State of the Practice of Computer Security Incident Response Teams ...

standards for incident handling methodologies or processes that are widely adopted, although
there are many projects currently in progress that are attempting to gain acceptance
and establish some standard mechanisms.
• Because of the newness of this field there is also no consistent structure or set of services
for a CSIRT. The nature of incident response makes it imperative that a team match the
goals and objectives of its constituency or parent organization. This means the services
offered and the structure of the CSIRT must be set up to support those being served. The
majority of teams do, however, offer some form of incident handling, development of security
policies, and development of alerts and advisories.
• There is no commonly used taxonomy for incident response and computer security terminology.
This can cause confusion when teams share data that has the same classification
name, but which may represent different things.
• Employees who are trained and experienced in incident response techniques and practices
are difficult to find.
• No established education path for CSIRT professionals exists as of today. Many incident
handling activities have evolved out of traditional system, network, and security administration.
Various training courses, as well as mentoring by experienced CSIRT members,
is what is currently available today to help educate incident handling staff. There are also
certification programs, but none has been adopted as a standard.
• There is a lack of publicly available sample templates for policies and procedures for use
in the day-to-day operations of a CSIRT.
• Few tools such as tailored help desks or trouble ticket solutions addressing the specific
needs of CSIRTs—authenticity and confidentiality, as well as workflows—are readily
available.
It has also been observed that CSIRT best practices do not currently exist in the following
areas:
• standards for interfaces—a team’s location within the organization, with whom they interact
(internally and externally), what is reported, how that occurs, etc.
• data management—how teams manage, access, archive, and share their CSIRT data
• professional standards—the formal or official specification for what a CSIRT comprises
and the staff who perform the work
134 CMU/SEI-2003-TR-001