vPLfv

In developing this model, we strived to ensure that our work complemented and conformed
to other work going on in the CSIRT community and that it fit into a broader enterprise security
framework. 7 For example, we wanted to ensure that our work was also applicable to the
Department of Defense (DoD) Computer Network Defense Service Provider (CNDSP) certification
and accreditation metrics.
The U.S. Department of Defense established a directive and instruction whereby all DoD
components are required to establish and provide for computer network defense services. 8
The CNDS is built around a framework of functional capabilities that are often provided by a
CSIRT. Those CND services are defined as: Protect; Monitor, Analyze & Detect; and Respond.
The primary goal of the DoD CNDSP certification and accreditation (C&A) process is
to enhance the survivability of DoD information systems and computer networks through a
standardized evaluation process. A secondary goal is to ensure a higher quality of protection
through increased maturity and understanding of the services provided by the CNDSP. The
DoD’s evaluation process is used as a measurement of mission effectiveness, operational performance,
and functional maturity through a number of critical success factors.
The functional model that we are presenting in this publication does not match process name
to process name with the CNDSP metrics, but all the processes and functions outlined in the
CNDS metrics do match to a process area within our incident management process workflows.
9
1.5 Purpose of this Report
This report documents the initial work done to date to define incident management processes.
It is a first step in providing the framework for creating and operating incident management
capabilities, including CSIRTs. As such it can be used as a foundational publication and reference
to detail a best practice model for incident management processes.
One of the main purposes of the report is to outline the basic concepts and methodology behind
the use of process mapping for defining incident management processes. Another purpose
is to define the Prepare, Protect, Detect, Triage, and Respond processes at a detailed
level in process workflows and corresponding descriptions and handoffs. The report also
looks at the relationship CSIRTs have to the overall incident management functions, hence
the name, Defining Incident Management Processes for CSIRTs. You will find that the majority
of the details of the processes in the workflows and descriptions are from the CSIRT point
of view.
7
8
9
Work is currently ongoing within the SEI’s Networked Systems Survivability program to develop
a framework for Enterprise Security Management (ESM). For more information on the evolving
ESM work, see: http://www.cert.org/nav/index_green.html.
As outlined in DoD Directive O-8530.1, “Computer Network Defense,” and DoD Instruction O-
8530.2, “Support to Computer Network Defense.”
The areas covered by the CNDSP C&A metrics are: Protection; Detection; Response; and CND
Sustainment Functions.
CMU/SEI-2004-TR-015 9