State of the Practice of Computer Security Incident Response Teams ...

2 Computer Security Incident Response
Teams
2.1 What is a CSIRT?
Computer networks have revolutionized the way business is done, but they have also introduced
substantial risk. Changes in society’s use of technology have provided new opportunities
for intrusions. Changes in organizational data protection requirements, local and national
laws, and institutional regulations have made it imperative to address security concerns at an
enterprise level. Even the best information security infrastructure cannot guarantee that intrusions
or other malicious acts will not happen. When computer security incidents occur, it is
critical for an organization to have an effective way to respond. The speed with which an organization
can recognize, analyze, and respond to an incident will limit the damage and lower
the cost of recovery.
A CSIRT is a service organization that is responsible for receiving, reviewing, and responding
to computer security incident reports and activity. Its services are usually performed for a
defined constituency that could be a parent entity such as a corporation, government, or educational
organization; a region or country; a research network; or a paid client.
Part of a CSIRT’s function can be compared in concept to a fire department. When a fire occurs,
the fire department is called into action. They go to the scene, review the damage, analyze
the fire pattern, and determine the course of action to take. They then contain the fire and
extinguish it. This is similar to the reactive functions of a CSIRT. A CSIRT will receive requests
for assistance and reports of threats, attack, scans, misuse of resources, or unauthorized
access to data and information assets. They will analyze the report and determine what
they think is happening and the course of action to take to mitigate the situation and resolve
the problem.
Just as a fire department can be proactive by providing fire-prevention training, instructing
families in the best manner to safely exit a burning building, and promoting the installation of
smoke alarms and the purchase of fire escape ladders, a CSIRT may also perform a proactive
CMU/SEI-2003-TR-001 11