State of the Practice of Computer Security Incident Response Teams ...

promote “higher education in information assurance” and produce “a growing number of professionals
with IA expertise in various disciplines.” 80
A relatively new development in incident handling training is the certification of CSIRT incident
handling staff or teams. In 2000, the SANS Institute 81 began offering individual certifications
for Global Information Assurance Certification (GIAC) 82 Certified Incident Handler
(GCIH). 83 And in 2003, the CERT Coordination Center began offering the CERT-Certified
Computer Security Incident Handler certification. 84
The U.S. Department of Defense has mandated that all Computer Network Defense Service
Providers (CNDSP) be certified and accredited in order to continue providing security services
to their subscribers. The CNDSP certification and accreditation process is means by
which providers can become certified according to the guidelines identified in DoD Directive
8530.1 “Computer Network Defense” and DoD Instruction 8530.2 “Support to Computer
Network Defense.” 85 The Certification and Accreditation process is an evaluation of the protect,
detect, respond, and sustain capabilities of the CND service provider, as well as an
evaluation of the ability of the provider to deliver these services to its subscribers.
Previous to these more specialized incident handling certifications, more generalized certifications
in the field of information security have been available to individuals. The most recognized
is the Certified Information Systems Security Professional (CISSP), 86 offered
through “(ISC) 2 ” the International Information Systems Security Certifications Consortium,
Inc. 87 The CISSP Certification examination covers a working knowledge of ten domains of
information security that comprise the Common Body of Knowledge (CMK). 88 Some of the
other types of information security certifications that are recognized are listed in Appendix C.
In reviewing the results of the CSIRT Organizational Survey, there was no standard type of
certification or degree required for incident handling staff by the teams participating in the
80
81
82
83
84
85
86
87
88
Policy documents are available to .mil sites via links on or
; access requires a DoD PKI Certificate.
. The ten domains of the CBK are Security
Management Practices; Security Architecture and Models; Access Control Systems & Methodology;
Application Development Security; Operations Security; Physical Security; Cryptography;
Telecommunications, Network, & Internet Security; Business Continuity Planning; and Law, Investigations,
& Ethics.
80 CMU/SEI-2003-TR-001