State of the Practice of Computer Security Incident Response Teams ...

Malaysia Computer Emergency Response Team (MyCERT) is not an MSSP but at one time it
offered some services for free and additional or special services for a fee 61 [MyCERT 03].
One of the biggest problems faced by CSIRTs is the ability to obtain and maintain funding. In
the book Incident Response, Kenneth van Wyk and Richard Forno point out that it can be
very difficult to get sufficient funding for the team because “information security, in general,
plays a supporting role…security functions are not revenue-generators, they are revenue consumers.”
As a result, many organizations are challenged to find ways to make a business case
for funding. The authors also suggests being “aggressive, assertive, and confident” in presenting
a funding case to management. CSIRTs might also consider diverse mechanisms to obtain
funding—levying a tax on business units or charging a fee for services [van Wyk 01]. Another
idea to save costs is to start with an ad hoc team, one that is pulled together to handle an
incident. The composition of the ad hoc team comes from other parts of the organization.
Staff that perform job functions related to IT maintenance and security are also assigned incident
response tasks. For such a model to work successfully, however, just making staff assignments
isn’t enough to have a good response capability; staff, management, and the constituency
need to understand that incident response takes priority over other tasks. If this is
not handled correctly it will cost the organization more by having an inadequate and possibly
incomplete response.
3.3.2 Budgets
CSIRT budgets are as diverse as the types of teams. Factors influencing budget costs include
the type of industry sector the CSIRT is in (which can influence salary costs), the number of
services to be offered, and the assistance provided by other areas of the organization (which
could cut down on the amount of staff and resources needed).
Survey participants were asked to identify what budget range most closely fit their CSIRT
budget (including salary costs). The categories used were as follows:
• Under $50,000 USD
• Between $50,000 and $100,000 USD
• Between $100,000 and $500,000 USD
• Between $500,000 and $1,000,000 USD
• Between $1,000,000 and $2,500,000 USD
• Between $2,500,000 and $5,000,000 USD
• Above $5,000,000 USD
61
According to their current web site, MyCERT no longer offers these special services. This information
came from their web site in 2002.
56 CMU/SEI-2003-TR-001