State of the Practice of Computer Security Incident Response Teams ...

REPORT DOCUMENTATION PAGE
Form Approved
OMB No. 0704-0188
Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching
existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding
this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Washington Headquarters
Services, Directorate for information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302, and to the Office of
Management and Budget, Paperwork Reduction Project (0704-0188), Washington, DC 20503.
1. AGENCY USE ONLY
(Leave Blank)
2. REPORT DATE
October 2003
3. REPORT TYPE AND DATES COVERED
Final
4. TITLE AND SUBTITLE
5. FUNDING NUMBERS
State of the Practice of Computer Security Incident Response Teams F19628-00-C-0003
(CSIRTs)
6. AUTHOR(S)
Georgia Killcrece, Klaus-Peter Kossakowski, Robin Ruefle, Mark Zajicek
7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)
Software Engineering Institute
Carnegie Mellon University
Pittsburgh, PA 15213
9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES)
HQ ESC/XPK
5 Eglin Street
Hanscom AFB, MA 01731-2116
11. SUPPLEMENTARY NOTES
8. PERFORMING ORGANIZATION
REPORT NUMBER
CMU/SEI-2003-TR-001
10. SPONSORING/MONITORING AGENCY
REPORT NUMBER
ESC-TR-2003-001
12A DISTRIBUTION/AVAILABILITY STATEMENT
Unclassified/Unlimited, DTIC, NTIS
13. ABSTRACT (MAXIMUM 200 WORDS)
12B DISTRIBUTION CODE
Keeping organizational information assets secure in today’s interconnected computing environment is a challenge
that becomes more difficult with each new “e” product and each new intruder tool. There is no one solution
for securing information assets; instead a multi-layered security strategy is required. One of the layers
that many organizations are including in their strategy today is a computer security incident response team, or
CSIRT. This report provides an objective study of the state of the practice of incident response, based on information
about how CSIRTs around the world are operating. It covers CSIRT services, projects, processes,
structures, and literature, as well as training, legal, and operational issues. The report can serve as a resource
both to new teams that are setting up their operations and to existing CSIRTs that are interested in
benchmarking their operations.
14. SUBJECT TERMS
CSIRT, computer security incident response team, incident handling,
incident response, computer emergency response team, incident
management, incident response management, CERT/CC, CERT Coordination
Center
16. PRICE CODE
15. NUMBER OF PAGES
290
17. SECURITY CLASSIFICATION
OF REPORT
Unclassified
18. SECURITY CLASSIFICATION OF
THIS PAGE
Unclassified
19. SECURITY CLASSIFICATION OF
ABSTRACT
Unclassified
20. LIMITATION OF ABSTRACT
NSN 7540-01-280-5500 Standard Form 298 (Rev. 2-89) Prescribed by ANSI Std. Z39-18 298-102
UL