Common challenges faced during the establishment of a CSIRT

Abstract

A CSIRT is a team of dedicated information security specialists that prepares for and responds to information security incidents. When an incident occurs, members of a CSIRT can assist its constituency in determining what happened and what actions need to be taken to remedy the situation. The establishment of a CSIRT, however, is not without certain difficulties or complications. Such a project requires sustained commitment and relies largely on a circle of international trust that needs time to develop. Without these attributes, a CSIRT establishment project can run into a number of problems that can have varying effects on the successfulness of the project. This article looks at a number of common problems faced during the establishment of a CSIRT, within the set of chronological steps.