State of the Practice of Computer Security Incident Response Teams ...

Up until this point, only one or two European security experts had attended the annual CSIRT
conference, which at that time was still being organized and hosted by the CERT/CC. 16 This
began to change in 1992, particularly in the European research networks. As the number of
hosts on the various European networks began to climb past 10,000, there was more need for
computer and network security. As more incidents took place, those with an understanding of
the CSIRT concept began to look for ways to work together. In 1992 a working group organized
by the Association of European Research Networks reviewed the situation. There was
agreement that CSIRT efforts in each national research network would bring a real benefit. It
was expected that each European team would cooperate with the others by sharing responsibilities
for communicating new vulnerabilities and security developments when they affected
all teams, but that each particular team would concentrate on its own constituent community.
This concept, to concentrate on one particular constituency but collaborate with other CSIRTs
and security experts, is one of the key unchanged principles of the CSIRT community today.
As a result of the European working group, various national research networks started their
own projects to establish CSIRTs for their organizational constituencies. As was common in
this arena, teams were established along different guidelines and offered different services
based on the needs of the community. Examples of two different types of teams that were
established within the European research community are CERT-NL and DFN-CERT.
• The SURFnet Computer Security Incident Response Team (CERT-NL) was established
by SURFnet, the Dutch research network, as a decentralized team. The team was staffed
with two members of SURFnet working in cooperation with experienced specialists from
other universities in the research network that could help provide broader expertise and
also help provide coverage outside of their normal working hours. Since this was created
as an internal project within SURFnet, there was not much of a delay in getting the team
up and running. The CERT-NL team became active in 1992. 17
• The Computer Emergency Response Team for the German Research Network DFN
(DFN-CERT) was established as a centralized team. The team was located at a university
that was a member of the network. Therefore, from a viewpoint of other universities, the
work was handled by “external” staff (to their organization) but from another “internal”
organization (of the whole network). No coverage was provided outside of normal working
hours. As this was an external project, a call for tender process 18 was necessary,
which resulted in a delay in establishing the team. DFN-CERT became active on the first
working day of 1993.
16
17
18
The first five conferences were sponsored and hosted by CERT/CC. Since 1994; a different organization
has sponsored and hosted the conference each year. See
.
For more information on SURFnet see .
A call for tender is a call for proposals, in which people or organizations are asked to provide a bid
for performing some type of work.
22 CMU/SEI-2003-TR-001