State of the Practice of Computer Security Incident Response Teams ...

Level/Priority
Low
Type of Incident/Activity
Network switch, news, chat, or shell server
[Schultz 02]
Level 1
Level 2
Level 3
Level 4
Low impact (affects one location; e.g., virus incident)
Local event with major impact on operations (compromise of a privileged
account, theft of critical equipment)
Minor impact event affecting two or more locations (e.g., non-destructive
virus; email spamming)
High-impact event affecting many sites (intrusion on critical global application)
Internet Security Systems. “Computer Security Incident Response Planning, Preparing for the Inevitable.”
Atlanta, GA, 2001.
Severity 1
Severity 2
Severity 3
Severity 4
Severity 5
Low-level probes/scans on internal systems; known virus (easily handled by
AV software)
Probes/scans on external systems; potential threats identified
Significant probes/scans; penetration of denial of service (DoS) attacks attempted
without impact on operations; widespread known virus attacks
(easily handled by AV software); isolated instances of new viruses
Penetration or DoS attacks with limited impact on operations; widespread
new computer virus attacks (not handled by AV software); risk of negative
financial/public relations impact
Successful penetration or DoS attacks with significant impact on operations;
signification risk of negative financial/public relations impact
[Schultz 90]
Priority 1
Priority 2
Priority 3
Priority 4
Priority 5
[Schiffman 01]
Low
Moderate
Hard
Human life, human safety
Protect classified/sensitive data
Protect other data (proprietary, scientific, managerial, etc.)
Prevent damage to systems (loss/alteration of files, damage to disk drives)
Minimize disruption of computing resources
Rather than priorities, this methodology rates in terms of attack complexity
and technical ability of attacker(s)
“script kiddie” attacks, well understood, no innovation
Attack uses publicly known/available attack method, additional modification
(e.g., forgery, different attack behaviors)
Clever and reasonably skilled attacker; exploit may/may not be publicly
known; attacker writes own code
96 CMU/SEI-2003-TR-001