Cyber Breach Response That Actually Works

CHAPTER 2Building a Cybersecurity Incident Response Team

Enterprises build defenses to protect digital assets from cyberattacks and keep cyber risk at an acceptable level. However, even with state-of-the-art controls, cybersecurity incidents are inevitable. For this reason, enterprises need a team with specialized skills to respond to incidents and coordinate activities between all of the parties that participate in the incident management process.

The structure and support model of an incident response function, and the services that it will provide to the organization, are vital considerations. Enterprises also need to decide what capabilities to build in-house versus in what areas they need to partner with outsourcing organizations.

This chapter discusses various topics that organizations need to consider when building a cybersecurity incident response team (CSIRT).

Defining a CSIRT

This section discusses the characteristics of a successful team; clarifies the difference among Computer Emergency Response Team (CERT), Security Operations Center (SOC), and CSIRT; and provides a detailed explanation of what the term CSIRT really means.

CSIRT History

The history of CSIRT started with the “Morris Worm.” On November 2, 1988, Robert Tappan Morris, a student at Cornell University, launched a self-replicating computer worm from an MIT computer via the Internet. Known as the “Morris Worm,” the code crippled nearly 6,000 computers, which at that time was roughly 10 percent of all ...