State of the Practice of Computer Security Incident Response Teams ...

3.7.1.1 Security Incident Taxonomy
Developing a taxonomy is a complicated endeavor, so much so that the new Incident Handling
Working Group (INCH WG of IETF) 90 choose not to address that issue in their work on
developing a format and methodology for exchanging incident data. Instead they have created
a format that identifies various fields such as incident, vulnerability, or artifact. Each team
using this format can place in those fields information according to their own definition of
each term.
In 1997 a doctoral dissertation was done by John Howard called “An Analysis of Security
Incidents on the Internet 1989–1995” [Howard 97]. One of the outcomes of this dissertation
was the development of a taxonomy for the classification of Internet attacks and incidents.
This document is still referenced in today’s CSIRT community.
The eCSIRT project also is using a taxonomy that was based on one developed by staff in
TeliaCERTCC.
3.7.2 Having a Plan
In February 2002 CIO published a report on “Cyberthreat Response and Reporting Guidelines”
[CIO 02] that was jointly sanctioned by the FBI and the U.S. Secret Service. This report
suggests that the better prepared an organization is to respond to security events, the better
chance it has to minimize the damage.
This is one of the main functions of a CSIRT, to be prepared to effectively handle incidents
when they occur and to help prevent incidents from happening. Whether the team is formalized
or ad hoc, many of the authors reviewed in our literature search [Allen 01, Duffy 01,
SANS 03, Schultz 02, Symantec 01, van Wyk 01, West-Brown 03] agree that the team should
have a plan for handling incidents and should back up the plan with documented policies and
procedures. This is a concept also widely embraced by the CSIRT community.
This incident response plan identifies the mission and goals of the team; the team roles and
responsibilities; the services provided; and policies, procedures, processes, and guidelines
related to incident handling. The incident response plan is not only for the CSIRT staff members
(in their role as incident handlers), but also for the constituency that they serve, so those
individuals are knowledgeable about what to report, how to report it, and to whom it should
be reported. The plan should also provide some notion of the expected level of service that
will be provided. RFC 2350, “Expectations for Computer Security Incident Response”
[Brownlee 98], is a best practice document created by the IETF GRIP working group that
90
84 CMU/SEI-2003-TR-001