search menu icon-carat-right cmu-wordmark

Defining Incident Management Processes for CSIRTs: A Work in Progress

Technical Report
In this report, the authors present a prototype best practice model for performing incident management processes and functions.
Publisher

Software Engineering Institute

CMU/SEI Report Number
CMU/SEI-2004-TR-015
DOI (Digital Object Identifier)
10.1184/R1/6572939.v1

Abstract

This report presents a prototype best practice model for performing incident management processes and functions. It defines the model through five high-level incident management processes: Prepare/Sustain/Improve, Protect Infrastructure, Detect Events, Triage Events, and Respond. Workflow diagrams and descriptions are provided for each of these processes. 

One advantage of the model is that it enables examination of incident management processes that cross organizational boundaries, both internally and externally. This can help computer security incident response teams (CSIRTs) improve their ability to collaborate with other business units and other organizations when responding to incidents. 

Future reports will extend this work and provide additional guidance to enable both newly forming and existing incident management capabilities to use the model to determine where gaps exist in their current processes and to develop plans for creating, improving, or restructuring their incident management processes. 

Although the processes defined in this document were originally developed for internal CSIRTs, the models and information presented here are applicable to other types of CSIRTs and other types of incident management and security management capabilities.

Cite This Technical Report

Alberts, C., Dorofee, A., Killcrece, G., Ruefle, R., & Zajicek, M. (2004, October 1). Defining Incident Management Processes for CSIRTs: A Work in Progress. (Technical Report CMU/SEI-2004-TR-015). Retrieved May 20, 2024, from https://doi.org/10.1184/R1/6572939.v1.

@techreport{alberts_2004,
author={Alberts, Christopher and Dorofee, Audrey and Killcrece, Georgia and Ruefle, Robin and Zajicek, Mark},
title={Defining Incident Management Processes for CSIRTs: A Work in Progress},
month={Oct},
year={2004},
number={CMU/SEI-2004-TR-015},
howpublished={Carnegie Mellon University, Software Engineering Institute's Digital Library},
url={https://doi.org/10.1184/R1/6572939.v1},
note={Accessed: 2024-May-20}
}

Alberts, Christopher, Audrey Dorofee, Georgia Killcrece, Robin Ruefle, and Mark Zajicek. "Defining Incident Management Processes for CSIRTs: A Work in Progress." (CMU/SEI-2004-TR-015). Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, October 1, 2004. https://doi.org/10.1184/R1/6572939.v1.

C. Alberts, A. Dorofee, G. Killcrece, R. Ruefle, and M. Zajicek, "Defining Incident Management Processes for CSIRTs: A Work in Progress," Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, Technical Report CMU/SEI-2004-TR-015, 1-Oct-2004 [Online]. Available: https://doi.org/10.1184/R1/6572939.v1. [Accessed: 20-May-2024].

Alberts, Christopher, Audrey Dorofee, Georgia Killcrece, Robin Ruefle, and Mark Zajicek. "Defining Incident Management Processes for CSIRTs: A Work in Progress." (Technical Report CMU/SEI-2004-TR-015). Carnegie Mellon University, Software Engineering Institute's Digital Library, Software Engineering Institute, 1 Oct. 2004. https://doi.org/10.1184/R1/6572939.v1. Accessed 20 May. 2024.

Alberts, Christopher; Dorofee, Audrey; Killcrece, Georgia; Ruefle, Robin; & Zajicek, Mark. Defining Incident Management Processes for CSIRTs: A Work in Progress. CMU/SEI-2004-TR-015. Software Engineering Institute. 2004. https://doi.org/10.1184/R1/6572939.v1