State of the Practice of Computer Security Incident Response Teams ...

In September 2003, the U.S. Department of Homeland Security (DHS), in conjunction with
Carnegie Mellon University, announced the formation of the United States Computer Emergency
Response Team (US-CERT). The main goals of the US-CERT will be to work with
public and private sectors to
• improve warning of and response to incidents
• increase coordination of response information
• reduce vulnerabilities
• enhance prevention and protection efforts [US-CERT 03]
“The US-CERT will begin as a partnership between the National Cyber Security Division
(NCSD) within DHS and Carnegie Mellon’s CERT/CC. The US-CERT will grow to include
other partnerships with private-sector security vendors and domestic and international organizations.
These groups will work together to coordinate national and international efforts
to prevent cyber attacks, protect systems, and respond to the effects of cyber attacks across
the Internet” 47 [SEI 03].
2.3.8 Other Initiatives in CSIRT Development and Evolution
In 1995 a working group on Guidelines and Recommendations for Incident Processing (GRIP)
was formed by the Internet Engineering Task Force (IETF). Its purpose was to develop guidelines
for providing consistent information about CSIRTs to those internal and external to a
team’s constituency. 48 The GRIP Working Group published RFC 2350, “Expectations for Computer
Security Incident Response Teams as Best Current Practice” [Brownlee 98]. This Request
for Comment (RFC) documented recommendations for what teams should publish about themselves
and explained why this information would be useful for users of a CSIRT.
As intruders make more use of home users’ computer systems, CSIRTs today are struggling
to figure out ways to interact with this type of constituency. Some interesting public outreach
projects and services are currently offered by the CERTCC-KR. 49 The initiatives include
• providing free anti-virus software and vaccine programs to elementary and secondary
education organizations
• operating a 24x7 phone number for anyone to call and report computer security incidents
and receive assistance in resolving them. This initiative is known as the Cyber 118 Operation.
47
48
49
For more information on US-CERT, see .
The GRIP Working Group was disbanded when its work was completed. Its initial charter can be
read at .
For more information on CERTCC-KR, see .
34 CMU/SEI-2003-TR-001