State of the Practice of Computer Security Incident Response Teams ...

• integrity
• operating system administration experience
• programming experience
• communication skills
• security experience [Smith 94]
Schultz provides a summary of the types of skills typically required in the CSIRT, including
the need for strong management experience to lead the team and ensure that it is meeting its
mission and the need for technical staff with proficiency in different applications, systems,
and networks found in the team’s constituency. He also lists other equally important traits
such as people, teamwork and communications skills, all of which contribute to effective interactions
between the team and its constituency [Schultz 02].
In addition to identifying the right skills for the CSIRT staff, Oppenheimer et al. suggest that
some security precautions be implemented during the hiring process to screen resumes for
“red flags.” Employers should perform reference and background checks, require new employees
to sign appropriate non-disclosure agreements or acceptable use documents, and provide
security awareness training as part of new-employee orientation [Oppenheimer 97].
Smith also discusses the importance of paying careful attention to hiring regulations with regard
to advertising, interviewing, and screening applicants. He raises the issues that management
will need to determine if hired staff will be required to complete non-disclosure agreements
and if they will need security clearances to perform their work (depending on the
sensitivity of the constituency’s information) [Smith 94].
Another issue that CSIRT managers must take into consideration concerns any CSIRT staff
members who will provide expert testimony in any judicial proceedings. If a team’s services
include forensics evidence collection, then the team members may be required to act as expert
witnesses in court. This may require specialized skills and training for the analyst. Also,
any staff member undertaking such tasks must be willing and able to stand up in court and
provide the testimony.
Having well-defined job descriptions that include a list of the roles and responsibilities for
each of the CSIRT positions along with the necessary skills, experience, educational background
and/or certifications and clearances required can be a helpful tool in identifying and
hiring the right staff.
CMU/SEI-2003-TR-001 77