State of the Practice of Computer Security Incident Response Teams ...

ganizations, and government organizations. The 2003 FIRST conference was held in Ottawa,
the Canadian capital.
Many different CSIRT initiatives at various levels of government in Canada are being implemented.
Work is going on at the country, province, territory, and city level. Some provincial
government CSIRTs have been operating for a few years, while others are in the process
of standing up their team.
The focal point of incident handling at the country level is the Office of Critical Infrastructure
Protection and Emergency Preparedness) (OCIPEP). OCIPEP is a civilian organization operating
in the Canadian government’s Department of National Defence. OCIPEP works under
the concept of partnerships. Its web site states that “protecting critical infrastructure and responding
to emergencies is a shared responsibility in Canada, requiring the full cooperation
and effort of Government of Canada departments and agencies, provinces and territories,
municipalities and the private sector” [OCIPEP 03].
“OCIPEP’s Infrastructure Protection Coordination Centre monitors physical and cyber threats
(24 hours a day/7 days per week) and serves as a central point of contact for threat and incident
information. Related information is currently received from and sent to the Government
of Canada, provincial and territorial governments, and the private sector” [OCIPEP 03].
2.3.7 Developments in the United States
Many different types of CSIRTs have also been developing over the years in the United
States. As can be seen in the next section, there are currently over 70 U.S. teams that are
FIRST members. These teams come from many sectors, including military, government, education,
critical-infrastructures, financial, ISP, non-profit, and commercial organizations.
There are many, many more U.S. teams that are not FIRST members. Some of the areas
where we see the biggest growth in CSIRTs have been commercial and critical infrastructure
organizations. Most branches of the U.S. military have their own CSIRTs. Many federal
agencies also have their own teams or are in the process of creating them.
One of the newest areas where we see interest and initiatives in creating CSIRTs is at the state
government level. State governments are receiving mounting pressure to meet their compliance
requirements with various laws and regulations regarding data privacy and cyber security.
In 2003 a report by Zeichner Risk Analytics concluded that the majority of states have
not met these requirements and regulations. The report also called for states to work together
to come up with a nationwide process for implementing and developing cyber-security laws
and policies [Zeichner 03].
CMU/SEI-2003-TR-001 33