBgBCAAJBQJfKoAYAhsMAAoJEAtobdGIvFfrjFwH/0p5fMCiXUpG53VGQlSYD426slMnTGkuKssomjlJSa1AhBDnGXsg1MeIf6IusMBy04qfy6SGhw4JZ2qtvt72YmCnJBrUaELN2Ui7QfKdbOcWMuTE+81QTTSDm6aEjrmzLSgzxBwZxA6ISUyr8ZgNU2fSYfHcq+YYENR7fQ23GGBt9oXHbdd9u+NUTqPLewOogVtEoVqmIXzrWnhHc+MMcr/gRTrSt2CHHz4UnWwm0wE/r5jnLZebsDdtJfghYnNoPRusfPmModvoU56lJFvpJH3T+ms0APYTT5Mn0+NHb/EPlcG31XJXHAg0jdjBz5OFeIKwVlw/H85mX072ZphsCAY==Gvj5
-----END PGP PUBLIC KEY BLOCK-----

Encrypted communications should use this – and only this – operational key.
All PGP keys (including the keys of individual team members) can be found at:
https://csirt.id/about-us/signature/

• Mr. Rudi Lumanto, Ph.D, as Chairman of CSIRT.ID
• Mr. Muhammad Salahuddien, as Deputy of Operation
• Mr. Dr. Bisyron Wahyudi, as Deputy of CIP and Resilience
• Mr. Dr. Muhammad Salman, as Deputy of Interagency Collaboration

Liaison is provided by the Department of Interagency Collaboration of CSIRT.ID.

None.

A preferred method to contact CSIRT.ID is through e-mail. For incident reports and related issues, please directly use incident [at] csirt.id. This procedure will create a ticket number in our tracking system and will alert officer on duty.

For general inquiries please send e-mail to info [at] csirt.id

If it is not possible to use e-mail – or advisable due to security reasons, you can contact or reach us through fixed-line – telephone and facsimile at +62 21 7592 0274.

CSIRT.ID`s operation is generally restricted to regular business hours:

• From 8:00 a.m. to 5:00 p.m. that is UTC +07:00
• Asia, Jakarta – Indonesia Western Time
• Monday through Friday, excluding National Holiday.

Note that: we will response ONLY DURING THESE HOURS.

We did not provide IVR (Interactive Voice Response) System and no recording for any communication by phone, and staffs are only available during office hours. So, please consider time differences between your area and ours, thus eliminating the possibility of a wasted call.

Otherwise, please use email and or our online incident reporting form (for members).

CSIRT.ID is a non-government initiative and independent cybersecurity incident response team association was formed by professionals, expert, and academia to assist communities and private sector in Indonesia to proactively contributing and strengthening national cybersecurity and resilience.

CSIRT.ID constituencies are:

• ICT Community, which is IT-security teams, professionals, and academia.
• Local CSIRT’s in Indonesia, especially the private sectors and non-government.
• Internet Core Infrastructure owners, which are Network Access Provider (NAP), Internet Service Provider (ISP), Internet Exchange and Data Center Operator (LEO), others Critical Infrastructure operators related to Cyber Security resilience.

For awareness purposes, pro-active educational material will be provided to the constituencies, and the general public as well.

CSIRT.ID founders: see 2.9 and former ID-SIRTII/CC members and staff.

CSIRT.ID co-founders are not mentioned directly due to some exceptions and restrictions reason. Including individual experts, academia, other Non-Government Agencies.

CSIRT.ID is not registered in any regional organization or initiatives membership yet, and no sponsors and affiliations available as at present time.

CSIRT.ID is an independent organization. Which means, it is fully funded by private donors and membership. We did not perform any kind of government function and services, particularly or in general.

Our accountability and responsibility are to the constituencies.

CSIRT.ID`s main purpose is to help coordination amongst local incident response initiatives to handle any kind of incidents at constituency level based on terms and conditions within NDA. This includes communication with counterparts and initiates collaboration as needed. In such, we only advise constituencies to take immediate action. WE DO NOT MITIGATE AND REMEDIATE directly since we do not have direct authority to its network and so on.

We did not have any authority over internet infrastructure yet.

CSIRT.ID is authorized to address any kind of cybersecurity incidents, which occur or threaten our constituency (see section 3.2 Constituency) and its cyber strategic interest, in which required cross-organizational coordination, especially amongst members at constituency level. We will impose any precaution action needed and committed to keeping our constituency informed to any potential vulnerability.

The level of support given by CSIRT.ID will vary depending on the type and severity of the incident or issues that occurred, type of constituent, size of user or community affected, and the availability of CSIRT.ID`s resources. Special attention will be given to an event that is directly affecting members and constituency's critical infrastructure.

Please note that NO DIRECT SUPPORT WILL BE GIVEN TO END USERS. They are expected to contact their local CSIRT or security team (if any), or system administrator, network administrator and department head for assistance.

CSIRT.ID cooperates with other organizations in the field of cybersecurity resilience and Internet infrastructure. Those engagements often require data or information exchange regarding incidents and issues. Nevertheless CSIRT.ID committed to protect the privacy of its constituency and therefore (under normal circumstances) only pass on limited and anonymized information to other parties, unless some contractual agreements apply, for example, Non-Disclosure Agreement (NDA).

We operate under restrictions imposed by applicable Indonesian law regarding information classifications and protection. This involves handling procedures of personal data as required by the Indonesian Data Protection law, but it is may be forced to disclose such information due to LEA investigation or by court`s order.

For usual communication, not containing sensitive information, CSIRT.ID will use conventional methods like unencrypted e-mail or facsimile.

For secure communication, PGP-Encrypted e-mail or telephone/fax will be used. If it is necessary to authenticate a person before communicating, this can be done either through existing peers of trust (e.g. FIRST, APCERT, OIC-CERT, others recognized CERT/CSIRT teams) or by other methods like a callback, mail-back or even face-to-face meeting if necessary.

We response the incidents through (online) public reporting procedures, which are:

• Conducting cybersecurity research and development and collaboration program through various activities: e.g. Digital Forensic, Malware Analysis, Network Security, Data Mining, Honey Net, etc.
• Providing security-related information, alert and advisory to general public based on related incident reports, actual monitoring events, and research analysis results.
• Providing advisories, consultancy, clinic, technical assistance to strategic institutions and agencies (upon request or as mandated by regulation).
• Conducting Threat Visibility and Information Sharing Center for constituencies – to detect and prevent major disruption.
• Conducting Coordination Center (CC) only at the constituency level. Liaison provided as a Single Point of Contact temporarily for constituencies if needed (upon request).
• Organized socialization program and other related events to raise public awaren ess and to the constituencies, related parties. Including providing cybersecurity training, seminars, and cyber competition regularly.