Computer Security Handbook, Fifth Edition

CHAPTER 56

COMPUTER SECURITY INCIDENT RESPONSE TEAMS¹

Michael Miora, M. E. Kabay, and Bernie Cowens

56.1 OVERVIEW

56.1.1 Description

56.1.2 Purpose

56.1.3 History and Background

56.1.4 Types of Teams

56.2 PLANNING THE TEAM

56.2.1 Mission and Charter

56.2.2 Establishing Policies and Procedures

56.2.3 Interaction with Outside Agencies and Other Resources

56.2.4 Establish Baselines

56.3 SELECTING AND BUILDING THE TEAM

56.3.1 Staffing

56.3.2 Involve Legal Staff

56.4 PRINCIPLES UNDERLYING EFFECTIVE RESPONSE TO COMPUTER SECURITY INCIDENTS

56.4.1 Baseline Assumptions

56.4.2 Triage

56.4.3 Technical Expertise

56.4.4 Training

56.4.5 Tracking Incidents

56.4.6 Telephone Hotline

56.5 RESPONDING TO COMPUTER EMERGENCIES

56.5.1 Observe and Evaluate

56.5.2 Begin Notification

56.5.3 Set Up Communications

56.5.4 Contain

56.5.5 Identify

56.5.6 Record

56.5.7 Return to Operations

56.5.8 Document and Review

56.5.9 Involving Law Enforcement

56.5.10 Need to Know

56.6 MANAGING THE CSIRT

56.6.1 Professionalism

56.6.2 Setting the Rules for Triage

56.6.3 Triage, Process, and Social Engineering

56.6.4 Avoiding Burnout

56.6.5 Many Types of Productive Work

56.6.6 Setting an Example

56.6.7 Notes on Shiftwork

56.6.8 Role of Public Affairs

56.6.9 Importance of Forensic Awareness

56.7 POSTINCIDENT ACTIVITIES

56.7.1 Postmortem

56.7.2 Continuous Process Improvement: Sharing Knowledge within the Organization

56.7.3 Sharing Knowledge with the Security Community

56.8 CONCLUDING REMARKS

56.9 FURTHER READING

56.10 NOTES ...