Developing a computer security incident response team plan strategy

Forensics and Computer Security Incident Response Team (csirt) Plan Strategy

The objective of this study is to develop and forensics and security incident response team (CSIRT) plan strategy for an organization. It is reported that a "computer security incident response team (CSIRT) is a concrete organizational entity (i.e., one or more staff) that is assigned the responsibility for coordinating and supporting the response to a computer security event or incident. CSIRTs can be created for nation states or economies, governments, commercial organizations, educational institutions, and even non-profit entities. The goal of a CSIRT is to minimize and control the damage resulting from incidents, provide effective guidance for response and recovery activities, and work to prevent future incidents from happening." (Ruefie, 2007, p. 1)Incident management is such that involves the detection and response to issues of security specifically computer related issues and the protection of "critical data, assets, and systems" in order to ensure that no incidents occur. (Ruefie, 2007, p. 1)

Required for incident prevention is involvement from "a wide range of participants across the enterprise." Included are: (1) security analysts, (2) incident handlers, (3) network and system administrators, (4) human resources and public affairs staff, (5) information security officers (ISOs), (6) C-level managers (such as chief information officers [CIOs], (6) chief security officers [CSOs], (7) chief risk officers [CROs]), and (8) other managers, product developers, and even end users. (Ruefie, 2007, p. 1)

The CSIRT is described as a "concrete organizational entity (i.e., one or more staff) that is assigned the responsibility of providing part of the incident management capability for a particular organization. When a CSIRT exists in an organization, it is generally the focal point for coordinating and supporting incident response." (Ruefie, 2007, p. 1) Kilcrece (2002) reports that the CSIRT duties include the performance of "at a minimum -- incident handling activities. This entails analyzing and resolving events and incidents that are reported by end users or are observed through proactive network and system monitoring."