DEVELOPING AN INTEGRATED COMPUTER SECURITY INCIDENT RESPONSE TEAM (CSIRT) STRATEGIC AND POLICY FRAMEWORK TO SUPPORT NATIONAL AIR DEFENSE OPERATIONS

Abstract

National air defense systems increasingly depend on interconnected digital technologies, making cybersecurity incident response a critical component of operational continuity and national security. However, Indonesia lacks an integrated Computer Security Incident Response Team (CSIRT) framework specifically designed for national air defense operations, resulting in fragmented incident response capabilities and interagency coordination challenges. This study aimed to develop an integrated CSIRT strategy and policy framework for Indonesia’s National Air Operations Command (Koopsudnas) and its regional air defense commands. An exploratory sequential mixed-methods design was employed. The qualitative phase involved in-depth interviews with 20 informants representing eight institutions, followed by a quantitative validation phase using the Analytic Hierarchy Process (AHP) with the same 20 subject-matter experts. The findings identified five distinctive operational characteristics requiring a specialized CSIRT framework: time-critical response requirements, heterogeneous Command, Control, Communications, Computers, Intelligence, Surveillance, and Reconnaissance (C4ISR) systems, geographical dispersion across the Indonesian archipelago, zero-disruption operational requirements, and threats from nation-state-sponsored advanced persistent threat actors. In response, the study developed the CSIRT-PU Framework, incorporating a four-tier architecture, concurrent Observe–Orient–Decide–Act (OODA) cycle integration, a Pre-Authorized Response Matrix, and graceful degradation based on Minimum Viable Defense. The framework adopts a dual-lead network partnership governance model involving Koopsudnas and the National Cyber and Crypto Agency (BSSN). AHP validation produced an aggregate consistency ratio of 0.0127, with cyber resilience receiving the highest priority weight at 33.45%. The study also introduces three theoretical constructs: Mission-Critical Public Service Governance, Hybrid Command-Collaborative Governance, and the Integrated Cyber-Defense Governance Model. These findings provide an institutional and theoretical foundation for developing integrated cybersecurity incident response capabilities tailored to Indonesia’s national air defense operations.