State of the Practice of Computer Security Incident Response Teams ...

3.10.4 Tools
There are really very few tools that have been specifically created for incident response and
incident handling except for some of the products mentioned in the incident data collection
section above and customized tools created by CSIRTs themselves.
Many of the tools that are used by CSIRTs are also tools used by system and network administrators.
Various organizations have created tool archives that provide access to or review of
security and incident response tools. One of those projects is described below.
3.10.4.1 Clearinghouse for Incident Handling Tools (CHIHT)
Through the TERENA TF-CSIRT, a project and site has been established to serve as a clearinghouse
for incident handling tools. The tools listed are based on the experience and usage
of various European CSIRTs. The tools are listed for other teams to review and not as recommendations
for use. The tools are categorized in the following manner [CHIHT 03]:
• evidence gathering tools
− examining media
− examining systems and processes
• evidence investigation tools
− analyzing evidence
− checking identities and contacts
• system recovery tools
• CSIRT procedures
− incident tracking and reporting
− incident archives
− communications
• remote access tools
− remote network access
− secure dial-up access
− secure tunnels
• proactive tools
− network auditing
− host auditing
− security management
− network monitoring and traffic analysis
− network intrusion detection
For more information see:
http://chiht.dfn-cert.de/
CMU/SEI-2003-TR-001 127