Contributed by Organizations or Campuses; Articles, Papers, and Reports; Cybersecurity; and Incident Handling and Response
Handbook for Computer Security Incident Response Teams (CSIRTs), 2nd edition
| Title: | Handbook for Computer Security Incident Response Teams (CSIRTs), 2nd edition (ID: CSD3847) | | Author(s): | Georgia Killcrece (Carnegie Mellon University), Robin Ruefle (Carnegie Mellon University), and Mark Zajicek (Carnegie Mellon University) | | Source: | Carnegie Mellon Software Engineering Institute | | Origin: | Contributed by Organizations or Campuses (2003) | | Type: | Articles, Papers, and Reports | | Abstract: | This document provides guidance on forming and operating a computer security incident response team (CSIRT). In particular, it helps an organization to define and document the nature and scope of a computer security incident handling service, which is the core service of a CSIRT. The document explains the functions that make up the service; how those functions interrelate; and the tools, procedures, and roles necessary to implement the service. This document also describes how CSIRTs interact with other organizations and how to handle sensitive information. In addition, operational and technical issues are covered, such as equipment, security, and staffing considerations. | | View this resource: | |
State of the Practice of Computer Security Incident Response Teams (CSIRTs)
| Title: | State of the Practice of Computer Security Incident Response Teams (CSIRTs) (ID: CSD3848) | | Author(s): | Georgia Killcrece (Carnegie Mellon University), Robin Ruefle (Carnegie Mellon University), and Mark Zajicek (Carnegie Mellon University) | | Source: | Carnegie Mellon Software Engineering Institute | | Origin: | Contributed by Organizations or Campuses (2003) | | Type: | Articles, Papers, and Reports | | Abstract: | Keeping organizational information assets secure in today's interconnected computing environment is a challenge that becomes more difficult with each new "e" product and each new intruder tool. There is no one solution for securing information assets; instead a multi-layered security strategy is required. One of the layers that many organizations are including in their strategy today is a computer security incident response team, or CSIRT. This report provides an objective study of the state of the practice of incident response, based on information about how CSIRTs around the world are operating. It covers CSIRT services, projects, processes, structures, and literature, as well as training, legal, and operational issues. The report can serve as a resource both to new teams that are setting up their operations and to existing CSIRTs that are interested in benchmarking their operations. | | View this resource: | |
|
