A Proposed Integrated Framework for Coordinating Computer Security Incident Response Team

Traditionally, computer security incident response teams (CSIRT) are expected to respond to hacking incidents, rogue employees, or virus outbreaks. Recently, they are maturing into a critical tool for maintaining business operations, homeland security, and compliance with new regulations. Alberts et al (2004) define a CSIRT to be “a capability or team that provides services and support to a defined constituency for preventing, handling, and responding to computer security incidents.” Among the most important aims of these CSIRTs is a focus on processes related to incident and security management. A type of CSIRT called, “Coordinating CSIRTs (C-CSIRT) “ facilitate the handling of incidents, vulnerabilities, and general information across a variety of external and internal organizations. These C-CSIRTs play a crucial role in performing security and incident management across multiple organizations. Examples of these C-CSIRTs include AusCERT (Australia Computer Emergency Response Team) and CISCO PSIRT (CISCO Product Security Incident Response Team).The main focus of a C-CSIRT is to get its constituent organizations’ computer related infrastructure back to an operational state as soon as possible (Killcerece, 2003). This is done by concentrating primarily on incident, security and IT management. In our view, a C-CSIRT must include related processes such as communication with the public and media and the investigative processes that help to find the root causes of the attack to prevent not only irreparable harm to the public image and services of a business, but also recurring attacks. In the proposed framework, we integrate issues of communication and investigation into the processes that a C-CSIRT performs to fulfill its basic function of security, IT and incident management.