State of the Practice of Computer Security Incident Response Teams ...

Model
Coordinating CSIRT
Description
Often centralized, a coordinating CSIRT is located in one physical or
geographical location. In this model the CSIRT coordinates and facilitates
the handling of incidents across a variety of organizations.
The CSIRT can be a coordinating entity for individual subsidiaries of
a corporation, multiple branches of a military organization, branch
campuses in an educational organization, institutions in a research
network or specific domain or for a particular country or state. Coordinating
CSIRTs usually have a broader scope and a more diverse
constituency.
More information about these organizational models and structures can be found in Organizational
Models for CSIRTs.
In the pilot survey, we combined the above functional and organizational categories to create
the following list:
• security team (called an ad hoc team)s
• distributed dedicated team
• distributed part-time team
• centralized team
• coordination center
• analysis center
• managed security service provider
We then asked the participating teams to identify what category best described their CSIRT
structure. See Section 3.2.3, “Organizational Placement of the CSIRT,” for the survey results
of their responses.
CSIRTs can also be categorized by the sector in which they are located or in which their constituency
is located. The sectors can be consolidated into a few general categories: government,
research and education, national, commercial, and other.
The following list breaks the above categories into more detail. These were the sectors used
in the CSIRT Organizational Survey. See Figure 2, “Demographics of CSIRT Survey Participants,”
for the results of the pilot survey.
• military
• education
• information and communication
• electric power
16 CMU/SEI-2003-TR-001