State of the Practice of Computer Security Incident Response Teams ...

One methodology for understanding the information and security needs of an organization is
the Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) SM process.
OCTAVE is a risk-based strategic assessment and planning technique for security. OCTAVE
is self-directed, meaning that people from an organization assume responsibility for setting
the organization’s security strategy. Risks to critical assets are used to prioritize areas of improvement
and set the security strategy for the organization. The results of such a process can
be used to help make a case to management concerning security and response requirements
[Alberts 02]. 67
Most in the CSIRT community will agree that to make a case to management you must put
issues in terms of management’s concerns and language. Risk and damage must be translated
into dollars and cents for the organization. This means showing how the CSIRT will help increase
productivity, increase cost savings, comply with regulations protect the company’s
reputation, decrease the threats against company assets, or even enable departments to score
well on an audit.
3.4 Services
Each CSIRT is different and provides services based on the mission, purpose, and constituency
of the team. Some of the services offered relate directly to incident handling, a core service
of a CSIRT. Other services, such as security training or audits, only relate indirectly to
incident handling, while serving broader organizational security needs. Some services may be
provided by other parts of the organization, such as an IT, training, or audit department, instead
of the CSIRT, or may even be outsourced. The actual assignment of tasks and responsibilities
depends on the structure of the CSIRT’s parent or host organization.
These services and a variety of others have been defined in the List of CSIRT Services jointly
published by the CERT/CC and the TI service and included in Organizational Models for
CSIRTs. That report and the corresponding list groups CSIRT services into three categories:
• Reactive services. These services are triggered by an event or request, such as a report of
a compromised host, wide-spreading malicious code, or something that was identified by
an intrusion detection or network logging system. Reactive services are the core component
of incident handling work.
• Proactive services. These services provide assistance and information to help prepare,
protect, and secure constituent systems in anticipation of future attacks, problems, or
events. Performance of these services will directly reduce the number of incidents in the
future. These services are ongoing, rather than being triggered by a direct event or request.
SM
67
OCTAVE is a service mark of Carnegie Mellon University.
For information on OCTAVE publications, see .
CMU/SEI-2003-TR-001 65