Computer Incident Response Team Assembly

By Alexander R Ward

November 11, 2012

In any organization preventative maintenance is strongly encouraged and sometimes mandatory. The reason for doing such actions is to prevent incidents. However, no matter how well your organization has prepared or tried to prevent an incident it will fail. Incidents happen no matter what. There is no changing that fact. But what makes and breaks organizations is how they react to the incident at hand. Planning and formulation of a team to handle incidents is something that can be difficult to do. For that reason management has to put together a team that is not only well educated, but seasoned. Putting together a team of junior professionals would be extremely detrimental to that organization, but that is not to say that a team shouldn’t consist of junior personnel. Each and every roll within an incident response team is vitally important. The Computer Security Incident Response Team (CSIRT) is designed to mitigate and handle the dangers that come with operating in a digital environment. Before we can delve into creating or assembling the CSIRT there are a few things that must be covered. By definition what is the purpose of a CSIRT? A CSIRT is there to outline the organizational structure and delineation of roles and responsibilities and to supplement an organization’s security infrastructure to investigate and minimize the threat of damage resulting from a breach of restricted/confidential or internal data (Gramm, 2012). Having a set of procedures to help minimize the occurrence of incidents or damage to the organization is necessary. Clearly establish and enforce all policies and procedures. Many security incidents are accidentally created by IT personnel who have not followed or not understood change management