State of the Practice of Computer Security Incident Response Teams ...

Making the case to management to gather support for building a CSIRT will involve several
steps. The need to identify and collect data for both the direct and indirect cost of incidents
will be helpful in this regard. Such costs will include, as mentioned before, staff time spent
on recovery and on implementing any lessons learned, system downtime, loss of productivity,
loss of critical service, any loss of revenue from services and operations that are unavailable,
repair costs, value of compromised information, loss of reputation, or an increase in insurance
premiums. Other data to gather will include the risks to the organization’s information
security assets.
Matched against these costs and risks will be the benefits that the CSIRT can provide, including
reduction in recovery costs due to more streamlined response processes and better communication
channels; the ability to gather and evaluate new threats to the organization’s operation;
and the ability to provide an enterprise-wide view of not only the security
weaknesses but the related response efforts and their implementation. The CSIRT, in essence,
becomes one of the providers of business intelligence to the organization.
The CSIRT will also show that it will be able to reduce incident activity and the damage resulting
from those incidents that do occur. The CSIRT will need to put a cost on the “loss”
avoided and the risk minimized by the work a CSIRT performs. It’s generally accepted that a
CSIRT will show a business benefit in the long term, when successfully implemented,
whether in business efficiency, reduced customer complaints, or enhanced reputation of the
parent organization. These types of issues and success stories are needed as part of the overall
business case to management. The organization’s business continuity plans and risk models,
if in place, should be able to be used to support the case for a CSIRT.
In the article by Sarah Scalet entitled “Risk: A Whole New Game,” she mentions the increased
interest in insurance companies who are offering cyber insurance and the move towards
creating actuarial models that map security practices to financial losses (versus guesses
at loss figures). Scalet mentions that courts are beginning to apply dollar figures to losses
from security breaches as well and that this could have an impact on companies being asked
to meet a certain standard of due care [Scalet 02].
The emergence of such legal precedents and standards will be another impetus to organizations
to develop incident handling capabilities. These capabilities are beginning to become
requirements in various laws and regulations. For example, in the U.S., the Gramm-Leach-
Bliley Act of 1999 (GLBA, also known as the Financial Services Modernization Act of 1999)
requires financial institutions to not only have customer privacy policies and an information
security program, but also a response capability. The European Data Protection regulations
require all data controllers to have appropriate technical and procedural means to protect the
data they hold. The establishment of a CSIRT or a response capability can be seen as one indicator
of a company actively engaging in due care or providing the required procedural response.
64 CMU/SEI-2003-TR-001