State of the Practice of Computer Security Incident Response Teams ...

documents the type of information a CSIRT should make public to its constituents and external
contacts.
Anyone who is familiar with handling computer security events knows that incidents come in
all shapes and sizes. Some are quite straightforward, easy to understand and mitigate. Others
can be quite serious and very complex, or can affect many hundreds of systems and require
coordination to respond to effectively.
A white paper published by Internet Security Systems, “Security Architecture and Incident
Management for E-Business,” written by M. S. Sokol, with contributions from D. A. Curry,
describes a set of best practices to reduce the risk of attacks and discusses a process for incident
management. They reference the British Standard (BS) 7799 91 which was the forerunner
of ISO 17799 92 (also referred to as BS EN ISO17799) a well-known set of best practice standards
for implementing information security in organizations. Sokol and Curry write “Incident
management responsibilities and procedures should be established to ensure a quick,
effective, and orderly response to security incidents” [Sokol 00].
Having a plan in place will enable sites or organizations to not only quickly identify unauthorized
activity occurring on their systems or networks, but will also facilitate responding to
such events. This can eliminate or mitigate any potential risks that might be faced (loss of
reputation, trust, or financial status, or even loss of life).
Even if you cannot define a robust plan, having some basic guidelines will help. The State of
Vermont has a set of incident handling procedures that are used as a guideline until their
CSIRT can enhance and update their existing document. This 10-page document includes
sections on setting the scope (e.g., having a plan to approach handling incidents), areas of
responsibility, and general and specific procedures. Their guidelines also include an incident
response checklist that can be used [Vermont 01]. Another set of guidelines used by Nebraska
similarly has procedures for reporting security breaches. It outlines their procedure for what
type of activity to report and how that information should be reported. A copy of these guidelines
can be seen in Appendix E [Nebraska 02].
Most of the authors in our literature search agreed on common areas that an organization
should consider implementing when planning a response capability, including
• establishing a centralized method or point of contact (POC) for reporting incidents
• identifying the goals, functions, and responsibilities of the team
91
92
For more information on BS7700, see .
For more information on ISO 17799, see .
CMU/SEI-2003-TR-001 85