State of the Practice of Computer Security Incident Response Teams ...

Dittrich goes on to say that a big challenge is getting people to keep track of the time they
spend on handling incidents (whether that is writing detailed notes in a log book, using time
management tools, or other approaches for capturing effort). Dittrich provided an example of
how the ICAMP model could be used for tracking a set of incidents.
Table 8:
Example of Calculating Incident Costs
Title
Hrs
Cost/Hr
($) Total ($) -15% ($) +15% ($)
Investigator 37 33.65 1,245.05 1,058.29 1,431.81
Administrator* 3 33.65 100.95 85.81 116.09
Benefits at 28% of salary 63 348.61 296.32 400.91
Total 1694.61 1440.42 1948.81
*Expected time for system reinstallation
It should be pointed out that the examples above focus on direct costs, but in calculating the
total cost of an incident there are many intangible and indirect costs that can be included in
the calculation of the cost of an incident. Some of these intangible and indirect costs include
loss of reputation; loss of productivity; increase in insurance premiums; and cost of new security
measures, software, and configurations. Putting a dollar figure on some of these costs
may be difficult, but should be achievable with input from financial and auditing staff.
3.3.4.2 Other Incident Cost Examples
The JANET-CERT team has set up a web page called “Case Studies: The Costs of Incidents.”
One example they list is a web defacement incident that cost an estimated 6000 pounds sterling.
The case study breaks the costs down into staff costs and overall business costs. These
costs given did not include any impact on the site’s reputation that resulted from the incident.
The defacement occurred at a university that taught computer security, but the site said they
did not have any way to calculate these types of costs or to determine if this affected any student’s
decision to attend the school [JANET-CERT 03].
The 2003 Computer Security Institute/Federal Bureau of Investigation (CSI/FBI) Computer
Crime and Security Survey indicated that 75% of the survey respondents said they suffered
financial losses as a result of computer crimes; however, less than half (47%) were able to
63
When calculating the costs of salary or personnel in the U.S., institutions that pay some form of
benefits for their employees will add that benefit cost into their total calculation. So in this example
whatever salary cost of a person was attributed to the incident, added to it was a benefit cost
that was calculated by taking the amount of the salary dedicated to the time spent handling the incident
and then multiplying that by .28 (28%).
60 CMU/SEI-2003-TR-001