Building a Cybersecurity Incident Response Team

This chapter discusses various topics that organizations need to consider when building a cybersecurity incident response team (CSIRT). It describes the characteristics of a successful team; clarifies the difference among Computer Emergency Response Team, Security Operations Center, and CSIRT; and provides a detailed explanation of what the term CSIRT really means. The chapter discusses incident response team models, support structures, and topics relating to hiring and training personnel possessing incident response competencies. Enterprises need to establish a CSIRT coordination model and determine how information flows between the stakeholders to ensure that everyone works toward the same goals. The chapter looks at how technical and business functions, as well external entities, augment a core incident response team when an enterprise convenes a CSIRT to respond to a cybersecurity incident. Enterprises may also choose to outsource their cybersecurity, including incident response, to focus on their core business.