State of the Practice of Computer Security Incident Response Teams ...

3.7.1 Defining Computer Security Incidents and Other Incident
Response Terminology
One of the problems facing the CSIRT community today is the lack of a standard taxonomy
or a standard set of definitions for describing incident response activities and events. This has
caused much confusion when trying to exchange data between teams or with sites. In particular,
the actual definition of the term “incident” varies from team to team. For example, definitions
for “incident” in the literature reviewed included the following:
• The CSIRT FAQ defines an incident as “any real or suspected adverse event in relation to
the security of computer systems or computer networks.” Another definition is “the act of
violating an explicit or implied security policy” [CSIRT 02].
• Allen, in The CERT Guide to System and Network Security Practices, describes an incident
as “a collection of data representing one or more related attacks. In addition, a set of
steps are described that are comprised of a series of practices used to respond to incidents,
e.g., analyze, communicate, collect, and protect. These are followed with practices
to contain, eliminate, return systems to operations, and improve the process” [Allen 99].
• A draft version of The State of Vermont’s incident reporting procedures for their CSIRT
defines an incident as “any irregular or adverse event, which can be electronic, physical,
or social that occurs on any part of the State’s infrastructure” [Vermont 01].
• In a joint survey from AusCERT, Deloitte Touche Tohmatsu, and the New South Wales
Police in May 2002, a computer security incident is defined as “an attack against a computer
or network, either real or perceived” and “any type of computer network attack,
computer-related crime, and the misuse or abuse of network resources or access” [Aus-
CERT 02].
• The SANS Incident Handling Step-by-Step guide defines an incident as “an adverse event
in an information system and/or network, or the threat of the occurrence of such an
event” [SANS 03].
• The Department of the Navy incident response guidebook uses the same definition as
SANS [Navy 96].
• Van Wyk and Forno describe an incident (in its most basic terms) as “a situation in which
an entity’s information is at risk,” without explicitly saying whether it is an event or an
attack [van Wyk 01].
• Mandia defines incidents as “events that interrupt normal operating procedure and precipitate
some level of crisis” [Mandia 01].
• Howard describes an incident as “a group of attacks that can be distinguished from other
incidents because of the distinctiveness of the attackers and the degree of similarity of
sites, techniques, and timing.” He also defines computer security as “preventing attackers
from achieving objectives through unauthorized access or unauthorized use of computers
and networks” [Howard 97].
82 CMU/SEI-2003-TR-001