State of the Practice of Computer Security Incident Response Teams ...

and recovery operations (incident response on-site). Others provide technical advice and recommendations
through phone, email, and documentation (incident response support). And
others facilitate the exchange of incident data, response and mitigation strategies (incident
response coordination). Incident Analysis is not only the technical analysis of the incident
report but also includes sub-services such as forensics evidence gathering and tracking and
tracing intruders. These two functions are sub-services because not all CSIRTs perform these
types of analysis.
In talking with and observing various teams, it can be seen that most teams perform incident
handling in some form. What that incident response work is varies from team to team. Some
teams spend their day reviewing intrusion detection system (IDS) logs. When they see an
alert or abnormal network traffic their response is to pass that alert on to another part of the
organization to handle. Other teams may spend their day watching IDS logs but when an alert
goes off, they send someone to analyze and investigate and determine the response. Still other
teams may do no IDS monitoring and instead staff a help desk to receive and handle security
incident reports. When they receive reports they may go to the affected machine to perform
diagnostic procedures and forensic analysis to determine what is wrong and capture any necessary
evidence. Other teams that coordinate incident response activities may rarely analyze a
system, but instead make sure information about ongoing threats and attacks are published to
the constituency, so the constituency can take the appropriate steps to protect themselves.
As we reviewed the literature, we found that the descriptions and identification of the range
of services a CSIRT can provide is very similar, although these are discussed at various levels
depending on the focus of the publication (e.g., management perspective versus technical). It
should also be noted that often different authors refer to these services with slightly different
names.
To find out what types of services current teams are offering, we asked participants in the
CSIRT Organizational Survey 68 to indicate which services they currently provide. The most
frequently reported service was, of course, incident handling (97%). Those who said they did
not perform incident handling were military coordination centers. The next most frequently
offered services were
• publish advisories or alerts (72%) 69
• perform security policy development (72%)
68
69
As the new CSIRT Services document was not complete when the survey was created, the list of
services on the survey was only a subset of the new services list.
In creating the pilot survey we did not distinguish between writing advisories or forwarding advisories
written by others. We included both in this service. In any future surveys we may choose to
make a distinction.
CMU/SEI-2003-TR-001 67