State of the Practice of Computer Security Incident Response Teams ...

• identifying the staff and necessary expertise and training required
• identifying and defining the proactive and reactive services to be provided by the team
• providing guidance for reporting and handling incident reports
• providing security awareness and incident response training for CSIRT staff and constituency
• establishing and encouraging well-defined incident handling and security policies and
procedures for the CSIRT and for the constituency
• sharing lessons learned with others
• establishing a method for evaluating how effective the CSIRT has been
• establishing a method for coordination between the CSIRT and internal and external parties
All of these issues and areas define the basic framework of the CSIRT.
In addition, many of these authors provide a set of processes or steps that are used in incident
response activities. Selections of these processes from several authors are highlighted in Appendix
B. Each process is outlined from each of the books or articles reviewed.
In reviewing the materials in the appendix, it can be seen that the basic steps for incident
management and response are very similar across the authors. They basically break down
into some form of
• prepare/protect
• detect
• contain
• analyze
• respond
• improve
The “prepare” or “protect” functions refer to proactive mechanisms to have in place to effectively
respond to an incident. This includes having incident reporting guidelines available to
the constituency and defined incident handling procedures for CSIRT staff. It also involves
the implementation of security best practices to protect systems. These best practices can include
applying appropriate security configurations for software and hardware; keeping up to
date with patches and operating system upgrades; monitoring system and network activity;
disabling unneeded services; enabling maximum auditing; installing internal and external
defenses such as firewalls, routers, and intrusion detection systems; and raising user awareness
regarding computer security issues.
86 CMU/SEI-2003-TR-001