State of the Practice of Computer Security Incident Response Teams ...

Effective teams will have a plan in place for how such coordination and interaction occurs so
that when an event happens, the team is positioned to quickly and efficiently orchestrate such
activities. This could include having pre-determined contacts set up (names, phone numbers,
email addresses, encryption keys) and/or tools to support disseminating information (tools to
extract relevant log information, mailing lists and mail merge tools to automate contacting
sites, automated tools to look up contact information from whois servers, etc.). There may be
pre-arranged non-disclosure agreements that are signed between the CSIRT and other external
contacts (for example, trusted experts who might assist in incident or vulnerability analysis).
Identifying the appropriate level of detail for what data is shared with others might be worked
out or negotiated prior to an event, but it has also been the case that such arrangements may
need to be made as an incident is unfolding and the incident is being analyzed. To the extent
that it is possible to determine beforehand who the team will share information with, how to
contact them, at what level of detail data is provided, and the method for dissemination or
access to that data, the more the CSIRT will be able to undertake such information sharing
efficiently and effectively. Some level of trust will also have to be discussed and agreed to.
This will involve what will be done with shared information, how confidential information
will be exchanged, and also with whom this information will be shared.
Van Wyk discusses pulling together the key players and having a Crisis Action Meeting to
determine appropriate actions for coordination and communication with others [van Wyk 01].
Part of such activity will determine what needs to be done allowing the team to then prioritize
those actions. Schultz also provides suggestions for establishing relationships with external
entities similar to those mentioned above [Schultz 02].
Depending on the CSIRT constituency and parent or host organization, who the CSIRT shares
information and data with and who a CSIRT coordinates response with can vary. We asked
the CSIRTs who participated in the survey with whom they coordinated their response and
with whom they shared data. Their responses are discussed in the following two sections.
3.7.14.1 With Whom Does the CSIRT Coordinate Activities?
CSIRTs coordinate response activities with internal departments and externally with other
CSIRTs, law enforcement agencies, and security experts. Of the CSIRTs that participated in
the survey,
• 66% coordinate their response activities with their CIO, IT and telecommunications departments,
or law enforcement
• 58% coordinate with other CSIRTs
• 41% coordinate with their legal department
106 CMU/SEI-2003-TR-001