Answers to common questions submitted to KUTIM-CSIRT about reporting and handling cyber incidents.
TLP:CLEAR · 56 views
A CSIRT (Computer Security Incident Response Team) is a cyber incident response team tasked with preventing, receiving, analyzing, and responding to cyber security incidents within an organization. KUTIM-CSIRT is the cyber incident response team of the East Kutai Regency Government.
KUTIM-CSIRT was established by East Kutai Regent Decree No. 555/K.557/2024 on the Establishment of the Kutai Timur Computer Security Incident Response Team (KUTIM-CSIRT), issued on 17 September 2024. Its establishment is also based on Presidential Regulation No. 95 of 2018 on Electronic-Based Government Systems (SPBE) and BSSN (National Cyber and Crypto Agency) Regulation No. 1 of 2024 on Cyber Incident Management. Full details of the legal basis are available on the Profile page.
A cyber security incident is an event that disrupts or may disrupt the confidentiality, integrity, or availability of electronic systems and information. Examples include website hacking (defacement), data leaks, malware or ransomware infections, phishing attacks, unauthorized access, and service disruption (denial of service).
Reports can be submitted by all regional government agencies and civil servants of the East Kutai Regency Government. Members of the public may also submit information about suspected incidents involving electronic systems owned by the East Kutai Regency Government (the *.kutaitimurkab.go.id domain).
Incidents can be reported by email to csirt@kutaitimurkab.go.id or through the reporting channel on the KUTIM-CSIRT website. Include as much information as possible, such as the time of the event, the affected systems, a description of the incident, and supporting evidence so that it can be handled more quickly.
Please include the reporter's identity and contact details, the date and time of the incident, the affected systems or assets (IP address, domain, or URL), a description of the symptoms or impact, supporting evidence such as screenshots or log files, and any actions already taken.
Incoming reports are reviewed and triaged on working days. Response times depend on the severity and impact of the incident. High-impact incidents are prioritized for handling as soon as possible, while other reports are followed up in turn.
Yes. KUTIM-CSIRT keeps information received from reporters confidential. Information is shared only with parties concerned with handling the incident, in accordance with personal data protection provisions and applicable laws and regulations.
No. All KUTIM-CSIRT services for constituents within the East Kutai Regency Government are free of charge.
Avoid making excessive changes to the affected system so that evidence remains intact for analysis. If possible, isolate the system from the network, document the observed symptoms, and avoid shutting down devices unless instructed by the team, so that digital artifacts can still be analyzed.
KUTIM-CSIRT does not handle non-security technical issues (such as hardware failures or routine application maintenance), general IT support requests, or incidents on systems outside its constituency and the *.kutaitimurkab.go.id domain. KUTIM-CSIRT is also not a law enforcement agency; legal action falls under the authority of the competent institutions.
A security advisory is an official notice about a vulnerability or threat together with mitigation recommendations, while a security bulletin contains information on threat trends and security practices. Both are published by KUTIM-CSIRT to help constituents strengthen the security of their electronic systems.
KUTIM-CSIRT is part of the national cyber incident response ecosystem and coordinates with Gov-CSIRT Indonesia under the National Cyber and Crypto Agency (BSSN), particularly in handling wide-impact incidents and exchanging threat information.
Contact KUTIM-CSIRT through our official channels.