Incident Response

Public Resource Teams

The first widely recognized incident response team, the Carnegie Mellon CERT, is the most frequently cited example of a public resource team. It is funded primarily by a government organization, the Department of Defense’s Advanced Research Projects Agency (DARPA), and it is a resource available to a general audience. The original 1988 charter of the CERT set up the team to be a “direct service to the Internet community.” In that role, the CERT/CC provided the entire Internet with incident response assistance including vulnerability advisories and telephone- and email-based guidance to sites experiencing security crises. (It is only fair to note here that the Internet was a substantially smaller place in 1988 when the CERT was first chartered.)

In the years since the formation of the CERT/CC, dozens of other public resource incident response teams have been formed, each serving its own constituency. These IRTs provide localized assistance for their own constituencies and typically draw on funding provided by some form of fee upon the entire constituency. Each IRT service offerings vary, of course, but the core services usually include the following:

Technical and procedural guidance to sites affected by an incident

The IRTs typically provide guidance via telephone and/or email.

Vulnerability reporting, analysis, tracking, and advisory distribution

Most IRTs function as a clearinghouse through which constituents can report system vulnerabilities. The IRT, ...