State of the Practice of Computer Security Incident Response Teams ...

The participating CSIRTs also represented teams that had been in operation for over two
years (62%) and those who were just starting 8 (21%). The modal 9 years of operation for the
CSIRTs participating were four to six years (34%). The rest fell into the one to two year range
(28%) and the seven to eight year range (17%).
Only 17% of the participating CSIRTs stated that their CSIRT was located across multiple
countries. The number of countries that these CSIRTs were distributed across ranged from 2
to 103. The CSIRT located in 103 countries was in the banking and finance sector. 10
1.7 About the Literature Search
In 1988, when the CERT Coordination Center (CERT/CC) was established, there was not
much information available that described incident response or incident handling in detail.
The good news today is that there is a growing body of literature that is available and that can
be easily found using your favorite web search engine. (For example, at the time we were
writing this document, a search on incident response provided about 15,000 links—some
were duplicates, others were pointers to bookstores, sites, articles, and other references on
this topic.) The more challenging task is sifting through all this data to find information that
meets your specific requirements for incident handling operations and building a CSIRT capability.
In our literature review for this state of the practice, we examined books, white papers, articles,
guidelines, procedures, and other similar information and research available on the web
and in print.
Our examination of the literature identified a few broad-based observations that will be of
interest to new or existing CSIRTs to further increase their overall knowledge and understanding
of incident handling, team responsibilities, team composition, and policy and procedure
issues:
• There is a growing base of anecdotal and case study information appearing in print about
not only the formation and organization of CSIRTs, but also on the general types of activities
these teams undertake and how they perform them.
• More information is available about the management and costs related to building and
operating incident response teams.
8
9
10
In operation for less than one year.
Modal in this case means the most frequently reported.
In talking to other corporate CSIRTs, it was often the case that those that support multinational
corporations have distributed teams in each country where their branch offices are located.
8 CMU/SEI-2003-TR-001