vPLfv

2 Incident Management Concepts and
Processes
2.1 Incident Management Requirements
In our CSIRT-related publications and courses, 12 we describe the need for organizations to
have a multilayered approach to secure and protect their critical assets and infrastructures.
This multilayered strategy requires that not only technical but also organizational approaches
be in place to manage computer security incidents as part of the goal of achieving an enterprise’s
business objectives in the face of risks and attacks. Organizations today want to not
just survive attacks but to be resilient to whatever malicious activity may occur. 13
Through our research in the area of incident management, we continue to evolve our understanding
of its processes. In the early history of incident management, where most capabilities
were established CSIRTs, the processes and functions performed by team members were
primarily reactive in nature; actions were taken to resolve or mitigate an incident when it occurred.
14 As teams increased their capability and scope, they began to expand their activities
to include more proactive efforts. These efforts included looking for ways to
• prevent incidents and attacks from happening in the first place by securing and hardening
their infrastructure
• training and educating staff and users on security issues and response strategies
• actively monitoring and testing their infrastructure for weaknesses and vulnerabilities
• sharing data where and when appropriate with other teams
As organizations become more complex and incident management capabilities such as
CSIRTs become more integrated into organizational business functions, it is clear that incident
management is not just the application of technology to resolve computer security
events. It is also the development of a plan of action, a set of processes that are consistent,
repeatable, of high quality, measurable, and understood within the constituency. To be successful
this plan should
12
13
14
These publications and courses are documented at http://www.cert.org/csirts/.
Resiliency in this context means the “the ability of the organization to withstand systemic discontinuities
and adapt to new risk environments” [Starr 03].
For historical background on the development of CSIRTs, see the State of the Practice of CSIRTs,
Section 2.3, “History and Development of CSIRT Capabilities.” This report is available at
http://www.cert.org/archive/pdf/03tr001.pdf.
CMU/SEI-2004-TR-015 15