State of the Practice of Computer Security Incident Response Teams ...

Attempting to manage (or remember) the specific details for any one of these incidents could
be a challenge; when incidents involve hundreds (or thousands) of hosts or sites, remembering
what happened, who was contacted, and the current status can be very difficult. Whatever
techniques are used for recording and tracking CSIRT data, it is worthwhile to identify in the
requirements design that all data can be easily searched, incident reports can be handed off to
other staff members (e.g., reassign the responsibility for handling a specific report), and that
current summaries of the workload and distribution across CSIRT staff can be determined.
Another consideration in determining what type of system to use for tracking and recording
CSIRT data is whether it can effectively incorporate processes for capturing and storing data
from other sources, such as telephone calls, facsimile, other types of correspondence, encrypted
information, binary files, and other types of files.
Some of the features that a CSIRT might require in recording and tracking data are included
in Table 10.
Table 10: Features of a CSIRT Tracking System
Ability to: Support for: Fields to capture:
• modify initial categorization
of reports
• access and read all related
emails
• respond to requests via email
• assign actions and redistribute
to others as needed
• search, sort, cross-reference,
and correlate hosts, IP addresses,
attack types, dates,
and names
• generate reports and/or statistics
as required
• review and/or reassign workload
of an incident handler
• open/close/reopen reports
• access library of standard
responses
• trigger automatic reminders
of incidents that need attention
• standardized incident data
representation (IODEF for
example)
• encrypting and decrypting
data
• documenting chain of custody
as part of investigation
or law enforcement activity
• contact information
• time zone for any times
reported or logs sent
• system information
• resolution and mitigation
strategies
• recommended steps
taken
• staff interviewed during
incident resolution
• follow-up actions
• cost of incident
• amount of time to resolve
(More fields are discussed
in section 3.7.5.1)
CMU/SEI-2003-TR-001 91