State of the Practice of Computer Security Incident Response Teams ...

the other teams. Again, the community of European research networks supported this idea of
a centralized European CSIRT and funding was established for a task force to develop a
roadmap for the future of CSIRTs in Europe.
2.3.3.1 Development of EuroCERT
The TERENA 21 task force “CERTs in Europe” final report recognized not only the need for
the establishment of more local teams situated near to the constituency experiencing the attacks
and incidents, but also the need for some type of coordination to improve the overall
interaction between teams [Ferriera 96]. This was seen as a way to provide a higher level of
support in Europe for incident handling activities than could be provided with one team acting
alone. This approach led to a three-year period in which various projects were suggested,
prepared, and drafted, finally culminating in a proposal for a European coordination center.
This project was started later in 1997 and continued through 1999 as EuroCERT [Kossakowski
96].
There were various problems with this project, as some CSIRTs saw EuroCERT as competing
with their own activities and thought that the agreements already in place between teams
were efficient enough to not need facilitation or support by another organization or level of
hierarchy. The failure of EuroCERT did not prove that coordination of CSIRTs could not be
done; it showed rather that any coordination needed to be different from that which already
existed. It needed to add value to the overall processes already in place and it needed to provide
functions that were not possible under the existing individual CSIRT agreements. These
problems are not inherent to European CSIRTs and organizations; similar problems have been
seen in the development of CSIRT coordination efforts in various organizations, whether in
an educational, governmental, or commercial setting. The resulting lesson learned is an important
one that other inter-organizational CSIRT coordination efforts should keep in mind as
they work to develop collaboration and coordination mechanisms in their own area or region.
Problems that still needed to be addressed regarding coordination between European CSIRTs
included the following:
• The existence of so many teams made it increasingly impractical to maintain relations of
the same quality with all other teams.
• It was highly unlikely that CSIRTs from one country would understand the differences
between CSIRTs in another. It would be much more convenient to provide one common
point of contact rather than, for example, having a French team need to decide which
German team to notify or coordinate with.
21
TERENA is the Trans-European Research and Networking Association. More information can be
found at .
24 CMU/SEI-2003-TR-001