State of the Practice of Computer Security Incident Response Teams ...

survey. Ten percent required a bachelor’s degree, 6% required the CISSP certification, 6%
required Microsoft Certified Systems Administrator (MCSA) 89 certifications, and 3% required
GIAC GCIH certification.
Along with external training, many teams have their own internal training to teach CSIRT
staff the specifics of their particular services. Fifty-five percent of the participating CSIRTs
stated that they had a formal training program for the CSIRT staff.
Appendix C lists some current sources for CSIRT training. In addition to the URLs listed in
this appendix, a search on the World Wide Web can provide an ever-growing menu of other
sites and organizations that now offer some level of incident handling training. In assessing
any training providers, it is important to try to determine whether the type of training being
offered meets the needs of the team and individual members of the team.
3.7 Processes
In this section we look at how CSIRTs go about receiving, categorizing, tracking, and responding
to computer security incidents. Information was gathered through the CSIRT Organizational
Survey, literature search, our own experiences, and discussions with other teams.
We will begin with a look at the definition of computer security incidents and other incident
response terminology. Next we will look at what is involved in creating an incident response
plan. We will move on from there to discuss various CSIRT operational processes such as
• receiving incident data
• recording and tracking CSIRT data
• categorizing and prioritizing incident reports
• performing incident response
• answering the hotline
• performing forensic analysis
• coordinating and sharing information
We will also discuss defining the hours of operation.
89
CMU/SEI-2003-TR-001 81