State of the Practice of Computer Security Incident Response Teams ...

eport, they begin an investigation to collect evidence for prosecution, and they are not responsible
for helping to repair the affected systems. However, an internal CSIRT in a commercial
company or an MSSP incident response provider, after analyzing an incident report,
may go to the site of the affected systems and physically perform the recovery operations to
collect forensic evidence and also repair the affected systems.
In the CSIRT Organizational Survey, we were interested in seeing the level of involvement
that CSIRTs had in the recovery and repair operations. We asked not only how CSIRTs affected
their response but also who in the organization actually performed the repair and recovery
operations.
The majority of the CSIRTs reported that the type of response they provide is either advice
via phone and email (74%) or the development and distribution of technical documents and
alerts (59%). Only 41% say they actually perform the recovery and repair of affected systems.
And only 21% pass reports on to others to handle.
Trends by sector include
• All of the banking and finance, information and communication, other commercial, and
83% of the education CSIRTs stated that they provide guidance via phone and email as
their primary method of response.
• None of the CSIRTs in the banking and finance, education, or information and communication
sectors stated that they passed on incident reports.
• 75% of the non-profit CSIRTs said that they provide response via phone and email guidance
or by passing on the incident. No non-profit stated that they repaired or recovered
the affected systems.
Trends by CSIRT model include
• None of the ad hoc teams stated that they passed on incidents.
• Coordination centers: 100% said that they provide advice via phone and email and by
publishing advisory. None stated that they passed on incidents.
• Combined teams: 100% stated that they provide response via phone and email guidance,
while none passed on incidents.
• Distributed dedicated teams: 100% provide response by phone and email guidance; 66%
also repair the systems themselves.
• Distributed part-time CSIRTs: 75% said they provide response via phone and email and
by repairing and recovering systems themselves.
It makes sense that distributed teams would be involved in the actual recovery and repair of
systems, as they are most likely located on-site, in comparison to centralized or coordinating
teams who are not on-site and who provide more guidance and support functions. In the same
CMU/SEI-2003-TR-001 99