State of the Practice of Computer Security Incident Response Teams ...

After the worm had been successfully contained, the National Computer Security Center (part
of the National Security Agency), initiated a series of meetings to discuss how to prevent and
respond to such occurrences in the future. On November 8, 1988, a postmortem meeting was
organized by the Defense Advanced Research Projects Agency (DARPA) to review and discuss
the lessons learned from the worm activity and related response. These were some of the
observations made:
• Participating staff at various major universities and computer centers were able to do a
successful analysis of the worm and resulting activity while the incident was happening,
even though not every detail of the worm attack and propagation was fully analyzed at
that time. It was also determined that some important aspects of the worm propagation
were not immediately recognized by some sites, resulting in more systems being infected.
In review, it could be seen that many sites were doing duplicate work in trying to analyze
the worm, and this time would have been better spent if they had collaborated. It was determined
that if all involved would have been able to communicate and compare their results,
the complete analysis would have been available much earlier, leading to both a
quicker containment of the worm and earlier recovery or protection of systems.
• The corrective measures derived from the analysis could have prevented further infections.
Because there was not a communication means available, distribution of the measures
to all who needed the information was not possible and many sites did not get the information
in a timely manner.
• The damage recovery was painful but straightforward, as long as the affected organization
had trusted backups available. But because the complete corrective measures could
not be distributed to all involved, many sites saw their recovered hosts become reinfected.
It was concluded that the most problematic part of the response effort was the missing communication
mechanisms. With many sites disconnecting from the network to contain the
worm activity and repair and recover their systems, and with much of the Internet mail service
inoperative due to the servers and relays being infected, there was not a quick and viable
way to get notification out to the Internet community on how to protect their systems from
the activity or respond if they were infected. Overall, the basic problem was that there was
not a formal method of coordination to handle such a computer security attack and the related
analysis and response.
In recognition of this problem, DARPA announced its intention to fund the development of a
coordination center for Internet security incidents. DARPA chose the Software Engineering
Institute 13 as the new center’s home. DARPA charged the SEI SM with establishing a capability
13
SM
The Software Engineering Institute (SEI) is a Federally Funded Research and Development Center.
For more information see .
SEI is a service mark of Carnegie Mellon University.
18 CMU/SEI-2003-TR-001