State of the Practice of Computer Security Incident Response Teams ...

ties, ISPs, security companies, and other public and private organizations. These types of
public-private coordination efforts are becoming popular in various countries around the
globe.
3.1.6 The Spread of CSIRTs
Most descriptions about how CSIRTs are formed come from anecdotal information based on
our experience and the experiences of other teams. Here are some observations concerning
how new teams are supported and the changes we have seen in how this support has been
provided.
3.1.6.1 Support from Existing Teams
The history of CSIRTs, while only covering 15 years, has shown that existing teams provide a
tremendous amount of support to new teams as they are being established. This support involves
sharing of policies and procedures, provision of training, and sponsorship for membership
in organizations such as FIRST. An example of this support and how it has helped
promote the establishment of more teams can be seen in Figure 10. This figure shows the interactions
between various types of teams that sponsored another team, and how this trend
carries on as those teams in turn sponsor other teams. Although team names are not mentioned,
the figure is based on actual data, and is an illustration of how FIRST sponsorship has
worked.
CMU/SEI-2003-TR-001 47