Forensics and Computer Security Incident Response Team (csirt) Plan Strategy
The objective of this study is to develop and forensics and security incident response team (CSIRT) plan strategy for an organization. It is reported that a "computer security incident response team (CSIRT) is a concrete organizational entity (i.e., one or more staff) that is assigned the responsibility for coordinating and supporting the response to a computer security event or incident. CSIRTs can be created for nation states or economies, governments, commercial organizations, educational institutions, and even non-profit entities. The goal of a CSIRT is to minimize and control the damage resulting from incidents, provide effective guidance for response and recovery activities, and work to prevent future incidents from happening." (Ruefie, 2007, p. 1)Incident management is such that involves the detection and response to issues of security specifically computer related issues and the protection of "critical data, assets, and systems" in order to ensure that no incidents occur. (Ruefie, 2007, p. 1)
Required for incident prevention is involvement from "a wide range of participants across the enterprise." Included are: (1) security analysts, (2) incident handlers, (3) network and system administrators, (4) human resources and public affairs staff, (5) information security...
(Ruefie, 2007, p. 1)
The CSIRT is described as a "concrete organizational entity (i.e., one or more staff) that is assigned the responsibility of providing part of the incident management capability for a particular organization. When a CSIRT exists in an organization, it is generally the focal point for coordinating and supporting incident response." (Ruefie, 2007, p. 1) Kilcrece (2002) reports that the CSIRT duties include the performance of "at a minimum -- incident handling activities. This entails analyzing and resolving events and incidents that are reported by end users or are observed through proactive network and system monitoring." (Ruefie, 2007, p. 1) Specific duties of CSIRT incident include the following: (1) determining the impact, scope, and nature of the event or incident; (2) understanding the technical cause of the event or incident; (3) identifying what else may have happened or other potential threats resulting from the event or incident; (4) researching and recommending solutions and workarounds; (5) coordinating and supporting the implementation of the response strategies with other parts of the enterprise…
