Incident Response

Development of Incident Response Efforts

Unlike firefighting -- which has been in existence for centuries -- computer incident response is a comparatively new area that began in 1988 with the establishment of the Carnegie Mellon University Computer Emergency Response Team Coordination Center (CERT/CC) in Pittsburgh, PA. Incidents certainly occurred and were handled before this, but it is only since 1988 that incident response has taken shape as a distinct discipline within the information security profession. Previously, an incident in a typical organization was handled by the organization’s IT staff and/or its security staff in a more or less ad hoc manner. The results, as might be expected, tended to be hit or miss, and were frequently:

• Unpredictable

• Unfocused, with no one knowing who was in charge of the situation

• Not tightly synchronized with senior management’s wishes and priorities in mind

• Costly, although such ad hoc incident response situations were not even sufficiently organized to provide an accurate accounting of actual costs

• Time-consuming

The history of incident response as a discrete discipline goes back to November 1988, when a young Cornell University graduate student named Robert T. Morris wrote a program known as a worm , and subsequently unleashed it on the fledgling Internet. Due primarily to the unavailability of large portions of the Internet, the incident resulted in what seemed to be panic and pandemonium. During the incident, individual system administrators, ...