State of the Practice of Computer Security Incident Response Teams ...

As the volume of incident and vulnerability reports continue to rise, 115 and the automation
and speed of many attack tools continue to increase, CSIRT and information security staff
members now have less time to react to new threats. For example, where the 1999 Melissa
virus propagated around the Internet within days, the 2000 Love Letter worm circulated the
globe in one day, the 2001 Code Red and Nimda worms reached global saturation in less than
18 hours, and the 2003 SQL/Slammer Worm reached saturation on vulnerable servers within
in 10-18 minutes. Every passing minute of unprotected exposure or delayed response against
an attack increases the likelihood that that attack may succeed or have some detrimental effects
against the vulnerable target. The rapid spread of attacks points to the fact that reactive
activities alone cannot sustain CSIRT work. CSIRTs must work with organizations to proactively
protect systems and resources.
3.9 Legal Issues and Cyber Crime Laws
Although the analysis of computer security incidents often focuses on the technical issues of
an incident (primarily the “what” and the “how”), there may be occasions when a CSIRT
might need to become involved in the investigative process (the “who” and the “why”), or at
least work closely with those who have such an investigative role. If there is any intention to
report an incident to the appropriate law enforcement agencies, it will be important for
CSIRT members to understand the legal issues involved and to have some familiarity with
the relevant laws in the affected jurisdiction.
Generally, computer crimes include traditional crimes (such as theft and fraud) that are committed
with the use of computers, and cyber crimes that are committed against computers
(viruses, denial of service attacks). In addition to statutory laws that have been enacted by
legislatures, there are also common laws or case laws that are the result of court decisions and
judicial opinions. While the statutory computer crime laws continue their slow growth and
evolution, new case laws are also developing on an ongoing basis.
It is important for CSIRT members to also be familiar with any privacy laws that provide protection
to others, in order to avoid the possible suppression of any improperly gathered evidence
that is intended to be presented in a court of law, as well as to avoid potential criminal
or civil liability. (In many jurisdictions, for example, laws may prohibit the unlawful interception
of, or access to, transmitted and stored data and communications; this may also include
prohibiting access to that data by system administrators or incident handlers if certain
conditions are not met.)
115
See .
114 CMU/SEI-2003-TR-001