State of the Practice of Computer Security Incident Response Teams ...

In the CSIRT community as a whole, there is general agreement that standards are needed
and that some minimal support is needed for automating incident tracking, response, and
analysis. 150
There are various projects and discussions currently under way that address many of these
issues. Critical and relevant discussions include
• incident data exchange: how to develop and utilize a common and easy-to-use mechanism
to allow sharing of data between teams and synthesis of collected data
• trusted introducers: what type of mechanisms are needed to help identify and verify teams
• operational coordination: what types of mechanisms for incident handling coordination
between various geographic areas and groups of CSIRTs in order to quickly control and
contain incident activity, share expertise, analysis, and data, and then effect a coordinated
response
• formalization of procedures and formats: what types of standards are appropriate and can
be applied to teams. Various standards are currently being sought by the community in all
areas, from common incident tracking systems to advisory preparation and data collection
and exchange.
• requirements for establishing a CSIRT capability: Teams are looking for methods to
evaluate their effectiveness. They want to baseline their operations and services against a
set of basic requirements and best practices.
• vulnerability disclosure: How, when, and to what extent to disclose vulnerability information
has been a highly volatile topic in the incident response and computer security
community. Various discussions are underway to determine if there can be any agreedupon
standards or processes in this area.
• certification and training: What types of training and certification should a member of an incident
handling team should be required to have? Many teams are struggling with these issues
today, along with the fact that just finding skilled incident handlers is not an easy task.
As previously mentioned throughout this report, each of the above depends on a variety of
factors, such as the mission or role of the CSIRT and its constituency, along with its organizational
structure, funding, and staffing. Because of this, it may not be possible to set standards
that every CSIRT would be able to follow. In a general sense, however, some “best practices”
should be possible across many CSIRTs—even if the specific implementation for how the
practice is performed is different. For example, from our observations and experience, we can
generally agree that, to be effective, CSIRTs require the following:
150
An example of standards development is the IODEF activity in the IETF INCH Working Group,
which strives to define a common data format for sharing incident handling data between different
CSIRTs.
CMU/SEI-2003-TR-001 135