State of the Practice of Computer Security Incident Response Teams ...

• audit and risk management specialists who help the CSIRT develop threat metrics and
risk assessments for constituency systems
• law enforcement liaisons or investigators involved in evidence collection, forensic analysis,
and any resulting prosecution or court cases
Support staff is usually required to help CSIRT members as needed by performing administrative
services.
3.5.3 Staff Skills
Finding and retaining skilled CSIRT staff is not an easy task. Many teams have relayed how
they have had open positions for long periods of time before finding someone who had the
right skill set and personality to work in their CSIRT.
Many of the authors of various incident handling books and articles discuss the types of skills
required for CSIRT staff [Schultz 02, Smith 94, van Wyk 01, West-Brown 03]. Most agree
that not only is it important for staff in the CSIRT to have the technical depth and breadth of
experience to handle incidents, it is equally important (sometimes even more so) to have
“people” skills as well.
It is obvious in many of the publications reviewed that CSIRT members are viewed as providing
a “customer service” role. Van Wyk and Forno state that it is paramount that every
team member have a positive, customer service-oriented attitude and that care be taken in
hiring the right staff [van Wyk 01]. For many CSIRTs, a large portion of the interaction with
others occurs through oral communication (telephone conversations, presentations) or the
written word (email, documents, reports, alerts, advisories, etc.), so it is imperative that
CSIRT staff be able to carry out these communications clearly and concisely, be able to describe
activity accurately, and provide information to their constituency or others that is easy
to understand. CSIRT staff may also be dealing with constituency members under great stress
because of the current damage resulting from any incident activity, so they must be able to
relate to the situation and often even calm people down to be able to obtain the needed information
to handle the incident. This is another reason why personal skills are so important.
Trustworthiness is paramount to the success of a CSIRT. This is one of the key lessons
learned that is discussed in CERT/CC incident handling courses. Other authors agree that
CSIRT members must be trustworthy [Kossakowski 94a, Schultz 02, Smith 94, West-Brown
03]. The words and actions of each member of the team can affect the reputation and constituent
perceptions of the team.
Smith says that in his opinion the attributes that any CSIRT staff member should have are (in
order of priority)
76 CMU/SEI-2003-TR-001