State of the Practice of Computer Security Incident Response Teams ...

As the field of incident handling and CSIRT functions is still relatively new, in many cases,
managers who are seeking trained staff will turn to the more traditional system administrator
position descriptions and skills. For example, SAGE, 75 the international organization for professional
system administrators, provides information about various job descriptions that
might be useful to organizations seeking to staff a CSIRT. 76 The core job descriptions cover
the range of novice to senior-level system administrator, listing the required background and
desirable skills for these positions.
More information on CSIRT required skills can be found in the CSIRT Basic Skills document
on the CERT/CC web site at http://www.cert.org/csirts/csirt-staffing.html.
3.5.4 Staff Burnout
Because of the amount of detailed work done by incident handlers and the increasing work
loads, many of the authors of the books and articles reviewed in the literature identified staff
burnout 77 as a problem for CSIRTs.
Most encourage managers of teams to foster an environment where professional development
of staff is given a high priority. As the technology improves and evolves, the CSIRT staff
must have opportunities to improve their skills and experiences. This may mean providing a
particular percentage of staff time for professional development. This professional development
could include working in other areas of the team or parent organization or attending
conferences and training in an effort to stay current with necessary incident handling skills.
A number of the authors identify the need to provide opportunities for the CSIRT staff to “rotate”
or take on other roles to avoid incident response burnout [Smith 94, van Wyk 02, Wack
91, West-Brown 03]. They recommend seeking ways to invigorate or energize staff by allowing
them to spend a portion of their time (or some other dedicated timeframe) working on
new projects, investigating new technologies, writing, participating in workshops or training
sessions, developing software tools that may be of use to the team or constituency, or performing
other research that will take them away from day-to-day incident handling activities.
The Handbook for CSIRTs suggests that only 80% of staff time should be devoted to incident
response activity [West Brown 03]. Van Wyk and Forno suggest that “incident response pro-
75
76
77
SAGE is a Special Technical Group (STG) of the USENIX Association. For more information
about SAGE, see .
The SAGE short topics booklet series includes one booklet focused on job descriptions, edited by
T. Darmohray. A brief overview of the booklet is available at
.
Webster’s Ninth New Collegiate Dictionary defines burnout as “exhaustion of physical or emotional
strength.”
78 CMU/SEI-2003-TR-001