Types of CSIRTs
A single person, the computer or network administrator of a small organization, may constitute the full and permanent incident response team. Responding to a major incident may overtake other ordinary responsibilities. For this reason, as an organization’s information technology operation becomes larger or more complex, the nature of its response capability often changes.
But one person or one in-house response organization is not the full layout of incident response throughout the world. Although some incidents are confined to one organization, others involve multiple targets, sometimes across organizational, political, and geographic boundaries. Here are some models for CSIRTs:
• a full organizational response team to cover all incidents; such a team may include separate staff to deal with situations in different organizational units, such as plants in separate locations or distinct business units of a larger company
• coordination centers to coordinate incident response activity across organizations, so that work is not duplicated unnecessarily and efforts proceed toward the same goals
• so-called national CSIRTs with coordination responsibility within a country and to national CSIRTs of other countries
• sector CSIRTs to assist with investigating and handling incidents specific to a particular business sector, for example, financial institutions or medical facilities; some attacks focus on one type of target (for example, in 2013 large banks were the target of massive denial-of-service attacks)
• vendor CSIRTs to address or participate in incidents involving one manufacturer’s products
• outsourced CSIRT teams, hired to perform incident response services on contract to other companies
CSIRTs operate in organizations, nationally, internationally, by vendor, and by business sector.
A related concept is the security operations center (SOC), which performs the day-to-day monitoring of a network and may be the first to detect and report an unusual situation. Also, information sharing and analysis centers (ISACs) perform some CSIRT functions by sharing threat and incident data across CSIRTs.
