State of the Practice of Computer Security Incident Response Teams ...

4 Summary
Our examination of the literature identified a few broad-based observations that will be of
interest to new and existing CSIRTs. This information can be used to further increase their
overall knowledge and understanding of incident handling, team responsibilities, team composition,
techniques and procedures, and policy issues.
• There is a growing base of anecdotal and case study information appearing in print about
not only the formation and organization of CSIRTs, but also the general types of activities
these teams undertake and how they perform them.
• More information is available about the management and costs related to building and
operating incident response teams.
• There are some common functional processes for performing incident handling activities
in a CSIRT. Even if these processes are grouped somewhat differently in the articles and
publications discussed in this technical report, the basic processes revolve around the following
tasks: prepare/protect, detect, respond, improve. See Section 3.7.7 for more detailed
information.
• There are many similarities in CSIRT processes; however, in the day-to-day operations of
a CSIRT, the way in which these processes are implemented and the depth and breadth of
the services that are provided may be very different.
Based on (a) our collective experience, (b) the reviewed literature, web sites, and CSIRT project
information, and (c) the collected survey data, we see the current state of the practice for
CSIRTs as follows:
• All evidence points to a large growth in the number of incident response teams over the
past four to five years. This growth has primarily taken place in the commercial sector.
Growth in education and government teams has also continued. Others seeking to create
CSIRTs include organizations in critical infrastructures such as the finance/banking and
power/energy sectors. Globally we are seeing more interest in implementing CSIRTs, especially
national and local government teams.:
• The reasons for the growth in teams include (a) the increase in the number of security
incidents and the recognition of a need for a planned response, (b) new legal requirements,
and (c) the current view that computer security must be proactive to be successful;
being reactive is no longer sufficient.
• Incident handling and incident response teams are still relatively new areas in computer
security, and incident response is still an immature field. Because of this there are few
CMU/SEI-2003-TR-001 133