Arrow Dropdown arrow Play

Truphone CSIRT

This page describes the Truphone CSIRT service according to the RFC 2350. 

Truphone Computer Security Incident Response Team (Truphone CSIRT) is part of the Truphone Cybersecurity, Risk and Compliance area. This team relies on automatic and stakeholders' alerts to respond to security incidents, protecting Truphone and its customers from threats to information security and cyber-attacks.

Purpose

Truphone CSIRT provides the most effective and efficient protection for our internal information and that of our customers, suppliers and partners. This is done by detecting threats, analysing data, and containing, eradicating and recovering from security incidents. It ensures minimal impact and the continuity of operations and data privacy.

Truphone CSIRT is in constant contact with other CSIRTs and CERTs, receiving and sharing relevant information on incidents in cyberspace.

Distribution List for Notifications

Email notification of updates are sent to Truphone CSIRT. All queries regarding updates and changes should be sent to Truphone CSIRT email address at csirt@truphone.com

Charter

Mission Statement

To contributions to the use of cyberspace in a free, reliable and secure manner by Truphone, its customers, suppliers and partners.

To maintain a proximity and means of communication with national and international regulatory and incident response agencies, allowing us to continuously improve the security of cyberspace.

Constituency

Truphone CSIRT scopes internal employees, assets and IPs provided to Customers. All Truphone domains are also included, namely truphone.com, business.truphone.com, myaccount.truphone.com and iot.truphone.com. All external facing Truphone IPs are also part of Truphone CSIRT scope, namely:

194.88.242.92, 194.88.242.156, 194.88.242.152, 194.88.242.163, 194.88.242.164, 194.88.242.165, 194.88.242.166, 194.88.242.167, 194.88.242.159, 194.88.242.158, 194.88.242.88, 194.88.242.94, 194.88.242.176, 194.88.242.178, 194.88.242.155, 194.88.242.121, 194.88.242.186, 194.88.242.83, 194.88.242.85, 149.14.17.8, 149.14.17.9, 149.14.17.10, 149.14.17.11, 149.14.17.12, 149.14.17.13, 149.14.17.14, 149.14.17.15, 194.88.243.155, 194.88.243.92, 194.88.243.152, 194.88.243.158

Sponsorship and Affiliation

Truphone Computer Security Incident Response Team (Truphone CSIRT) is part of Truphone Cybersecurity, Risk and Compliance area.

Address

TagusPark, Edifício Qualidade B - Bloco B2 - 3A, Sala 324, 2740-120 Oeiras, Portugal.

Time Zone

Portugal/WEST (GMT+0, GMT+1 em horário de verão)

Public Keys and Encryption

Encrypt any sensitive email with the Truphone PGP Key and send to csirt@truphone.com
Key Size: 4096
Key Validity: 31 July 2020
Key Fingerprint: 6D7A D480 C564 7993 7532 E0C8 F10F D55B 443A B2BC

Link to Public Key

Authority

The Truphone CSIRT works under the responsibility of Truphone's Chief Information Security Officer. It collaborates with the operational responsibilities of its employees' infrastructures, thus guaranteeing the operational authority necessary for the correct development of the incident response. 

Types of Incidents and levels of support

Truphone CSIRT responds to all types of cybersecurity incidents, including those that result in a security breach of the following types:

Incident Class: 

  • Malware
  • Availability
  • Information Gathering
  • Intrusion 
  • Information Security
  • Fraud 
  • Other

The Truphone CSIRT has adopted the policy of classification of incidents of CERT.PT, guaranteeing a harmonization of communication between both entities.

Cooperation, Interaction and Disclosure of Information

Truphone's privacy and data protection policy means that sensitive information may be passed on to third parties only with the prior express authorization of the individual or entity to whom that information relates.

Communication and Authentication

From the means of communication provided by Truphone CSIRT, telephone and unencrypted electronic mail are considered sufficient for the transmission of non-sensitive information. For the transmission of sensitive information, the use of PGP cipher or equivalent is mandatory.

Incident Response

The incident response provided by Truphone CSIRT is only carried out within the scope of the aforementioned action and follows a methodology adapted to the best practices, containing the following phases:

a) Detection
b) Analysis
c) Containment
d) Eradication
e) Recovery

Proactive Activities

Alerting Truphone's internal and external stakeholders about cybersecurity risks arising from the infrastructure used in this service, with the potential to impact those Customers.
Provide ratings and visibility on their allocated IP ranges.

Disclaimer

While every precaution will be taken in the preparation of information, notifications and alerts, Truphone CSIRT assumes no responsibility for errors or omissions, or for damages resulting from the use of information contained within.

Furthermore, several contractual obligations are included in the standard service contract, which only cover the involved parties.

Contacts

Truphone CSIRT

Email: csirt@truphone.com.

Phone: +351 91 9370496

For any other inquires the following contacts should be used:
* General Cybersecurity, Risk and Compliance inquires: seccom@truphone.com
* 24/7 support from non Truphone mobile: +44 20 3318 0733
* 24/7 support from Truphone mobile: 707

Return to security page.

Related