Honeypot-Integrated CSIRT Model Based on ISO 27001/27035

Abstract

Higher education institutions are evolving into digital entities that manage critical assets, including sensitive personal data and academic records. However, many universities in Indonesia still lack a structured and legally compliant approach to information security, leaving them vulnerable to cyber threats such as defacement attacks and data breaches. This paper proposes a conceptual model for a Computer Security Incident Response Team (CSIRT) specifically designed for academic environments. The model integrates international standards ISO/IEC 27001 for Information Security Management Systems and ISO/IEC 27035 for incident handling, with proactive threat detection using honeypot technology. The framework consists of four layers: governance, operational procedures, technology infrastructure, and legal compliance. Designed using a systems-thinking approach and validated through expert review, the model addresses institutional readiness and outlines a roadmap for phased implementation. It aims to support early threat detection, structured response workflows, and digital forensic readiness in alignment with Indonesian cybersecurity law. This honeypot-integrated CSIRT model contributes a strategic reference for universities seeking to enhance their security capabilities in a sustainable and lawful manner.