State of the Practice of Computer Security Incident Response Teams ...

Not surprisingly, in the majority of cases the teams with the larger staffs had a larger budget.
An important question we did not ask in the survey was the size of the constituency and networks
supported by each team. This may have provided more useful information to gauge the
team size effectiveness. In any future surveys we will ask that question.
Across the board, most CSIRT sectors and models had both full-time and part-time staff.
• 38% of the participating CSIRTs stated that they had 1 to 5 part-time staff working on the
team.
• 17% said they had 6 to 11 part-time staff working on the team.
• One team said that they had 100 part-time staff distributed across various sites.
• As would be expected, almost all distributed teams, ad hoc teams, and combined teams
had part-time staff. However, a few combined teams had only full-time staff. And the majority
of the ad hoc and distributed part-time teams had only part-time staff.
• 48% of those with part-time staff said that the staff involved provided the equivalent of
work done by 1 to 3 full-time staff.
Smith, in his article “Forming an Incident Response Team,” says that the AusCERT team recognized
early that the size of a team would have an effect on the overall capabilities of the
team. He discusses some approaches for seeking expertise from outside sources and the need
for developing trusted contacts. Smith also pointed out that one of the “common attributes
between existing CSIRTs [is] that they are under-funded, under-staffed, and overworked.” He
also suggested that one full-time technical person could comfortably handle one new incident
per day (with a maximum of 20 incidents in some type of active state) [Smith 94]. Those,
however, were statistics for the AusCERT operation almost 10 years ago. Such statistics may
no longer be valid in today’s CSIRT environment. The larger numbers of incidents that are
being reported today and the sophistication of attacks may mean that an incident handler cannot
handle that many incidents at a time. Our survey did not research the number of incidents
that can be handled by CSIRT staff, so we have no statistics for comparison today. However,
this type of information is being collected as part of the eCSIRT.net initiative in Europe, so in
the future we may have some statistics on how long it takes CSIRT staff to handle particular
types of incidents. 73
3.5.2 Staff Positions
Although there is not a standard number of staff for a team, there are some standard, agreedupon
positions that a team might consider. These are described in this section. In addition,
Section 4.5 of the Handbook for CSIRTs provides additional details concerning staffing issues
[West-Brown 03].
73
For more information on eCSIRT.net, see .
72 CMU/SEI-2003-TR-001