Establishing a Computer Security Incident Handling Capability

Computer systems and the information they store are valuable resources that need to be protected. Increasingly sophisticated threats including system and network intruders, computer viruses, and network worms can exploit a variety of weaknesses in computer systems and cause significant damage. Due to increased use of local area networks (LANs) and large networks such as the Internet, damage caused by seemingly isolated computer security incidents can spread to other systems, causing widespread denial of service and other losses.

Government agencies, business, and academic institutions need to take steps to understand the increased threats now affecting computer systems and to learn how to respond to computer security incidents with the requisite speed and skill. This bulletin recommends the use of a Computer Security Incident Response Capability (CSIRC) as part of a computer security program so that incidents can be contained and ultimately prevented in a timely and cost-effective manner.