State of the Practice of Computer Security Incident Response Teams ...

service managers or customers. Such emergency situations need to be addressed in any response
plans and in any authority given to the CSIRT.
The speed with which such malicious attacks spread have reinforced the need for a good incident
response plan to be in place, including established channels of communication, identified
response staff, notification lists, and established recovery policies and procedures. Involvement
of the CSIRT in the configuration of the constituency infrastructure is also
important, as the only response is often to stop the incident from happening at your site, by
ensuring your site is not vulnerable or has good perimeter defenses and host configurations.
Other trends previously noted by the CERT/CC have warned of attacks against Windowsbased
targets, especially in DoS attacks, 110 as well as attackers increasingly targeting home
users’ systems because of their wide availability, high bandwidth, and relative lack of security.
The CERT/CC has created a section on their web site for home users, 111 containing a
number of articles, as well as a document titled “Home Network Security.” 112
These trends outlined by the CERT/CC indicate that organizations relying on the Internet face
significant challenges to ensure that their networks operate safely and that their systems continue
to provide critical services even in the face of attack.
3.8.1 Impact on Incident Response
The growing threats caused by intruder attack trends have affected the way in which CSIRT
staff must respond. The sheer number of attacks that are detected and reported continues to
rise, with many CSIRTs typically seeing a doubling (or more) in the rate of new incident reports
with each passing year. Annual incident statistics posted by the CERT/CC 113 and the
CSI/FBI Computer Crime and Security Surveys 114 are frequently cited as examples of the
growing rate of incident reports.
110
111
112
113
114
“Trends in Denial of Service Attack Technology”
“Home Network Security”
112 CMU/SEI-2003-TR-001