State of the Practice of Computer Security Incident Response Teams ...

service providers, or nation states [West-Brown 03]. Whomever it serves, the CSIRT must
clearly identify the constituency to ensure that they are providing services to appropriate individuals.
The majority (86%) of the CSIRTs participating in the CSIRT Organizational Survey stated
that they did have an identified constituency. Some of the new and developing teams stated
that they were still in the process of identifying their constituency.
The types of constituencies identified by the survey participants are shown in Figure 11.
Organizational Survey Participants Constituencies
clients and
customers
17%
IP range or
domain
10%
parent or host
organization
17%
public
3%
military
organizations
26%
university and
research
networks
20%
government
organizations
7%
Figure 11: Constituencies of Survey Participants
As would be expected, the educational sector CSIRTs identified their parent research network
or university as their constituency. The military CSIRTs identified other areas of the military
or specific military departments, and the information and communication CSIRTs identified
their customers or supported IP ranges and domains as their constituency. The non-profit
CSIRTs identified the public or their host organization as their constituency.
It should be pointed out that a CSIRT does not just interact with its constituency. A CSIRT
may also communicate with other CSIRT teams and security experts, individuals outside of
the CSIRT who are reporting problems, representatives from law enforcement, or vendors.
Many CSIRTs, if time permits and if their policies allow, will try to help those outside of their
constituency when reporting problems. But the constituency is the formal group that the
CSIRT provides service for according to its mission.
50 CMU/SEI-2003-TR-001