State of the Practice of Computer Security Incident Response Teams ...

way, the combined and coordination centers seem to rely more on coordination of response
and mitigation strategies. The centralized teams had no particular set of response options
across the participating teams; they provide response across all categories of response options.
3.7.7.1 Who Rebuilds Systems?
When asked explicitly who rebuilds and recovers any affected systems, the participating
CSIRTs provided the following information:
• 59% of participants stated that the IT department, not the CSIRT, recovers and rebuilds
affected systems.
• All of the CSIRTs in the commercial sector said that the IT department recovers and rebuilds
systems.
• Most of the other sectors stated that both the IT and CSIRT did recovery and rebuilding.
All of the teams identified as distributed dedicated teams said that only the IT department
recovered and rebuilt systems. All other types had either IT or CSIRT or both. No matter
where the CSIRT reported—to the IT department or security department, or if the CSIRT was
its own department—there was no consistent answer to who recovered and repaired the systems;
it was IT, CSIRT, or both.
3.7.8 Computer Forensics Activities
One area of incident analysis and response that is receiving a lot of attention is computer forensics
or forensic evidence collection. More teams are learning this analysis technique and
more tools are becoming widely available.
There is also growth in reference materials and training available concerning forensics. Many
of the authors in the literature refer to investigating computer security incidents (events, attacks,
other unauthorized activity) as “computer forensics” [Caloyannides 01, Kruse 02] or
“cyber forensics” [Marcella 02].
In 2002 Information Security magazine conducted a review of selected books on the topic of
forensics and highlighted what was covered in each. 105 This magazine also devoted much of
their April 2002 issue to articles on computer forensics and a few case studies [Kessler 02].
Schultz devotes two chapters to an overview of forensics, describing approaches for several
types of searches that can be performed, what to look for, how to conduct the investigation,
105
For a summary, see .
100 CMU/SEI-2003-TR-001