Creating a CSIRT: Getting Started
Operating Your CSIRT
Developing Incident Handling Cost Models
Collecting Evidence/Forensics
Organizations for CSIRTs
Projects Related to CSIRTS
Collections of Publications Related to Computer Security and CSIRTs

Creating a CSIRT: Getting Started

• Action List for Developing a Computer Security Incident Response Team (CSIRT)
• Creating a Computer Security Incident Response Team: A Process for Getting Started
• Defining Incident Management Processes for CSIRTs: A Work in Progress (pdf) | html
• Staffing Your Computer Security Incident Response Team – What Basic Skills Are Needed?
• Steps for Creating National CSIRTs (pdf)
• Limits to Effectiveness in Computer Security Incident Response Teams (pdf)
• Creating a Financial Institution CSIRT: A Case Study
• Organizational Models for Computer Security Incident Response Teams (pdf) | html
• Forming an Incident Response Team (AusCERT Publication)
• CSIRT Services
• Expectations for Computer Security Incident Response (RFC 2350)
• CSIRT Frequently Asked Questions

Operating Your CSIRT

• Handbook for Computer Security Incident Response Teams (CSIRTs) (pdf) | html
• State of the Practice of Computer Security Incident Response Teams (pdf) | html
• Incident Management Capability Metrics (pdf) | html
• Incident Management Mission Diagnostic Method (pdf) | html
• NIST Computer Security Incident Handling Guide (pdf)
• Avoiding the Trial-by-Fire Approach to Security Incidents
• Site Security Handbook (RFC 2196)
• The SANS Security Policy Project

Podcasts

• The Real Secrets of Incident Management

Developing Incident Handling Cost Models

• Developing an Effective Incident Cost Analysis Mechanism, by David A. Dittrich, SecurityFocus, June 12, 2002
• Incident Cost Analysis and Modeling Projects
• Australian Computer Crime and Security Survey
• CSI/FBI Computer Crime and Security Survey

Collecting Evidence/Forensics

• First Responders Guide to Computer Forensics (pdf)
• First Responders Guide to Computer Forensics - Advanced Topics (pdf)
• Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations, U.S. Department of Justice
• Guidelines for Evidence Collection and Archiving (RFC 3227)

Organizations for CSIRTs

• The Forum of Incident Response and Security Teams
• FIRST Site Visit Requirements and Assessment (pdf)
  
• TERENA TF-CSIRT - Collaboration of Security Incident Response Teams (Europe)
• Trusted Introducer for CSIRTs in Europe
• Asia Pacific Computer Emergency Response Team (APCERT)

Projects Related to CSIRTs

• AirCERT (Automated Incident Reporting)
• CHIHT - Clearing House for Incident Handling Tools
• The Incident Object Description Exchange Format (RFC 5070)

Collections of Publications Related to Computer Security and CSIRTs

• TF-CSIRT: General Information for IRTs/CERTs
• TF-CSIRT: CERT and System Security Information
• TF-CSIRT: Tools and Software for Intrusion Detection and System Security
• AusCERT Presentations and Papers
• SecurityFocus Infocus: Incident Handling articles
• Handbook of Legislative Procedures of Computer and Network Misuse in EU Countries (2003) (pdf)
• Update to the Handbook of Legal Procedures of Computer and Network Misuse in EU Countries for assisting CSIRTs (2005) (pdf)

If you have suggestions or recommendations for other resources or projects that should be listed here, please send email to csirt-info@cert.org.