State of the Practice of Computer Security Incident Response Teams ...

• insider abuse of internal computer resources [Australia 02]
The Australian Computer Crime & Security Survey for 2003 asked for feedback on these
same categories of attacks. The 2003 survey was submitted to 350 public companies in Australia,
with responses from 214. The survey results for the annual cost of computer crime for
2003 totaled more than $11.8 million, 65 double the $5.7 million reported in the previous
year’s survey [Australia 03]. The 2002 survey pointed out that some of the respondents’ costs
reflected only the cost of investigation and recovery. Other losses, such as lost business opportunities,
degradation of network performance, and cost of misuse, to mention a few, were
difficult to quantify.
Simone Kaplan, in a CSO Online article “Criteria for Determining the Cost of a Breach,”
provides a list that can be used to identify costs associated with a computer security incident
[Kaplan 02]:
• system downtime
• people downtime
• hardware and software costs
• consulting fees
• money (salaries/benefits)
• cost of information
• cost of lost business
• incidentals
• legal costs
• cost to company reputation
The Center for Education and Research in Information Assurance and Security (CERIAS)
Incident Response Database is an example of an incident tracking system designed to help
capture the costs of incidents. It is a web-based system that can be downloaded for free from
https://cirdb.cerias.purdue.edu/website/ [CERIAS 03].
3.3.5 Making a Case to Management
Whatever the form of the CSIRT capability, much of the literature (see, for example, Mandia,
West-Brown, and SANS) makes the point that, to be successful, the team must have senior
65
Note that the total responding for 2002 was 75 (80%), whereas for 2003 it was 126 (58%).
62 CMU/SEI-2003-TR-001