Computer Security Incident Response Team Development and Evolution

An Integral Model to Provide Reactive and Proactive Services in an Academic CSIRT Based on Business Intelligence

“…With the purpose to accomplish this, the Academic CSIRT has: (i) reactive services, which have been designed to generate alerts and warnings, as well as provide adequate management of incidents and vulnerabilities; (ii) proactive service, with the objective of providing technological surveillance, security assessments, development of security tools, intrusion detection service, security-related dissemination, configuration and maintenance of security tools, applications and infrastructure; (iii) Security Quality Management Services, which establish security consultancies, security awareness, in addition to security education and training [2]. However, due to the amount of malicious event data, by which the Academic CSIRT handles non-automatically and together with the need to provide to their members with a tool, which allows them to effectively analyze the traffic of their respective network, this project presents a solution by using BI, in order to generate incident management services based on security presentation and data analysis.…”

“…The lack of coherent and rigorous management has led to government institutes, companies and universities to be targeted by cyber-attacks [2]. In addition, the speed with which an institution has been able to recognize, analyze and respond to an incident will decrease recovery costs and reduce the potentially generated damage [3].…”

Capabilities and Skill Configurations of Information Security Incident Responders

“…The job of incident responder is further conflated by claims that responders may specialize in related areas such as forensics, data mining, reverse engineering, configuration of countermeasures, or penetration testing [5]. One study has recognized the need to distinguish the incident response role (and skills used in that role) by the type of incident (routine or non-routine) [17].…”

“…For example, hardware and software vendors (such as Cisco, Intel, Juniper, and IBM) have created incident response teams to address vulnerabilities in their products; organizations in many other industries have formed incident response teams to address attacks against their information and communication technology (ICT) assets or to respond when they lose customer data; and governments have created response teams to coordinate efforts around remediating vulnerabilities. Some experts observe that as incident response teams have become more common, the role has become much more specialized [4], [5].…”

CERT üçün insident verilənlərinin intellektual analizi

“…Həmin hücumlara cəld və effektiv cavab vermək bəzən çətin ola bilər. Təşkilatın tələblərinə görə bu komandalar bir neçə seqmentdə insident idarəetmə funksiyaları və fəaliyyətlərini yerinə yetirirlər [2].…”