State of the Practice of Computer Security Incident Response Teams ...

Figure 12 shows the breakdown of budgets indicated by the survey participants.
CSIRT Budget Ranges
Between $100,000
and $500,000
25%
Between $50,000
and $100,000
15%
Under $50,000
10%
$5,000,000 and
above
7%
Between
$2,500,000 and
$5,000,000
3%
Between $500,000
and $1,000,000
25%
Between
$1,000,000 and
$2,500,000
15%
Figure 12: Budget Ranges for CSIRT Organizational Survey Participants
The 7% that said their budgets were above $5,000,000 were all military CSIRTs. The majority
of the remaining CSIRTs identified their budgets as ranging between $500,000 and
$1,000,000 (25%) and between $100,000 and $500,000 (25%). Therefore, 50% of the participating
CSIRTs indicated that their budgets were between $100,000 and $1,000,000. Educational
and non-profit CSIRTs, as expected, had the lowest budgets. No other trends by sector
were seen.
3.3.3 Staff Costs
In the Internet Security Systems (ISS) white paper “Computer Security Incident Response
Planning,” the amount quoted for security administrators and consultant salary costs (obtained
from a January 2001 SysAdmin, Audit, Network, Security [SANS] Security Alert)
ranged from approximately $60,000–$80,000 per year. This figure applies to those who perform
system and network administration. The ISS report also quoted a Gartner estimate that a
dedicated two-person incident response team will cost $251,000 in the first year for capital
expenditures, with $324,000 per year for salaries, benefits, and training. Additionally, Gartner’s
numbers for external investigation and other forensics services were in the $100,000
range, for providing specialized skills in the collection and analysis of incident information. 62
External staff undertaking this type of work will generally need more specialized training in
62
Internet Security Systems. “Computer Security Incident Response Planning, Preparing for the
Inevitable.” Atlanta, GA, 2001.
CMU/SEI-2003-TR-001 57