State of the Practice of Computer Security Incident Response Teams ...

fessionals be utilized only 55–65 percent with the rest of the time available for training” [van
Wyk 01].
Schultz also discusses the problem of burnout and management’s responsibility to identify
techniques and approaches to provide incident response staff with opportunities to do other
types of work [Schultz 02, p. 90]. Smith suggests that staff should rotate through high-stress
positions and have opportunities to work on other activities that are less stressful (although,
of course, they should be available if emergency situations necessitate pulling them back into
incident handling activities) [Smith 94].
3.6 Training and Certification
As more and more CSIRTs were created during the 1990s, a common issue that many teams
(and individuals) faced was the general lack of training resources for incident handling. Although
training was widely available for various technical skills 78 that an incident handler
may need (e.g., system and network administration), few training providers taught how to
secure those hosts and networks, let alone how to apply this knowledge to the arena of incident
handling activities—receiving incident reports, analyzing the incident, sharing relevant
information with others, and providing an effective response.
The CERT Coordination Center was one of the first organizations to provide training courses
specifically designed for CSIRT managers and technical staff. Originally developed for the
U.S. Army, these courses are now offered to the public, and have been attended by hundreds
of CSIRT members from around the world. 79
Today, there are a number of sources that provide some level of training in incident response
and incident handling activities, as well as more training sources in special focus areas such
as computer forensics. Many organizations offer “hands-on” courses, as well as online or
webcast courses or seminars that can be attended without having to incur travel expenses.
Training in the general fields of information security and information assurance is quite
abundant. Many colleges and universities are now offering courses and curriculums in information
security or assurance, at both the graduate and undergraduate levels. In the United
States, since 1999 the National Security Agency has designated 50 universities as Centers of
Academic Excellence in Information Assurance Education, part of an outreach program to
78
79
See the CERT/CC document at , which lists the
basic skills, both technical and non-technical (e.g., personal and communication skills), that the
CERT/CC has found essential for providing effective incident response.
CMU/SEI-2003-TR-001 79