State of the Practice of Computer Security Incident Response Teams ...

3 Current State of the Practice of CSIRTs
This section takes a look at the information gathered through our research efforts. It pulls together
information from our survey, literature search, interviews, and research. The main focus
is to provide a picture of the current CSIRT community and how teams go about their
work. We will discuss the organizational structure and processes of teams, the problems in
determining the actual number of teams, the types of services being offered by teams, the
type of training available for teams, the types of projects being implemented by teams, and
the major impacts on teams, such as changes in intruder trends and laws.
Topics include the following:
• the number and types of CSIRTs today, including some background on the change in
number and type of CSIRT in the past few years
• the organizational structures of CSIRTs, including constituency and mission, location,
hours of operation, authority, and reporting structures
• types of CSIRT funding and the costs of operating a CSIRT
• the types of services offered by different types of teams
• the skill sets and staff positions needed on a team, along with a review of available training
• how CSIRTs receive, record, track, categorize, and prioritize incident data
• with whom CSIRTs coordinate response activities and share data
• current influences on CSIRT operations that can potentially affect the creation and operation
of CSIRTs
• changes in the nature and type of intruder threat and the impact this has had on the dayto-day
operations of CSIRTs
• an overview of some of the recent projects undertaken by or beneficial to the CSIRT
community
3.1 Number and Type of CSIRTs Today
It is difficult to determine exactly how many CSIRTs are in existence today. Some of the reasons
for this difficulty are as follows:
CMU/SEI-2003-TR-001 37