State of the Practice of Computer Security Incident Response Teams ...

mission, 51, 74, 77, 84, 90, 93, 98, 105,
124, 129
mission statement, 51
misuse of resources, 11
models, 15, 53, 69, 72, 89, 99, 107, 108,
137
monitoring
IDS, 68, 70
of network and system logs, 68
Morris Worm, 17
MSSPs, 16, 44, 46, 51, 55, 99
multi-layered security strategy, 1
mutual assistance, 117
Mx-CERT, 30, 31
MyCERT, 29, 55, 56
NASA, 19, 21
NASA ARC CNSRT, 21
National Autonomus University of
Mexico, 31
National Computer Security Center, 18
National Cyber Security Division, 34
National Hurricane Preparedness Center,
97
National Institute of Justice, 115
National Institute of Standards and
Technology. See NIST
national research networks, 22, 44
National Security Agency, 18, 79
Naval Computer Incident Response Team
(NAVCIRT), 21
NBSO, 30, 31
Nebraska, State of, 85
network
activity, 125
administrators, 5
monitoring programs, 88
sensors, 88
services, 17
sniffer programs, 109
surveillance techniques, 130
New South Wales Police, 82
New Technologies Inc. (NTI), 159
NIC BR Security Office - Brazilian
Computer Emergency Response
Team, 30
Nimda worm, 114
NIST, 19, 20, 21, 83, 161, 163
NIST Contingency Planning Guide for
Information Technology Systems, 131
NIST Special Publication 800-34, 153
NITC, 92
no authority, 53
non-disclosure agreements, 75, 77, 106
notification lists, 112
NT/2000, 101
number of incidents, 104
Office of Critical Infrastructure Protection
and Emergency Preparedness
(OCIPEP), 33
off-the-shelf recording products, 94
OILZ, 20, 21
operational coordination, 135
operational guidance, 74
Oracle, 94
organizational models. See models
Organizational Models for CSIRTs, 5, 6,
16, 65
organizational structure, 49, 135
orientation, of new employees, 77
Ottawa, 33
outsourcing, 65, 75, 101
parent organization funding, 55
part-time staff, 72
penetration testing, 68, 75
perpetrators, 105
personnel. See staff
Pethia, Richard D., 20
PGP, 105
PH-CERT, 29
Philippine Computer Emergency
Response Teams, 29
PHP, 125
pitfalls, 48
plan of action, 14
platform specialists, 73, 75
point of contact, 24, 28, 85, 117
policies and procedures, 47, 59, 75, 83,
84, 86, 98, 108, 112, 115, 124, 127,
134, 179
policy attributes, 109
policy design and implementation, 108
polymorphic tools, 111
postmortem, 83
post-secondary education institutions, 49
practices, 82
preparation/protection, 83, 86, 133
PRESECURE, 159
Presidential Decision Directive 63, 173
Pretty Good Privacy, 105
prioritizing
activities, 106, 129
incidents, 95
268 CMU/SEI-2003-TR-001