State of the Practice of Computer Security Incident Response Teams ...

• lack of clearly defined mission and authority
• lack of coordination mechanisms
These issues were echoed by those participating in the CSIRT Organizational Survey when
asked about what are the biggest challenges facing their CSIRT. There was not one specific
challenge that was consistently listed or more frequently listed by the participating teams.
There was also not one particular type of challenge seen more by CSIRTs in any one sector or
any category or type of CSIRT. Survey results related to challenges faced by CSIRTs are
shown in Table 14.
Table 14: Challenges Faced by CSIRTs
Challenge
rapid growth of incident volume and workloads (including massive virus and worm
incidents)
Percentage
of
Respondents
14%
needing more budget and/or resources 14%
getting and retaining good staff 14%
management’s and business managers’ attitude about security, and the difficulty in
convincing them of the need for secure practices and response procedures
issues relating to the coordination and collaboration between units, CSIRTs, and
sites
getting more projects and work as they got better at their job was a challenge since
the workload kept growing
10%
10%
7%
collection and dissemination of information and follow-up from sites 7%
defining the role or authority of the CSIRT 7%
Other challenges cited included
• under-reporting and covering up of incidents by customers
• skill and knowledge at customer sites
• difficulty in prioritizing who gets what assistance
• difficulty in telling administrators what to do
• space issues
• setting up the CSIRT
CMU/SEI-2003-TR-001 129