State of the Practice of Computer Security Incident Response Teams ...

tended team is formed by temporarily adding on other professionals or specialists depending
on the type of activity and type of response and analysis required.
The list that follows provides a more detailed sample of the types of staffing and tasks related
to positions that might be part of a core and extended CSIRT. A review of the CSIRT literature
and discussions with other teams about their organizational structure show that these are
common types of positions in CSIRTs. It should be pointed out, however, that not all teams
would have all these positions. CSIRT staffing will depend not only on the main mission of a
team, but also on the funding and expertise available in the parent organization. It will also
depend on what services and capabilities are provided by other parts of the parent organization
or constituency.
A core team might include
• manager or team lead
− provides strategic direction
− enables and facilitates work of team members
− supervises team
− represents CSIRT to management and others
− interviews and hires new team members
• assistant managers, supervisors, or group leaders
− provides day-to-day operational guidance for team
− supports strategic direction of assigned functional area
− supports the team lead as needed
− provides direction and mentoring to team members
− assigns tasks and duties
− participates in interviews with new team members
− handles management tasks in team lead’s absence
• hotline, help desk, or triage staff (can also be referred to as first responders)
− handle main CSIRT telephone(s) for incident or security reports
− provide initial assistance, depending on skills
− undertake initial data entry and the sorting and prioritizing of incoming information
• incident handlers
− undertake incident analysis, tracking, recording, and response
− coordinate the reactive and proactive guidance that will be provided to the constituency
(develop material such as documentation, checklists, best practices, and guidelines)
− disseminate information
− interact with the CSIRT team, external experts, and others (such as sites, media, law
enforcement, and legal personnel) as appropriate, by assignment from team lead or
other management staff
− undertake technology-watch activities if assigned
− develop appropriate training materials (for CSIRT staff and/or the constituency)
− mentor new CSIRT staff as assigned
− monitor intrusion detection systems, if this service is part of the CSIRT activities
74 CMU/SEI-2003-TR-001