Computer Security Incident Response Teams (CSIRTs)

Abstract

For major security breaches, many corporations activate computer security incident response teams (CSIRTs). CSIRTs pull together the skills of IT security personnel, IT personnel, functional line managers, other corporate employees, external business partners, and law enforcement agencies, in order to analyze the attack, contain it, repair damage, (possibly) punish the wrongdoer, and harden the attacked system to prevent a repeat of the security incident. Keywords: CERT (computer emergency response team); IT security staff; postmortem analysis; security breach; security incident