Best Practice Detail

13-7-8062

Network Operators and Service Providers should identify and train a Computer Security Incident Response (CSIRT) Team. This team should have access to the CSO (or functional equivalent) and should be empowered by senior management. The team should include security, networking, and system administration specialists but have the ability to augment itself with expertise from any division of the organization. Organizations that establish part-time CSIRTs should ensure representatives are detailed to the team for a suitable period of time bearing in mind both the costs and benefits of rotating staff through a specialized team.

Status: Rollover New

References/Comments: IETF RFC2350, CMU/SEI-98-HB-001. Also, NRIC BP 0598.

Historical events:

• Network Operators
• Service Providers
• Cable
• Internet/Data
• Satellite
• Wireless
• Wireline
• Cyber Security
• Emergency Preparedness
• Training and Awareness
• CSRIC VII: Rollover New In CSRIC VII