![](https://csdnimg.cn/release/download_crawler_static/12174599/bgf.jpg)
COMPUTER SECURITY INCIDENT HANDLING GUIDE
6
2. Organizing a Computer Security Incident Response Capability
Organizing an effective computer security incident response capability (CSIRC) involves several major
decisions and actions. One of the first considerations should be to create an organization-specific
definition of the term “incident” so that the scope of the term is clear. The organization should decide
what services the incident response team should provide, consider which team structures and models can
provide those services, and select and implement one or more incident response teams. Incident response
plan, policy, and procedure creation is an important part of establishing a team, so that incident response
is performed effectively, efficiently, and consistently, and so that the team is empowered to do what needs
to be done. The plan, policies, and procedures should reflect the team’s interactions with other teams
within the organization as well as with outside parties, such as law enforcement, the media, and other
incident response organizations. This section provides not only guidelines that should be helpful to
organizations that are establishing incident response capabilities, but also advice on maintaining and
enhancing existing capabilities.
2.1 Events and Incidents
An event is any observable occurrence in a system or network. Events include a user connecting to a file
share, a server receiving a request for a web page, a user sending email, and a firewall blocking a
connection attempt. Adverse events are events with a negative consequence, such as system crashes,
packet floods, unauthorized use of system privileges, unauthorized access to sensitive data, and execution
of malware that destroys data. This guide addresses only adverse events that are computer security-
related, not those caused by natural disasters, power failures, etc.
A computer security incident is a violation or imminent threat of violation
of computer security policies,
acceptable use policies, or standard security practices. Examples of incidents
are:
An attacker commands a botnet to send high volumes of connection requests to a web server, causing
it to crash.
Users are tricked into opening a “quarterly report” sent via email that is actually malware; running the
tool has infected their computers and established connections with an external host.
An attacker obtains sensitive data and threatens that the details will be released publicly if the
organization does not pay a designated sum of money.
A user provides or exposes sensitive information to others through peer-to-peer file sharing services.
2.2 Need for Incident Response
Attacks frequently compromise personal and business data, and it is critical to respond quickly and
effectively when security breaches occur. The concept of computer security incident response has become
widely accepted and implemented. One of the benefits of having an incident response capability is that it
supports responding to incidents systematically (i.e., following a consistent incident handling
methodology) so that the appropriate actions are taken. Incident response helps personnel to minimize
loss or theft of information and disruption of services caused by incidents. Another benefit of incident
response is the ability to use information gained during incident handling to better prepare for handling
An “imminent threat of violation” refers to a situation in which the organization has a factual basis for believing that a
specific incident is about to occur. For example, the antivirus software maintainers may receive a bulletin from the software
vendor, warning them of new malware that is rapidly spreading across the Internet.
For the remainder of this document, the terms “incident” and “computer security incident” are interchangeable.