Handbook for Computer Security Incident Response Teams (CSIRTs)
Molra J. West-Brown, Don Stikvoort, Klaus-Peter Kossakowski, Georgia Killcrece, Robin Ruefle · 2003
We have often been asked whether an updated version of the CSIRT Handbook would ever be released.Periodically we have reviewed the document and found that most of the material and guidance provided are still current, relevant, and helpful to new and existing teams.Some of the examples included and organizations discussed were dated, but otherwise the concepts and recommendations covered are still valid for today's work.In the summer of 2002, the CERT ® CSIRT Development Team began collaboration with the Trusted Introducer for European Computer Security Incident Response Teams (CSIRTs) service to create a standard set of service descriptions for CSIRT functions.As we finished that document 1 it became apparent that we should, indeed, update the CSIRT Handbook to include this new list of services.As we began to revise the document we felt it was also time to update any out-of-date examples and also any out-of-date terminology.We also included, where appropriate, references to new discussion topics, resources, or CSIRT operational activities that we believe are relevant to the information discussed in this handbook.In the long run though, we elected to minimize the changes to the original as much as possible.These are the main changes that have been made:1.Many of the examples provided in the handbook have been updated.We have kept a number of the previous examples, as they are still true conceptually and the guidance available still proves to be useful today.More recent examples have been added that we hope will be more applicable for today's readers.2. The new CSIRT service definitions have been incorporated throughout the handbook.3. The handbook has been aligned with other new documents that we have produced or are in the process of producing, specifically the new Organizational Models for CSIRTs handbook.This document is a companion piece to the CSIRT Handbook.It provides detailed information on the types of organizational structures and corresponding services that may be implemented to provide a CSIRT capability.We have timed the release of this updated version of the CSIRT Handbook with the publication of the Organizational Models for CSIRTs handbook.