State of the Practice of Computer Security Incident Response Teams ...

For more information see:
http://cert.uni-stuttgart.de/projects/caif/
3.10.2.4 Guidelines for Evidence Collection and Archiving (RFC 3227,
Best Practice)
This RFC provides high-level guidelines for collecting and archiving data related to an intrusion.
It presents best practice recommendations for determining volatility of data, deciding
what to collect, performing the collection, and determining how to store and document the
data. It also brings up topics to consider concerning privacy and legal issues when collecting
intrusion data.
For more information see:
http://www.ietf.org/rfc/rfc3227.txt
3.10.2.5 Australian Standard for Managing IT Evidence (HB-171-2003)
This standard “provides guidance on the management of electronic records that may be used
as evidence in judicial or administrative proceedings, whether as a plaintiff, defendant, or
witness.” It specifically deals with litigation in Australia, but is based on general best practices
in forensic evidence collection and IT security [HB171].
For more information see:
http://www.standards.com.au/catalogue/script/Details.asp?DocN=AS342335504743
3.10.2.6 Expectations for Computer Security Incident Response (RFC
2350, Best Practice)
One of the older best practice documents that involved CSIRTs was the “Expectations for
Computer Security Incident Response” RFC. This document provides guidance on the type of
information that should be published to a CSIRT’s constituency and to other CSIRTs. It discusses
defining the CSIRT’s mission, charter, constituency, services, policies, and procedures.
For more information see:
http://www.ietf.org/rfc/rfc2350.txt
3.10.3 Incident Data Collection
New teams are always looking for tools to not only help them collect incident data but also to
compare how their incident activity compares with other sites and organizations. During an
incident, a team will often need to determine if what they are seeing is limited to their systems
or is more widespread. Various organizations have been developing tools or mecha-
124 CMU/SEI-2003-TR-001