State of the Practice of Computer Security Incident Response Teams ...

3.5 Staffing
The majority of documents we reviewed stress the importance of identifying staff (or a team)
that is responsible for handling computer security incidents. This staff may be full time and
devoted to incident handling tasks, or it may be ad hoc and pulled together only when an incident
occurs.
3.5.1 Staff Size
A question we frequently hear is “How big should my team be?” This is not an easy question
to answer, because it depends on a lot of factors. Most people involved in incident handling
agree that one person is not enough, but there is no standard number concerning how many
staff members are needed. This depends on the expertise of the staff, the incident workload,
and the type of services offered. It also depends on what work related to incident handling
and computer security is provided by other parts of the parent or host organization.
Depending on the level of service provided, the size of the team may need to have a minimum
number of staff. For example, for a 24x7 service like the hotline, you can begin to estimate
how many staff you might need to provide this service. If you have three shifts, you will
need at least four to six people to provide a basic hotline service: three to cover the shifts and
a backup for each to cover sick time and vacations. Depending on the number of calls that
come in, one person for each shift may not be enough. So you may need another three staff
members. However, if the hotline staff also performs other tasks, such as technical monitoring,
triage, or incident analysis, then even that number of staff may not be enough.
There was one European CSIRT that was staffed with just one person who spent just 20% of
his time handling incident reports—for a whole country. While by today’s standards this
would seem an unlikely model, at that time this “team of one” provided a valuable service to
other CSIRTs in the community by acting as a facilitator to distribute incident reports to the
appropriate entities.
In looking at the data gathered in the CSIRT Organizational Survey and through our literature
review, no specific staffing trends or best practice staffing levels were seen. The survey data
showed that
• 31% of participating CSIRTs stated that they had 1–5 full-time staff.
• 31% stated that they had 6–10 dedicated full-time CSIRT staff.
• 21% stated that they had over 10 staff.
• Only one stated that they had over 100 staff and that was a combined military team.
• Even some ad hoc and distributed part-time teams stated that they had some staff devoted
to incident handling on a full-time basis.
CMU/SEI-2003-TR-001 71