State of the Practice of Computer Security Incident Response Teams ...

Figure 10: Example of Team Sponsorship and Propagation of CSIRTs
Newly forming teams have benefited from site visits to established team sites; reviewing
other teams’ web sites, incident reporting forms, and guidelines; and networking at conferences
such as the annual FIRST conference or meetings such as those regularly held by the
TF-CSIRT. Many teams are quite willing to receive visitors and share their experiences in
establishing their own team. They are also generally very supportive. In addition, many existing
teams still consider it important for their day-to-day function to meet other teams, as any
interaction with those teams will be easier once they have established contact. Such meetings
help teams gain a better understanding of each other and establish a means of communication.
As mentioned in Section 1.7, “About the Literature Search,” many teams have also made articles
and publications available about their process for establishing their team. These documents
help new teams have an idea of a process to follow and also help teams avoid pitfalls
and be aware of issues that will need to be addressed. Prior to 1998—the year the first edition
of the CERT/CC Handbook for CSIRTs [West-Brown 03] was published—no comprehensive
document was available for interested organizations to learn about the challenges and tasks
48 CMU/SEI-2003-TR-001