Computer Security Incident Response Team Development and Evolution

• Published in: IEEE security & privacy Vol. 12; no. 5; pp. 16 - 26
• Main Authors: Ruefle, Robin, Dorofee, Audrey, Mundie, David, Householder, Allen D., Murray, Michael, Perl, Samuel J.
• Format: Magazine Article
• Language: English
• Published: New York IEEE 01-09-2014; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Availability; Computer crashes; Computer information security; Computer security; Contingency planning; Cybercrime; Cybersecurity; Data encryption; Evolution; Handles; information exchange; Information management; information security; Information technology; Integrity; Management; organizational aspects; Organizations; Performance evaluation; risk analysis; sociotechnical systems
• ISSN: 1540-7993; 1558-4046
• DOI: 10.1109/MSP.2014.89

When computer security incidents occur, it's critical that organizations be able to handle them in a timely manner. The speed with which an organization can recognize, analyze, and respond to an incident will affect the damage and lower recovery costs. Organized incident management requires defined, repeatable processes and the ability to learn from incidents that threaten the confidentiality, availability, and integrity of critical systems and data. Some organizations assign responsibility for incident management to a defined group of people or a designated unit, such as a computer security incident response team. This article looks at the development, purpose, and evolution of such specialized teams; the evolving nature of attacks they must deal with; and methods to evaluate the performance of such teams as well as the emergence of information sharing as a core service.