State of the Practice of Computer Security Incident Response Teams ...

• Security quality management services. These services augment existing and already
well-established services that are independent of incident handling and traditionally have
been performed by other areas of an organization such as the IT, audit, or training department.
If the CSIRT performs or assists with these services, the CSIRT’s point of view
and expertise can provide insight to help improve the overall security of the organization
and identify risks, threats, and system weaknesses. These services are generally proactive
in nature but contribute indirectly, rather than directly, to a reduction in the number of incidents.
Table 9 provides a high level overview of the various CSIRT services within each of the
above categories as outlined in Organizational Models for CSIRTs and the corresponding
CSIRT Services List. The services listed in Table 9 are defined and explained in detail in the
CSIRT Services list available at http://www.cert.org/csirts/services.html.
Table 9:
CSIRT Services by Category
As illustrated in Table 9, there are many different types of services that a CSIRT can provide.
In reviewing the service offerings from different CSIRTs, it can be seen that there is not one
set combination of functions or services that a CSIRT provides. However, to be considered a
CSIRT, a team must provide some form of incident handling service.
Incident handling includes three functions: receiving incident reports, performing incident
analysis, and performing incident response. These translate into four basic services: incident
analysis, incident response on-site, incident response support, and incident response coordination.
The various types of “incident response” services indicate the wide variety of “responses”
different types of CSIRTs choose to provide. Some teams actually perform repair
66 CMU/SEI-2003-TR-001