State of the Practice of Computer Security Incident Response Teams ...

data collection, the use of analysis tools and techniques, and knowledge in handling such information
to ensure that any potential evidence will be admissible in a court of law. ISS also
mentions that it may be difficult (and costly) to hire and retain a cadre of such expert staff
even for larger companies; while for smaller organizations the costs would be prohibitive.
3.3.4 The Cost of an Incident
In trying to determine the cost of a team, many organizations try to first determine how much
an incident or threat will cost to compare this with the cost of mitigating the incident. To do
this, organizations must find a way to quantify the cost of an incident.
3.3.4.1 Incident Cost Analysis and Modeling Project (ICAMP)
Two studies that were done to determine a process for quantifying the costs of incidents are
the “Incident Cost Analysis and Modeling Project (ICAMP) I” [Rezmierski 98] and “Incident
Cost Analysis and Modeling Project (ICAMP) II” [Rezmierski 00], which sought to provide a
way to measure loss to universities from incidents in computing environments. The 1998
study calculated costs for 30 incidents at a little over $1 million and provided an estimate of
the actual costs for particular IT incidents. It includes sample incident types and templates
that can be used by others to calculate incident costs.
The ICAMP II study was designed to provide more information about incident data. This
second study gathered information related to incidents and their costs and chose to divide the
incidents into two broad types of activities. The first was categorized as “Service Interruptions”
and included incidents separated into the following:
• compromised access
• hacker attacks
• insertion of harmful code
• denial of service
The second type of activity included in the data collection was “copyright violations” and
they included distribution of illegal software (e.g., MP3 and “warez”). Based on these categories
(service interrupts and copyright violations), the study revealed that the average cost for
15 incidents included in the study was just over $59,000.
A further breakdown resulted in the following costs based on type of incident:
• a compromise: $1,800
• harmful code: $980
• denial of service: $22,350
58 CMU/SEI-2003-TR-001