CIRT management: Tracking incidents

Computer Incident Response Team advantages, requirements and tools

Security Strategies Alert Newsletter  By M. E. Kabay, Network World, 08/19/04

 Start a discussion    Print article

 Comments (1)    Print article

Page 2 of 2

* Handover of control:  Whenever someone takes over control of the case, that handover should be noted in the record.

* Technical details including:

  - Diagnostics

  - Tests of hypotheses

* Resolution:  What was the outcome?  When was the case closed?

* Search facilities:  Full-text search capabilities.

* Knowledge base:  Ability to integrate vendor-supplied entries to speed research.

In an online discussion by someone called "DonaldA-M", I noted two additional points I hadn't thought of:

* Industry-standard database engine:  Easy to learn, maintain and improve.

* Accept input from comma-separated value (CSV) files:  Import data from other systems.

TOOLS:

There's a wide range of software available for tracking incidents.  You can build your own, but then you'll have to provide proper documentation and training materials because turnover is a constant problem for CIRTs.  In addition, unless your analysts have experience with the CIRT function, they are likely to miss useful features that have accumulated over the years in products used by thousands of people.

I have provided a short list of proprietary (commercial) help desk products in the Readings section below.  You will want to use the Network World Fusion search at http://search.nwfusion.com/query.html?qt=help+desk to see an extensive list of articles on this topic.

There are also well-respected open-source tools listed below.

All such tools can be complex; since you don't want people fumbling about in an emergency, be sure that you budget for adequate training for your staff as you implement the tool you select.

* * *

For Further Reading

"DonaldA-M" (2003).  Good, but there's more...
http://tinyurl.com/4bcve

Cerberus Helpdesk
http://cerberusweb.com/

DISA (2001).  Introduction to Computer Incident Response Team (CIRT) Management.  Defense Information Systems Agency, U.S. Department of Defense.  See http://iase.disa.mil/eta/ to download a full PDF catalog of free training materials.

Help Desk Institute
http://www.thinkhdi.com/

HelpMaster Pro Suite
http://www.prd-software.com.au/prd/help-desk-products/

Open Source Ticket Request System (OTRS)
http://otrs.org/

Request Tracker (RT)
http://www.bestpractical.com/rt/

TrackIt!
http://www.itsolutions.intuit.com/Track-It.asp

Ward, J. (2003).  Evaluate help desk call-tracking software with these criteria.
http://techrepublic.com.com/5100-6270-5030618.html?tag=series

Ward, J. (2003).  Product review:  HEAT PowerDesk, call center tracking software.
http://techrepublic.com.com/5100-6270-5034947.html

Ward, J. (2003).  Product review:  HelpMaster call center tracking software. 
http://techrepublic.com.com/5100-6270-5034721.html

Featured White Papers

• Hey, Can I Borrow Your Keys? I'd Like to Trash the Kingdom