State of the Practice of Computer Security Incident Response Teams ...

management support (sometimes called “buy-in”), as illustrated by the quotations included
below:
“Our experience shows that, without management approval and support, creating
an effective incident response capability can be extremely difficult and problematic.”
-- CERT CSIRT Development Team, 2002
“Management and user buy-in are critical to the success [of the team]”
-- Schultz and Shumway [Schultz 02]
“Until you have management buy-in, you’ll find it hard to get time, money, and
political support for your incident handling activities.”
--SANS Computer Security Incident Handling
Step-by-Step [SANS 03]
“Any policies, procedures, or incident response teams existing without top-level
support usually fail.”
– Mandia and Prosise [Mandia 01]
“Without proper support from management…an effective CSIRC is not possible.”
-- Wack [Wack 91]
What was true 10 years ago still applies today in the incident response area. There have been
a number of situations where a response team was set up as a direct result of activity that occurred.
The CERT/CC, for example, was established in November of 1988 as a direct result
of the Morris Worm. 66 In 1992, a surge in the number of reported incidents that were being
launched from Australia (to overseas sites) resulted in a combined effort from the Queensland
University of Technology, Griffith University, and The University of Queensland to seek federal
funding to establish an Australian response team. “Although the proposal was rejected by
the government, the organizations had such strong convictions that this was needed that they
decided to build the capability anyway and looked for ways to fund the activity from their
own budgets” [Smith 94, p. 44]. In building their plan, AusCERT (then called SERT) sought
guidance and assistance from existing response teams to help them understand what was
needed and how to coordinate efforts with other response teams [Smith 94].
66
CMU/SEI-2003-TR-001 63