State of the Practice of Computer Security Incident Response Teams ...

3.1.5 Other Trends
Other trends we have observed include the growth of teams in particular sectors. The
CERT/CC has seen over the past few years a marked increase in the number of teams from
banking and finance, insurance, law enforcement, and critical infrastructures such as power
and energy, transportation, and information and communications. There has also been an increased
interest in creating CSIRTs for federal government agencies, U.S. state governments,
and national teams for countries in all areas of the world. Figure 9 shows the breakdown by
sector of organizations that have attended CERT/CC CSIRT courses from 2000-2002.
In the past seven years we have seen another trend as incident response services have become
offered, along with a range of security services, by consulting or managed security service
providers (MSSP). As more and more organizations require such support, they now have a
choice of creating their own team or hiring a team with the skills and experience to do the
job. Table 6 shows that as of August 2002, there were approximately 23 MSSP CSIRTs that
were either members of FIRST or the European CSIRTs Directory. The first registered MSSP
CSIRTs were in 1996. Since that time one or two have been added every year, with a large
increase in 2001.
% Organizational Sector Representation for 2000-2002 CSIRT
Classes
Information and
Communications
3%
Public
Administration
19%
Non-Profit
2%
Finance and
Banking
4%
Energy Critical
Infrastructure
3%
Military
26%
Education
8%
Law Enforcement
2%
Commercial
33%
Figure 9: Organizational Sector Representation for 2000–2002 CERT/CC CSIRT
Classes
Another good example of the large number of teams that exist but are not registered comes
from work that is done by CERTCC-KR. This team works with a group of 200+ established
CSIRTs in Korea through an initiative called “CONCERT.” These teams come from universi-
46 CMU/SEI-2003-TR-001