Improving Cybersecurity Incident Response Team (CSIRT) Skills, Dynamics and Effectiveness

reportActive / Technical Report | Accession Number: AD1027871 | Open PDF

Abstract:

By analyzing documentation, observing actual CSIRT activity, convening focus groups, and using pre- and post-incident interviews, a team from Dartmouth College, George Mason University and Hewlett-Packard recommended ways to improve the skills, dynamics and effectiveness of CSIRTs. The results include descriptions of needed knowledge, skills and abilities for key CSIRT roles, viewed from individual, team and multi-team system perspectives, as well as simulation-derived recommendations for optimal CSIRT performance.

Author(s):
Pfleeger, Shari L.
Author Organization(s):
Trustees of Dartmouth College Hanover United States
Descriptive Note:
Technical Report,01 Sep 2012,01 Jun 2016
Pagination:
0021

Security Markings

DOCUMENT & CONTEXTUAL SUMMARY

Distribution:
Approved For Public Release
Distribution Statement:
Approved For Public Release;

RECORD

Collection: TR
Identifying Numbers
Report Number(s):
AFRL/RI-AFRL-RI-RS-TR-2017-029
Task Number(s):
DA
Project Number(s):
DHS2
Monitor Series:
AFRL-RI-RS-TR-2017-029
 Subject Terms
Joint Capability Areas:
JCA_5_Command and Control; JCA_5.3_Planning; JCA_5.2_Understand; JCA_5.2.3_Share Knowledge and Situational Awareness; JCA_5.3.3_Develop Strategy; JCA_5.3.2_Apply Situational Understanding; JCA_4.6_Engineering; JCA_4.6.1_General Engineering; JCA_5.3.1_Analyze Problem; JCA_5.2.2_Develop Knowledge and Situational Awareness; JCA_5.4_Decide; JCA_5.5.2_Task; JCA_5.5_Direct; JCA_1.2.1_Training; JCA_1.2.5_Lessons Learned; JCA_1.2.3_Educating; JCA_1.2.2_Exercising; JCA_2.1_Planning and Direction
Modernization Areas:
Cyber
Communities of Interest:
Cyber
Descriptor(s):
computer security, information exchange, job analysis, teamwork, situational awareness, software development, training, mental processes, homeland security
Field(s)/Group(s):
Computer Systems Management and Standards, Personnel Management and Labor Relations
Keyword(s):
Cyber Incident Response, Response Teams, Cognitive Task Analysis
Report Date:
2017 Mar 01
Creation Date:
2017 Sep 22