State of the Practice of Computer Security Incident Response Teams ...

3.10.5 Research
CSIRTs and security experts are always looking to understand the intruder community better
to help teams and sites proactively protect their systems, networks, and critical assets. With
the computer security and incident response discipline still being relatively new, there are
different research projects currently in progress related to learning more about securing networks
and systems and also about effective incident handling. The following is one project in
progress.
3.10.5.1 The Honeynet Project
The Honeynet Project is a non-profit research group composed of volunteers from the security
field who are interested in researching tools, techniques, and activities of the intruder
community through the use of a Honeynet [Honeynet 03].
A Honeynet is essentially a network of systems deployed in a controlled environment that can
be watched and monitored for attacks and intruder activity. By watching attacks and probes
against the system or by monitoring how the system is compromised and used to attack others,
the system owners can learn about the techniques and tools used by the intruder community.
This information can then be used to improve the knowledge and understanding of other
computer security professionals.
The Honeynet Project is now in the third of four phases. The first phase provided a proof of
concept and provided the opportunity to capture and study attacks. The second phase was to
improve the methodology for the implementation, infrastructure, and deployment of a
Honeynet. The third phase, starting in 2003, is to develop a bootable CD that will allow participants
to easily deploy a standardized Honeynet. The fourth phase will be to develop a system
to automatically collect and synthesize data from the various Honeynet research projects.
The main purposes of the project are to raise awareness, teach and inform, and do research.
For more information see:
http://www.honeynet.org/
3.11 Current Problems
Problems and challenges faced by CSIRTs that are commonly mentioned in classes, conferences,
or other discussion venues include
• lack of funding
• lack of management support
• lack of trained incident handling staff
128 CMU/SEI-2003-TR-001