State of the Practice of Computer Security Incident Response Teams ...

In the CSIRT community, we often say “Reuse, with appropriate attribution, is good.” Being
able to learn from the actions and experiences of other response teams can be very effective
in helping a team to develop their own plans. For example, in building a team for the German
Research Network back in 1993, Kossakowski pointed out that they were able to gain a lot of
knowledge about what they needed to launch their CSIRT from talking to other teams [Kossakowski
94b]. He also pointed out that it can be challenging to prepare a successful plan for
a CSIRT, especially if starting from scratch. One of the lessons learned was that talking with
other teams, reviewing information that is available on CSIRTs in general, and where possible
and appropriate, visiting other CSIRTs, will go a long way towards helping you to build
an effective plan for your own CSIRT [Kossakowski 94a].
3.7.3 Incident Handling Process or Methodology
As mentioned in the previous section, many authors provide a set of processes, steps, or
methodologies that are recommended for handling incident activity, threats, and intruder attacks.
Some teams have very formalized processes with flowcharts and checklists that team members
must follow to handle an incident. Other teams handle this process in a more ad hoc
fashion. For example, the representation for the incident life cycle referenced in Section 3.4.1
of the Handbook for CSIRTs shows a visual representation for how a report moves through
the incident handling cycle [West-Brown 03].
IDS
Other
Email
Triage
Information
Request
Hotline/
Phone
Vulnerability
Report
Coordinate
Information
and
Response
Incident
Report
Initial Analysis and
Data Collection
Perform Technical
Analysis
Obtain
Contact
Information
and
Notify
Others
Figure 13: The Incident Life Cycle
CMU/SEI-2003-TR-001 87