State of the Practice of Computer Security Incident Response Teams ...

Level/Priority
Devilish
Type of Incident/Activity
Attacks indicate domain expertise; extremely skilled, innovative, able to
cover tracks, can leave covert re-entry channels; difficult to catch by average
system and network administrator
[McGlashan 01]
Priority 1
Priority 2
Priority 3
Priority 4
Priority 5
Preservation of non-critical systems
Continuity of complete service
Preservation of critical systems, proprietary* strategic information
Classified or (legally) sensitive data
Life and health
For an interesting comparison, here are the hurricane severity levels developed by the National
Hurricane Preparedness Center: 102
Table 13: Severity Levels of the National Hurricane Preparedness Center
Level
CAT 1
CAT 2
CAT 3
CAT 4
CAT 5
Description
Winds of 74 to 95 miles per hour
Winds of 96 to 110 miles per hour
Winds of 111 to 130 miles per hour
Winds of 131 to 155 miles per hour
Winds greater than 155 miles per hour
Some other levels include
• AusCERT – Priority 1-5 (lowest is non-critical systems; highest equals life and death)
[AusCERT 01]
• The ISS paper on “Computer Security Incident Response Planning,” discusses levels of
severity from 1-5 (severity 1 being a low-impact incident and 5 being “significant)” 103
Most authors believe that something as simple as establishing or assigning rankings such as
Category 1, 2, or 3 or High, Medium, or Low will assist in prioritizing incident reports. Over
time these may need to be expanded to meet the requirements or needs of the CSIRT and
constituency being served. At one of our CSIRT development courses, one attendee discussed
their categories for intruder activity and response. They used colors as indicators for the level
of “threat” associated with an incident or other activity being handled by the team: red (high
102
103
Internet Security Systems. “Computer Security Incident Response Planning, Preparing for the
Inevitable.” Atlanta, GA, 2001.
CMU/SEI-2003-TR-001 97