CERT-GH RFC 2350 Profile
1. Document Information
This document complies with RFC 2350.
1.1. Date of Last Update
This is version 2.0 as of October 2, 2021.
1.2. Distribution List for Notifications
CERT-GH will not plan frequent modifications to this document, thus see section 1.3 for the download location
1.3. Locations where this Document May Be Found
The current version of this profile is available at https://www.csa.gov.gh
2. Contact Information
2.1. Name of the Team
Full name: Ghana National Computer Emergency Response Team
Short name: CERT-GH
2.2. Address
CERT-GH
3rd Floor, NCA Tower,
6 Airport By-pass Road
Accra
Ghana
Digital Address: GL-126-7029
2.3. Time Zone
CERT-GH provides 24-hour incident response service.
3rd Floor, NCA Tower.
Greenwich Meantime (GMT).
2.4. Telephone Number
CERT-GH emergency local mobile: +233 (303) 972531
CERT-GH emergency international mobile: +233 (303) 972530
2.5. Facsimile Number
Not applicable.
2.6. Other Telecommunication
Not applicable.
2.7. Electronic Mail Address
Report cybersecurity incidents to report [@t] csa.gov.gh
2.8. Public Keys and Encryption Information
CERT–GH has a PGP key with fingerprint: 0A3E 73BC 0A1B 8B12 9F3C 8AB7 46D2 76A4 AD38 7498
2.9. Team Members
Information about team members is available upon request.
2.10. Other Information
For additional information about CERT-GH, visit
https://csa.gov.gh/cert
2.11. Points of Customer Contact
E-mail: info@csa.gov.gh
Phone: 0503 185 846
Online form: https://csa.gov.gh/report
SMS Shortcode: 292 (Ghana Only)
Cyber Security Authority (CSA-Gh) Mobile App (Android and iOS)
3. Charter
3.1. Mission Statement
CERT-GH provides information and assistance to its constituents for implementing proactive measures to reduce the risks of computer security incidents. It also provides reactive services when cyber-attacks occur to reduce their impact. Finally, it builds capacity and training on incident management to its constituents.
3.2. Constituency
Sectorial CERTS (National Security, Financial, Telecommunication, Education, Government, Military, Business, Industrial & Commercial Systems (ICS))
General Public
3.3. Sponsorship and/or Affiliation
CERT-GH is a unit under the Cyber Security Authority of the Ministry of Communications and Digitalisation
CERT-GH is affiliated to Council of Europe (GLACY+), UNICEF, Ghana-US Cooperation (SGI), Microsoft
CERT-GH is also a member state of the Budapest Convention (Convention on Cybercrime).
3.4. Authority
CERT-GH has the authority to oversee and make recommendations regarding cybersecurity events and incident mitigation. CERT-GH will execute its duties as outlined within the scope of its charter, informed by applicable laws, regulations, directives, and additional assignments as indicated by the Cyber Security Advisor.
4. Policies
Policies are currently under review
4.1. Types of Incidents and Level of Support
All incidents are considered normal priority unless they are labeled EMERGENCY.
4.2. Cooperation, Interaction, and Disclosure of Information
All incoming information is handled confidentially by CERT-GH, regardless of its priority.
When reporting a sensitive incident, please state so explicitly (for example, by using the label SENSITIVE in the subject field of email) and, if possible, use encryption as well.
CERT-GH supports the Information Sharing Traffic Light Protocol (ISTLP; see https://www.first.org/tlp/docs/tlp-v1.pdf). Information that arrives with the tags WHITE, GREEN, AMBER, or RED will be handled appropriately.
4.3. Communication and Authentication
See section 2.8; In cases that involve sensitive information, use of PGP/GnuPG is highly recommended.
5. Services
5.1. Incident Response
5.1.1 Incident Triage
Investigating whether indeed an incident occurred.
Determining the extent of the incident.
5.1.2 Incident Coordination
Determining and contacting the involved organizations.
Facilitating contact with other parties including law enforcement, if needed.
Asking for reports and/or composing reports, depending on the involved organizations, incident type and severity.
Communicating with media, if necessary.
5.1.3 Incident Resolution
Advising the involved organization(s) on appropriate measures.
Following up the incident solution process.
Collecting evidence and interpreting data, if applicable.
5.2. Proactive Activities
CERT-GH collaborates with Shadowserver foundation.
Providing relevant information on threats, trends and remedies to their constituency (and/or media, if necessary) to raise security awareness and competence.
Collecting contact information of sectorial CERT teams.
Providing for a community building and information exchange within the constituency.
6. Incident Reporting Forms
Refer to section 2.11
7. Disclaimers
While every precaution will be taken in the preparation of information, notifications and alerts, CERT-GH assumes no responsibility for errors or omissions, or for damages resulting from the use of the information contained within.
