Id-SIRTII/CC RFC 2350
1. Document Information
This document contains a description of Id-SIRTII/CC according to RFC 2350. It provides basic information about the Id-SIRTII/CC, the ways it can be contacted, describes its responsibilities and the services offered.
1.1 Date of Last Update
This is version 0.10 as of 10/05/2021. Indonesia date format is DD/MM/YYYY.
1.2 Distribution List for Notifications
There is no distribution list for notifications as of 10/05/2021.
1.3 Locations where this Document May Be Found
The current version of this document can always be found at:
For validation purpose, GPG signed ASCII version of this document is located at:
The key used for signing is the Id-SIRTII/CC key as listed under section 2.8. Public Keys and Encryption Information.
2. Contact Information
2.1 Name of the Team
Id-SIRTII/CC - Indonesia Security Incident Response Team on Internet Infrastructure / Coordination Center.
Id-SIRTII/CC – BSSN
Jalan Harsono RM No. 70 Ragunan
Jakarta Selatan, 12550
2.3 Time Zone
We are located in Asia, Jakarta - Indonesia Western Time that is GMT+07:00. No daylight saving time. GMT are consider similar with UTC. Indonesia time format are HH:MM:SS in 24 hours notation – without AM/PM.
2.4 Telephone Number
Telp. +62 21 7883 3610
2.5 Facsimile Number
Fax. +62 21 7884 4104
2.6 Other Telecommunication
2.7 Electronic Mail Address
Please send incident related reports to incident[at]idsirtii.or.id
Non-incident related mail should be addressed to info[at]idsirtii.or.id
2.8 Public Keys and Encryption Information
Id-SIRTII/CC uses a signing key for operational purpose. Please encrypt any sensitive e-mail with the Id-SIRTII/CC PGP public key and send to firstname.lastname@example.org.
This trust anchor is:
Key ID: A25718A5
Fingerprint: D074 F751 FF8D 9669 9EDF C809 F197 D18F A257 18A5
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: SKS 1.1.6
-----END PGP PUBLIC KEY BLOCK-----
2.9 Team Members
Adi Nugroho, as Liaison Officer and Acting Official Chair of Id-SIRTII/CC.
2.10 Other Information
Further information about Id-SIRTII/CC can be found at: https://www.idsirtii.or.id
2.11 Points of Customer Contact
Preferred method to contact Id-SIRTII/CC is through e-mail. For incident reports and related issues, please directly use incident[at]idsirtii.or.id. This procedure will create a ticket number in our tracking system and will alert officer on duty.
For general inquiries please send e-mail to info[at]idsirtii.or.id
If it is not possible – or advisable due to security reasons – to use e-mail, you can contact or reach us through fixed line – telephone at +62 21 7883 3610.
ID-SIRTII/CC`s operation are generally restricted to regular business hours:
From 8:00 a.m. to 5:00 p.m. that is GMT +07:00
Asia, Jakarta – Indonesia Western Time
Monday through Friday, excluding National Holiday.
Note that: we will response ONLY DURING THESE HOURS.
Our phones are connected to IVR (Interactive Voice Response) System that will record any communication, but officers and staffs are only available during office hours. So, please consider time differences between your area and ours, thus eliminating the possibility of a wasted call.
Otherwise, please use email and or our online incident reporting form.
3.1 Organizational Information
Id-SIRTII/CC is under the National Security Operation Center (NSOC), which is a part of the National Cyber & Crypto Agency (NCCA), in Indonesian called as Badan Siber dan Sandi Negara (BSSN). This is regulated in Presidential Regulation of the Republic of Indonesia Number 53 of 2017 concerning National Cyber and Crypto Agency, which is amended in Presidential Regulation of the Republic of Indonesia Number 133 of 2017 concerning Amendments to Presidential Regulation Number 53 of 2017 concerning National Cyber and Crypto Agency, and the latest amendment to Presidential Regulation Number 28 of 2021 concerning National Cyber and Crypto Agency.
3.2 Mission Statement
The main purpose of Id-SIRTII/CC is as The National CSIRT/CC of Indonesia, to coordinate security efforts and incident response for government level, Critical Infrastructure, digital economy and IT-security problems at national level in Indonesia.
Id-SIRTII/CC constituencies are:
- ICT Community, which is IT-security teams and professionals.
- Local CSIRT’s in Indonesia, which is ACAD-CSIRT an Academic CSIRT forum, Govt-CERT a Government CSIRT under the National Cyber & Crypto Agency (NCCA), Local Government CSIRT and Industry Sector CSIRT.
- Internet Core Infrastructure, which are Network Access Provider (NAP), Internet Service Provider (ISP) and Local Exchange and Data Center Operator (LEO).
- Law Enforcement Agency (LEA), which is National Police andAttorney General.
- Government agencies, which is Ministry of Law and Human Rights, Ministry of Communication and Information Technology, etc.
- Any agencies related with National Critical Infrastructure.
- Basically – as The National CSIRT/CC of Indonesia – Id-SIRTII/CC is mandated to take responsibility to any other constituencies that are not yet be serviced by any other CSIRT. We will engage upon request.
- For awareness purposes, pro-active educational material will be provided to the constituencies, SME’s and general public as well.
3.4 Sponsors and/or Affiliation
- AWARI (Asosiasi Warung Internet Indonesia), The Indonesian Internet Kiosk Association. Web site http://www.awari.or.id/
- MASTEL (Masyarakat Telematika Indonesia), The Indonesian ICT Society. Web site http://www.mastel.or.id/
- APJII (Asosiasi Penyelenggara Jasa Internet Indonesia), The Indonesian Internet Service Provider Association. Web site http://www.apjii.or.id/
- POLRI (Kepolisian Republik Indonesia), The Indonesian National Police. Web site http://www.polri.go.id/
- KEJAGUNG (Kejaksaan Agung Republik Indonesia), The Indonesian Attorney at General. Web site http://www.kejaksaan.go.id/
- DITJEN POSTEL (Direktorat Jenderal Pos dan Telekomunikasi), The Directorate General of Post and Telecommunication. Web site http://www.postel.go.id/
- BI (Bank Indonesia), The Indonesian Central Bank. Web site http://www.bi.go.id/
- AKKI (Asosiasi Kartu Kredit Indonesia), The Indonesian Credit Card Association. Web site http://www.akki.or.id/
Co-founders are not mention directly due some exception and restriction reason. Including individual expert, academia, others Government Agencies and NGO’s.
Members of FIRST, National CSIRT Forum, APCERT and OICCERT.
Id-SIRTII/CC is a quasi government organization. Which means, it is fully funded only by The Government of Republic of Indonesia.
Our accountability and responsibility is to the constituencies.
Id-SIRTII/CC`s main purpose is to coordinate others initiatives to handle any kind of incidents at national level. This includes communication with counterparts and initiate collaboration as needed. In such, we advise local or sector CSIRT’s or our constituencies to take immediate action. WE DO NOT MITIGATE AND REMEDIATE directly since we do not have direct authority to our constituencies, its network and so on.
We have indirect authority over AS38775. Contact to APNIC are through IDNIC.
4.1 Types of Incidents and Level of Support
Id-SIRTII/CC is authorized to address any kind of cyber security incidents, which occur or threaten our constituency (see section 3.2 Constituency) and its cyber strategic interest, in which required cross-organizational coordination, especially at national level. We will impose any precaution action needed and committed to keep our constituency informed to any potential vulnerability.
The level of support given by Id-SIRTII/CC will vary depending on the type and severity of the incident or issue, type of constituent, size of user or community affected, and Id-SIRTII/CC`s resources in place. Special attention will be given to the issues that are directly affecting to critical infrastructure.
Please note that NO DIRECT SUPPORT WILL BE GIVEN TO END USERS. They are expected to contact their local CSIRT (if any), or system administrator, network administrator and department head for assistance.
4.2 Co-operations, Interaction and Disclosure of Information
Id-SIRTII/CC will cooperate with other organizations in the field of cyber security and Internet infrastructure. Those engagements often require data or information exchange regarding to incident and issue. Nevertheless Id-SIRTII/CC committed to protect privacy of its constituency and therefore (under normal circumstances) only pass on limited and anonymized information to others party, unless some contractual agreements apply, for example Non Disclosure Agreement (NDA).
We operate under restrictions imposed by applicable Indonesian law regarding to information classifications and protection. This involves handling procedures of personal data as required by Indonesian Data Protection law, but it is may be forced to disclose such information due to LEA investigation or by court`s order.
4.3 Communications and Authentication
For usual communication, not containing sensitive information, Id-SIRTII/CC will use conventional methods like unencrypted e-mail or facsimile.
For secure communication PGP-Encrypted e-mail or telephone/fax will be used. If it is necessary to authenticate a person before communicating, this can be done either through existing peers of trust (e.g. FIRST, APCERT) or by other methods like callback, mail-back or even face-to-face meeting if necessary.
5.1 Incident Response
We response the incidents through (online) public reporting procedures, which are:
5.1.1. Incident Triage
- Determining whether an incident and the reporter are authentic.
- Assessing related information and prioritizing the incident.
5.1.2. Incident Coordination
- Determine any involved organizations.
- Contact person in charge to investigate and take appropriate action.
- Facilitate contact to other parties that can help to resolve the incident.
- Send reports to other related CERT’s, parties or LEA if it is needed.
5.1.3. Incident Resolution
- Advise others security teams involved to take appropriate actions.
- Follow up progress, ask for reports, report back and escalated to higher authority.
- Id-SIRTII/CC assists others security team in technical and management aspects of incidents as needed. Particularly, we provide assistance or advices upon request. We engaged to any kind of mitigation and remediation process upon by constituency’s request.
- Id-SIRTII/CC collect incidents statistics form its constituency periodically.
5.2 Proactive Activities
- Conducting National Monitoring Center – to detect known threats, anomalies and any kind of potential security issues within Indonesia Internet Infrastructure – as Early Warning System to prevent major disruption.
- Operating Data Centers – to host and develop applications related to Monitoring and Early Warning System and secure internet infrastructure. Collecting and preserve ISP’s log files to support Law Enforcement investigation process and providing second opinion analysis (cyber crime law, digital forensic etc.) as expert witness.
- Conducting cyber security research and development program through various departments: Digital Forensic, Malware, Network Security, Data Mining, Honey net.
- Providing security related information, alert and advisory to general public based on related incident reports, actual monitoring events and research analysis result.
- Providing advisories, consultancy, clinic and technical assistance to strategic institution and agencies (upon request or as mandated by regulation).
- Organized socialization to raise security awareness to the constituencies, related parties and providing cyber security training regularly.
- As a Coordination Center (CC) at national level and provide liaison – Single Point of Contact – to counterpart within the country and abroad.
6. Incident Reporting Forms
If possible, please make use of our Incident Reporting Form.
Current version is available from http://idsirtii.or.id/halaman/tentang/kontak-kami.html
While every precaution will be taken in the preparation of (those) information, alerts and notifications, Id-SIRTII/CC assumes will not take any responsibility for errors, omissions or damages resulting from the use of the information contained within.
This information should be solely used only as mentioned.