State of the Practice of Computer Security Incident Response Teams ...

Mandia captures it very nicely: “Words that go together: Sonny and Cher, Donnie and Marie,
and Policies and Procedures. You cannot talk about one without the other” [Mandia 01]. In
the CERT CSIRT Development Team training courses, we define CSIRT policies as “what
you want to do” and CSIRT procedures as “the step-by-step instructions for how you do it.”
In the absence of well-defined policies and procedures, incident handling staff (and your constituency
for that matter) will make up their own rules and guidelines. The lack of these
documents can be detrimental to the success of the CSIRT.
The Handbook for CSIRTs provides an overview of policy attributes, listing management endorsement,
clarity, need, usability, implementation, and enforcement [West-Brown 03]. Included
in the description of each of these attributes are tips or sample statements to help the
reader in developing such policies. Some of the typical policy content features are also identified,
along with suggestions about how these might be defined in the policy.
In a recent InfoSecurity News magazine devoted to computer forensics articles, Rothke discusses
having an incident response staff and comprehensive policies and procedures, and
states, “If there are no policies and procedures in place, there is no way to ascertain that
things are being done properly” [Rothke 02].
Symantec’s white paper on planning for incident response discusses the need to establish
policies and procedures. “Without policies and procedures, employees have no understanding
about what is and is not acceptable” [Symantec 02].
3.8 Changes in Intruder Attacks and Tools
As time goes by, the types of computer security incidents and attacks, along with methods,
tools, and techniques used by intruders, continue to evolve. During the 1980s, intruders primarily
exploited passwords and known vulnerabilities to gain unauthorized access to computer
systems. Later, intruders moved on to exploit protocol flaws, examine source code for
new security flaws, install network sniffer programs, use IP source address spoofing in attacks,
and conduct widespread, automated scanning of the Internet to identify additional targets.
In each of these progressions, the more knowledgeable intruders have transferred their
“expertise” to novices by creating easy-to-use exploitation scripts and increasingly sophisticated
toolkits, while taking advantage of the currently available technologies.
Figure 14 demonstrates how the required intruder knowledge (curved line) has decreased
over time in comparison to the increase in the sophistication of attacks and intruder tools
(straight line). Today intruders with little knowledge can execute sophisticated attacks with
the click of a button, as the intruder tools have combined and automated tools for finding and
exploiting vulnerable systems.
CMU/SEI-2003-TR-001 109