Appendix A: CSIRT

Question 1

Coordination centers

Answer 1

Coordinate handling of incidents across various CSIRTs. (i.e. US-CERT)

Question 2

Analysis Centers

Answer 2

Synthesize data. Look for trends in incident activity.

Question 3

Vendor teams

Answer 3

Vendor team that handles vulnerabilities in their products. Also remediation and mitigation.

Question 4

Incident response providers

Answer 4

MSSP

Question 5

CSIRT Constituency

Answer 5

Who they support

Question 6

CSIRT relationship to others

Answer 6

Peers

Question 7

CSIRT place in org.

Answer 7

Roots (mostly in the SOC)

Question 8

Reactive service

Answer 8

Triggered by an event, request,

Question 9

Proactive service

Answer 9

Prepare, protect systems

Question 10

Triage function

Answer 10

Help desk level activities.

Question 11

Handling function

Answer 11

Reviews incident report. Analysis. Responses. Notification.

Question 12

Feedback function

Answer 12

Supports giving feedback on issues not related to specific incident.

Interface with media.

Question 13

Optional announcement function

Answer 13

Provides advisories