This training material is an updated version of the ENISA training material Aspects of Cooperation between CSIRT and LE - Toolset, Document for trainees, that was developed based particularly on the ENISA 2020 Report on CSIRT-LE Cooperation - A study of the roles and synergies among selected EU MS/EFTA countries (an updated and expanded version of it is expected to be published in Q1 2022). Some of the 2020 report's conclusions are that, in terms of incident response and cybercrime, the position and role of the Computer Security Incident Response Teams (CSIRTs) and Law Enforcement (LE) in the national institutional framework varies from country to country. Similarly, the structure and the organisation of the Judiciary also depends on the country. In addition, between the three communities - CSIRTs, LE and Judiciary - different approaches and different levels of cooperation exist. While the operational cooperation, especially in the daily interactions and informal communication, seems to be well-established, sometimes it seems that more structured cooperation could be achieved to have less fragmented information flow between the three communities. Also, there is a more significant gap in the interaction between CSIRTs and the Judiciary, compared to the cooperation established between LE and the Judiciary. CSIRTs would rather often interact with the Judiciary in case they are called as an expert witness in court. Moreover, LE is not solely involved in the detection and investigation of cybercrimes. A key component of their role is the preventive aspects of cybercrime, and it is in this role that cooperation with other communities, particularly the CSIRT community, becomes apparent to support preventive strategies. Preventive aspects of incidents/cybercrimes can also be seen as the initial ground for establishing cooperation between the CSIRTs and the LE communities, which can then extend to other phases of the incident/crime investigation. On the other hand, CSIRTs play an important role in informing (potential) victims of cybercrime and providing them with information on how to report a crime to the Police. CSIRT and LE communities also need to closely cooperate to mitigate the risks of having evidence compromised or destroyed. Regarding the incident handling and cybercrime investigation, several competences are required. While each community has developed its own set of skills and knowledge, they can all benefit from the competences of the other communities. Furthermore, the 2020 report on CSIRT and LE cooperation also concluded that despite the initiatives that are already in place to facilitate training within each community, or joint trainings engaging two communities (e.g. CSIRTs and LE, or LE and the Judiciary), it seems that there is a need for more training and exercises addressing the three communities together.
