State of the Practice of Computer Security Incident Response Teams ...

Although CSIRTs have been in existence since 1988, the development of CSIRTs and the incident
response field is still in its infancy. It has not yet become a standardized field of practice
but it is rapidly moving to a more standardized discipline. Many organizations are looking
to formalize their incident response methodologies, processes, and organizational
structures.
As organizations move to establish dedicated 1 or ad hoc 2 CSIRTs they are actively looking
for guidance to see what has worked for other similar organizations. They want to know how
many staff a CSIRT in a similar sector has, how they operate their incident response service,
or what tools they use to record and track incident reports.
Currently there are no standard answers to these questions. CSIRTs can take many forms and
have different requirements, responsibilities, functions, and structures. 3 We have seen CSIRTs
whose staff only review intrusion detection logs, while other CSIRT staff recover and rebuild
systems, provide security awareness training, analyze artifacts 4 , publish alerts and advisories,
and perform security audits and consulting.
This report is a start at collecting information about CSIRTs across a very broad canvas of
activities.
The information for this report was gathered through
• our collective experiences in working with CSIRTs in the incident response work we
have done over the years, the collaborations we have had, and the courses that we teach
• a literature search and review of related articles, books, and other documents concerning
incident response, including existing or pending laws, legislation, and regulations that
will have an impact on incident response work
• a pilot survey of CSIRT organizational structures. This survey was distributed to course
attendees at the 14th Annual Computer Security Incident Handling Conference (FIRST)
Conference in Hawaii in 2002 and to various other CSIRTs. Appendix A contains a copy
of the pilot survey form. 5
1
2
3
4
5
A formalized team is a capability where identified staff have been given the responsibility for both
reactive and proactive CSIRT work.
An ad hoc team is a team called together to handle an incident as it occurs. It is more reactive in
nature.
The different types of CSIRT organizational models are described in the SEI handbook CMU/SEI-
2003-HB-001, Organizational Models for CSIRTs, which will be published in the fall of 2003.
Artifacts are basically the remnants of an intruder attack or activity. For example, malicious code
or toolkits found on a compromised system would be considered artifacts.
If you are interesting in adding to the general knowledge of CSIRTs by filling out a survey, you
can request a copy via email from csirt-info@cert.org.
2 CMU/SEI-2003-TR-001