CSIRT

1.1 Last updated
2026/01/19

1.2 Distribution list for notifications
There is no distribution channel to notify changes to this document.
Updates to this document will be visible in the place specified in the article 1.3.

1.3 Access to this document
The updated version of this document is available at https://www.upt.pt/csirt/rfc2350-en.txt
The Portuguese language version is available at https://www.upt.pt/csirt/rfc2350-pt.txt

1.4 Authenticity of this document
Both the Portuguese and English versions of this document have been signed with the CSIRT-UPT’s PGP key.
The signatures are also on our website, under:

https://www.upt.pt/csirt/rfc2350-en.txt.asc
https://www.upt.pt/csirt/rfc2350-pt.txt.asc

2.1 Name of the team
UPT-CSIRT

2.2 Address
Portucalense University I-D.H.
Rua Dr. António Bernardino de Almeida, 541
4200-072 Porto
Portugal

2.3 Time zone
Portugal/WEST (GMT+0, GMT+1 in day-light saving time)

2.4 Telephone number
+351 225 572 000

2.5 Facsimile number
None.

2.6 Other telecommunication
None.

2.7 Electronic mail address
Electronic mail address to notify about computer security information incidents:
csirt@upt.pt
Electronic mail address for IT support:
helpdesk@upt.pt
Electronic mail address for other issues:
info@upt.pt

2.8 Public keys and encryption information
PGP Key ID: 632C31E9
PGP Fingerprint: 9ECA 80BD FA33 6D2A 7E83 1516 FE78 C8F9 632C 31E9
The key is available at https://www.upt.pt/csirt/pgp-csirt.asc

2.9 Team members
Members: Paulo Almeida, José Soares

2.10 Other information
More information about UPT-CSIRT can be found at https://www.upt.pt/csirt/info

2.11 User contact means
The preferred method for contacting UPT-CSIRT is via e-mail as described in sections 2.7 using the template shown in section 6.

3.1 Mission statement
The purpose of UPT-CSIRT is to allow Portucalense University to coordinate security efforts and incident response for IT-security problems.

3.2 Constituency
UPT-CSIRT coordinates responses to cybersecurity incidents that involve any entity within Portucalense University, including devices belonging to a network or address allocated exclusively to Portucalense University.

3.3 Affiliation
UPT-CSIRT is a service of the Portucalense University. UPT-CSIRT keeps a close coordination with RCTS CERT (https://www.fccn.pt/seguranca/rcts-cert/).

3.4 Authority
UPT-CSIRT authority is defined by the DSI Director of Portucalense University.
UPT-CSIRT hopes to collaborate with the various IT departments of all university. In case of lack of answer in an acceptable time, and if the incident requires, restriction or blocking of connectivity may occur.

4.1 Incident types and support level
UPT-CSIRT handles all types of cybersecurity incidents, categorized in the following types:

1. Malicious codeli>
2. Availability
3. Information Collection
4. Intrusion Attempt
5. Intrusion
6. Information security
7. Fraud
8. Abusive Content
9. Vulnerable
10. Other

The level of support given by UPT-CSIRT varies depending on the type, severity and scope of ongoing incidents and the resources available for its treatment.

4.2 Cooperation, interaction and privacy policy
UPT-CSIRT privacy policy and data protection establishes that sensitive information can be sent to third parties, only and exclusively on a real need basis, with the exception of judicial entities.
Information that is not confidential will be used for statistical ends, which can be disclosed to other entities.

4.3 Communication and authentication
For normal communication not containing sensitive information UPT-CSIRT, phone and non-ciphered e-mail are considered to be sufficient for non-sensitive information transmission. In order to transmit sensitive information, PGP usage is mandatory.

5.1 Coordination of security incidents
UPT-CSIRT will coordinate a response to a security incident between the interested/affected parties. This coordination typically will involve the asset owner or the team responsible for the involved network segment. The handled incident can start by UPT-CSIRT initiative, for example a large-scale incident, or can be started by other designated means. Auto-generated reports and data-feeds will be handled as automatically as possible.
This incident coordination includes:

5.1.1 Incident triage

1. Determining whether an incident is authentic if possible;
2.  Determine the involved entities;
3. Assessing and prioritizing the incident.
   5.1.2 Incident coordination
   1) Contact the involved entities to investigate the incident and take the appropriate steps
   2) Facilitate contact to other parties which can help resolve the incident
   3) Send response to other CSIRTs or original requester.

5.1.2 Articulação com outras entidades

1. Contato com as partes envolvidas para que procedam à investigação do incidente em questão e que sejam tomados os passos apropriados.
2. Contatos com outras partes que possam ajudar à resolução do incidente.
3. Envio de relatórios a outras equipas de CSIRT.
   O UPT-CSIRT funciona como central, tendo a capacidade de encaminhar os incidentes para o destinatário correto com o intuito de ajudar e facilitar a resolução de incidentes de segurança.

UPT-CSIRT works as an information hub which knows where to send the right incident reports to in order to help and facilitate the resolution of IT security incidents.

5.1.3 Incident resolution
UPT-CSIRT follows up on the progress of the concerned local security teams.
In case an incident is not solved in a timely manner, UPT-CSIRT can initiate the process to restrict connectivity in case of necessity and/or analyze involved assets.
UPT-CSIRT will also collect statistics about incidents.

5.2. Proactive activities
UPT-CSIRT coordinates and maintains the following services:

1. Risk analysis
2. Security audits
3. Dissemination of alerts;
4. Configuration and maintenance of security tools;
5. Intrusion detection analysis;
6. Dissemination of information related to security.
7. Internal vulnerability checking.

UPT-CSIRT does not carry out the abovementioned mitigation or resolution measures. This responsibility lies with each person responsible for the affected asset.
O UPT-CSIRT não executa as medidas de mitigação ou de resolução atrás referidas. Esta responsabilidade é de cada uma das pessoas responsáveis pelo ativo afetado.