State of the Practice of Computer Security Incident Response Teams ...

Most of the documents we reviewed described various approaches for constructing or organizing
a team, and regardless of the CSIRT model chosen, there were a few roles that all consistently
identified as needed:
• team lead (or manager, coordinator, principal investigator, senior technical lead)
The manager, team lead, or coordinator role has the overall responsibility for managing
the team and overseeing the handling of incident activities. This person can allocate or
request additional resources when needed, and may have budgetary control and authority
to take actions within the boundaries of certain predefined conditions (e.g., may be empowered
to schedule overtime, have systems disconnected from a network, purchase
software or hardware, etc.).
• technical staff (incident handlers, vulnerability or artifact analysts)
The technical staff provides the primary support for incident handling, as well as supporting
other CSIRT services 74 that may be provided and for which they have the expertise.
Staff can be full-time CSIRT members or may be adjunct members who are approved to
work with the CSIRT as needed. These part-time staff may be from other departments or
sections of the parent organization or constituency or they may be external security experts
who have a working agreement with the CSIRT.
• first responders
This can include those who handle the first report of an incident, whether they are help
desk personnel, CSIRT hotline staff, or some other type of staff.
• experts
These may be computer security experts, platform specialists, or network administrators
who are brought in to provide guidance and advice during an incident, but are not full
time members of a team.
• other professional or administrative support staff
The professional support category could include staff from IT, human resources, legal,
corporate security, disaster recovery, or public relations departments. It may also include
media specialists, criminal investigative staff, and other management contacts that can
assist the CSIRT. The other administrative category includes administrative and secretarial
staff support (either full-time or part-time staff) who may be called upon to assist during
heightened periods of increased incident activity, major events, or other times (holidays,
new school semester terms, fiscal/calendar year roll-overs, etc.).
We have also noticed through discussion with other CSIRTs that many teams implement the
concept of a core team and an extended team as their model for CSIRT operations. The core
team usually consists of first responders and incident and vulnerability analysts. The ex-
74
See the CSIRT Services list at .
CMU/SEI-2003-TR-001 73