State of the Practice of Computer Security Incident Response Teams ...

priority), yellow (cautionary alert, has potential to escalate), green (everything normal). 104
These alert banners would be strategically located in the CSIRT offices as visual reminders of
current activity levels. The yellow alert was also used to let part-time members of the CSIRT
know that they may get called in if the priority went higher.
Because there are not consistent severity scales across CSIRTs, one of the more unfortunate
problems that can occur is that scales can be contradictory. In some cases the priority scales
used have just the exact opposite level of severity compared to some of the others. While a
selected priority setting works very well within an organizational constituency, it could lead
to confusion in those cases where incidents affect multiple sites beyond a single constituency
base. If a clear understanding of the relative priorities or criticality is not understood by all,
the response actions taken may seriously (and detrimentally) affect the ultimate resolution of
the activity.
In looking at the lifetime of an incident, it must be recognized that the priority of the incident
may change as new information comes to light. The priority of a specific type of incident
might also change over time as changes in mission and services occur.
3.7.7 Incident Response Processes
CSIRT response strategies vary as much as CSIRTs themselves do. The response that a
CSIRT provides is based on its mission, services, and service levels. Response options can
include
• providing guidance and solutions via phone or email
• going to the site or affected machine and helping repair and recover the systems
• analysis of logs, files, or other artifacts
• assistance in legal investigations and prosecution
• capturing and documenting evidence from affected computers
• development and dissemination of patches, fixes, workarounds, advisories, alerts, or
technical documentation
• notification to sites involved in the activity (both victim and source sites)
• none (forward to others to handle)
Once an incident report has been received and reviewed, the response provided will depend
on the CSIRT’s mission, purpose, expertise, and policies and procedures. For example, a state
law enforcement CSIRT’s mission may be to pursue legal investigations; when they receive a
104
CERT CSIRT Development Team personal communication, 2002.
98 CMU/SEI-2003-TR-001