State of the Practice of Computer Security Incident Response Teams ...

ole. This may include providing security awareness training, security consulting, configuration
maintenance, and producing technical documents and advisories. 11
A majority of CSIRTs started as “response-oriented” organizations, but have since developed
into organizations that work proactively to defend and protect the critical assets of organizations
and the Internet community in general. This proactive work can also include influencing
policy, and coordinating workshops and information exchanges. It also includes analyzing
intruder trends and patterns to create a better understanding of the changing environment so
that corresponding prevention, mitigation, and response strategies can be developed and disseminated.
When utilized to its fullest extent, however, a CSIRT is more than an incident response capability.
The goals of a CSIRT must be based on the business goals of the constituent or parent
organizations. Protecting critical assets is key to the success of both an organization and its
CSIRT. The goal of a CSIRT, in this context, is to minimize and control the damage, provide
effective response and recovery, and work to prevent future events from happening. In this
role the CSIRT collects incident information, security weaknesses, and software and system
vulnerabilities in the organizational infrastructure or within a constituency.
In a commercial, military, educational, or government setting, the CSIRT becomes a focal
point for business intelligence within the organization and a primary source of authentic risk
data. This information can provide an important data feed into operational risk modeling. The
CSIRT can be seen as a key element in loss minimization and risk mitigation. In this same
manner, the CSIRT’s role as a central repository allows it to gather an enterprise-wide picture
of security issues as it relates across the organization. This also allows the CSIRT to link together
events that may not have been seen to be related when looked at individually.
A CSIRT can be on-site and able to conduct a rapid response to contain a computer security
incident and recover from it. CSIRTs may also have familiarity with the compromised systems
and therefore be more readily able to coordinate the recovery and propose mitigation
and response strategies. Their relationships with other CSIRTs and security organizations can
facilitate the sharing of response strategies and early alerts to potential problems.
CSIRTs can work with other areas of the organization to ensure new systems are developed
and deployed with security in mind and in conformance with any site security policies. They
can help identify vulnerable areas of the organization and in some cases perform vulnerability
assessments and incident detection services. In their coordination function, they can be a central
point that pulls together information and analysis from the physical security sector, the IT
11
For a description of these various services see the CSIRT Services list at
.
12 CMU/SEI-2003-TR-001