State of the Practice of Computer Security Incident Response Teams ...

A CSIRT, due to its position, may also be able to exert pressure on the constituent to take a
specific action. An ISP, for example, may be able to force its constituents to take a specific
action or face discontinuation of Internet services [West-Brown 03].
When CSIRT organizations first began to form, most of them had “no authority.” These were
mostly national CSIRTs, university or research CSIRTs, and coordinating CSIRTs. Over time
as more commercial and local teams were established, these types of teams required more
authority to perform their work. We see today that many commercial, educational, and military
teams have full or shared authority over their constituency systems.
The most frequent type of authority cited by the CSIRTs participating in the survey was full
authority (34%); this crossed the various sectors and categories of CSIRTs. Others identified
that they had no authority (24%) or shared authority (24%).
The only correlation with sector and CSIRT authority was that all participating non-profit
CSIRTs stated that they had no authority. No correlations were identified between the CSIRT
model and the assigned CSIRT authority.
3.3 Funding and Costs
One question we have been asked quite frequently is “How much does it cost to start and operate
a CSIRT?” Unfortunately, the answer is not easy; there is no one figure that can be
given for what a CSIRT will cost to set up and operate. There is also not much literature on
this topic, and what is available is generally anecdotal rather than quantitative in nature.
The costs for setting up a team depend on the circumstances and environment in which the
team is established. An internal team that is distributed may not need additional salary or
equipment costs while a new team being set up in its own department will incur many more
costs. CSIRT costs will include not only start-up costs (software, computing equipment, capital
furniture expenditures, supplies, Internet domain registration fees, facilities costs, phones,
fax machines) but also personnel costs (salaries and benefits). Once the CSIRT is operational,
there will be continuing sustainment costs, both for operational expenditures (ongoing facilities
maintenance, support of equipment, upgrades, supplies, travel) and personnel costs
(raises, professional development and training).
In this section we look at the ways CSIRTs are funded today and the types of budgets they
have, and then discuss issues in determining the cost of incidents.
54 CMU/SEI-2003-TR-001