State of the Practice of Computer Security Incident Response Teams ...

against what others are doing. Appendix E contains copies of some incident reporting forms,
which are included with the permission of the author or owner of the material.
As we reviewed the literature, we found that there are similarities in some of the forms and
documents that have been developed. For example, as might be expected, the flowcharts illustrated
in Mandia [Mandia 01, p. 18] and Nebraska [Nebraska 02] have many similar components,
including pre-incident preparation, detection, and decision points for determining
the next steps in the process (such as confirming an incident, formulating a response strategy,
notifying and/or coordinating with contacts, documenting, and restoring operations). In addition,
steps for investigative activities (forensics duplication, network monitoring, etc.) are
steps included in the flow diagrams. Other forms and documents contain similarities in the
type of information that is collected—what we refer to as the “critical information” that is
needed regarding an event that has been reported to the CSIRT. This includes relevant contact
information, hostnames, IP addresses, OS versions/patch levels, chronology documenting the
activity, and actions for response and follow up.
In Section 3.7.2, “Having a Plan,” we referred to the fact that many of the documents we reviewed
in the literature search included a variety of different incident response processes or
steps. For example, there are copies (or online versions of) incident reporting forms included
in a number of publications [DHS 03, FCC 01, Kruse 02, Navy 96, Nebraska 02, SANS 03,
USSS 01]. A variety of incident reporting and response flowcharts are referenced [Mandia 01,
Kruse 02, Nebraska 02, Steele 02] and process guides or checklists available [Allen 01,
Swanson 02, Vermont 01]. 148 Descriptions of an incident response process or methodology
are included in several sources [Allen 01, SANS 03, Schultz 02, Symantec 01, West-Brown
03]. More detailed guidance on response procedures 149 can be found in some [Allen 01, Mandia,
01, SANS 03, Schiffman 01].
148
149
While the CERT Guide to System and Network Security Practices [Allen 01] and the NIST Contingency
Planning Guide for Information Technology Systems [Swanson 02] are targeted at system
and network administrators or other IT professionals, the processes and practices are applicable in
many areas of CSIRT work and may be worth reviewing.
Response procedures are the specific steps recommended for protecting systems, detecting and
responding to intrusions, and returning systems to normal operations.
CMU/SEI-2003-TR-001 131