RCF 2350
1. Document Information
This document complies with RFC 2350.
1.1. Date of Last Update
This is version 1.4 as of September 1, 2022.
1.2. Distribution List for Notifications
This profile is kept up-to-date in the location specified in section 1.3.
E-mail notification of updates are sent to TDC CDC management and analysts.
Please send any questions about updates to the TDC CDC teams e-mail address: cdc@tdcnet.dk
1.3. Locations where this document may be found
The current version of this profile is always available at https://tdcnet.dk/rcf-2350/ or can be downloaded here
2. Contact Information
2.1 Name of the Teams
Full name(s): TDC NET Cyber Defense Center
Short name: TDC NET CDC, TDC SOC-CERT, TDC SOC, TDC CERT
2.2. Addresses
TDC NET CDC
Teglholmsgade 1
0900 Copenhagen C
Denmark
2.3. Time Zone
Central European Time (GMT+0100, GMT+0200 from April to October)
2.4. Telephone Number
TDC NET CDC regular telephone number: +45 4030 5501
TDC NET CDC emergency telephone number: Restricted, contact through secure email.
2.5. Facsimile Number
Not applicable.
2.6. Other Telecommunication
Not applicable.
2.7. Electronic Mail Address
Please send incident reports that relate to TDC NET CDC services, including copyright issues, spam, incidents and abuse to cdc@tdcnet.dk
Non-incident related mail should be addressed to cdc@tdcnet.dk
2.8. Public Keys and Encryption Information
Please encrypt any sensitive e-mail with the TDC NET CDC CERT PGP key with:
- PGP keyid 0x7226EE53 and
- PGP fingerprint DFBD 1C45 3A8E 2F60 5754 05D6 8954 240D 7226 EE53
...and send it to cdc@tdcnet.dk
Please sign messages using a key that is verifiable using the public key
servers.
Because all TDC NET CDC analysts can read mail encrypted with the cdc@tdcnet.dk key, individuals can use it if they cannot find a key for a specific TDC NET CDC team member.
2.9. Team Members
No public information is provided about TDC NET CDC team members.
2.10. Other Information
Further information about TDC NET CDC can be found at https://tdcnet.dk/rcf-2350/
TDC NET CDC is a member of Forum for Incident Response and Security Teams (FIRST).
See https://www.first.org/members/teams/tdc_soc for details.
2.11. Points of Customer Contact
The preferred method for contacting TDC NET CDC is e-mail.
- For general inquiries, please send e-mail to: cdc@tdcnet.dk
- For abuse or security issues, please use: cdc@tdcnet.dk
- In case of emergency, contact TDC NET CDC through secure e-mail.
TDC NET CDC's hours of operation are generally restricted to regular business hours (except public holidays):
- Monday to Thursday: 08:00 to 16:00
- Friday: 08:00 to 15:30
However, the 24/7/365 watch desk will respond to emergencies outside of normal business hours. These contact details will be provided to customers.
None TDC NET CDC business customers of TDC (AS3292) should use contact details mentioned on http://www.csirt.dk, and for TDC private customers the contact is handled through postmaster@abuse.mail.dk
3. Charter
3.1. Mission Statement
The TDC NET CDC mission is to coordinate, inform and assist about IT-security related issues for all TDC NET CDC's customers.
TDC NET CDC's mission is to work for a more secure society. This involves helping customers protect their systems and data by performing comprehensive investigations into cyber security incidents, and to contribute to the prevention of such incidents by engaging in proactive threat assessment, mitigation planning.
3.2. Constituency
Denmark.
3.3. Sponsoring Organisation / Affiliation
TDC NET CDC operates with the authority delegated by TDC NET.
3.4. Authority
TDC NET CDC performs investigations, managed security monitoring services into cyber attacks to minimize the effect and damage of its customers.
4. Policies
4.1. Types of Incidents and Level of Support
TDC NET CDC acts as a commercial CSIRT that amongst other assists customers that face an emergency such as: Hacking attempts and malware infections in addition to ad hoc emergency investigations.
4.2. Co-operation, Interaction, and Disclosure of Information
All incoming information is handled confidentially by TDC NET CDC and in accordance with Danish Law.
When reporting an incident of sensitive nature, please state so explicitly by using an appropriate label in the Subject field (for example, SENSITIVE, EMERGENCY, etc.) and if possible, use encryption as well.
TDC NET CDC supports the Traffic Light Protocol (TLP; see https://www.first.org/tlp/); information that arrives with the tags CLEAR, GREEN, AMBER, AMBER+STRICT or RED will be handled accordingly.
4.3. Communication and Authentication
See section 2.8; usage of PGP in all cases where sensitive information is involved is highly recommended.
5. Services
5.1. Incident Response (Triage, Coordination, and Resolution)
TDC NET CDC can assist system administrators in handling the technical and organizational aspects of cyber security incidents.
6. Incident Reporting Forms
Not available, please report using e-mail. When reporting an incident of sensitive nature use encrypted e-mail.
7. Disclaimers
While every precaution will be taken in the preparation of information, notifications and alerts, TDC NET CDC assumes no responsibility for errors or omissions, or for damages resulting from the use of the information contained within.