State of the Practice of Computer Security Incident Response Teams ...

Distribution of Teams By General Category
100%
90%
80%
70%
60%
50%
40%
30%
Other
Government
Research
National
Commercial
20%
10%
0%
North America Europe Asia/Pacific Latin America Total
Figure 7: Sector Distribution of Registered CSIRTs by Geographic Area
Figure 7 shows some interesting but not unexpected trends:
• In North America (Canada and the United States) we see a majority of commercial teams
and a lower number of research-oriented teams.
• In Europe, the relationship between commercial and research teams is just the opposite.
This is a historic trend, as nearly all European countries have national research networks
and these organizations have been the early adopters since 1992. Over the years these research-oriented
CSIRTs were responsible for raising the awareness of ISPs and other
commercial organizations, which then established their own teams.
• In the Asia Pacific region, the majority of the “registered” teams are national teams, most
or all of them funded by the corresponding national government.
• In Latin America the low number of teams precludes identifying any clear emerging
trends, although we see evidence of research, commercial, and national teams in existence.
We expect that this diversity will continue.
In Table 6 we categorize the large number of teams in North America and Europe by more
detailed sectors.
CMU/SEI-2003-TR-001 43