How to setup a CSIRT

• CERT Security Practices and Evaluations
• CSIRTs FAQ
• Organizational Models for Computer Security Incident Response Teams (CSIRTs)
  Georgia Killcrece, Klaus-Peter Kossakowski, Robin Ruefle, Mark Zajicek. CMU/SEI-2003-HB-001. December 2003 -http://www.sei.cmu.edu/publications/documents/03.reports/03hb001.html
• Establishing a Computer Security Incident Response Capability (CSIRC). NIST Special Publication 800-3, November, 1991
• Financial issues

• Developing an Effective Incident Handling Cost Analysis Mechanism, by David A. Dittrich; SecurityFocus, June 12, 2002 http://online.securityfocus.com/infocus/1592

• Incident Cost and Analysis Model Project
  http://www.cic.uiuc.edu/groups/ITSecurityWorkingGroup/archive/Report/ICAMP.shtml

• 2001 Information Security Industry Survey
  http://www.infosecuritymag.com/articles/october01/images/survey.pdf

• Forming an Incident Response Team
This paper is based on experience of establishing Australian CERT in 1993 and presents useful tips how to establish a new IRT.

• ---

• Training the new staff of CSIRTs: IST Project TRANSITS (Training of Network Security Incident Teams Staff)

• RFC 2196. Site Security Handbook (replaces the now obsolete RFC1244)
This handbook is a guide to setting computer security policies and procedures for sites that have systems on the Internet (however, the information provided should also be useful to sites not yet connected to the Internet).  This guide lists issues and factors that a site must consider when setting their own policies.  It makes a number of recommendations and provides discussions of relevant areas [local].

• RFC 2350. Expectation for Security Incident Response Teams
This document describes the general Internet community's expectations of Computer Security Incident Response Teams (CSIRTs). It is not possible to define a set of requirements that would be appropriate for all teams, but it is possible and helpful to list and describe the general set of topics and issues which are of concern and interest to constituent communities [local].
• RFC2504. Users' Security Handbook
This document provides guidance to the end-users of computer systems and networks about what they can do to keep their data and communication private, and their systems and networks secure. Part Two of this document concerns "corporate users" in small, medium and large corporate and campus sites.  Part Three of the document addresses users who administer their own computers, such as home users. System and network administrators may wish to use this document as the foundation of a site-specific users' security guide; however, they should consult the Site Security Handbook first [local].
• RFC3013. Recommended Internet Service Provider Security Services and Procedures
The purpose of this document is to express what the engineering community as represented by the IETF expects of Internet Service Providers (ISPs) with respect to security. It is not the intent of this document to define a set of requirements that would be appropriate for all ISPs, but rather to raise awareness among ISPs of the community's expectations, and to provide the community with a framework for discussion of security expectations with current and prospective service providers [local].

• RFC3227. Guidelines for Evidence Collection and Archiving
  The purpose of this document is to provide System Administrators with guidelines on the collection and archiving of evidence relevant to such a security incident. If evidence collection is done correctly, it is much more useful in apprehending the attacker, and stands a much greater chance of being admissible in the event of a prosecution. [local].

• National Startegy to Secure Cyberspace - Published by US President's Critical Infrastructure Protection Board September 18, 2002
  Stategies developed by other sectors:
• Partnership for Criticaql Infrastructure Security
• NIST Computer Security Special Publications
• Unix System Administration written by Frank G. Fiamingo from University Technology Services The Ohio State University.
• Center for Education and Research in Information Assurance and Security (CERIAS)
• Incident Reporting Guidelines. - CERT® Coordination Center. Updated September 2002.
• FIRST Information - Information of general interest and for FIRST members.

• Forum of Incident Response and Security Teams
• Trusted Introducer (TI) process for CSIRTs and basic set of information about CSIRT required by TI
• TF-CSIRT (Task Force for CSIRT Coordination in Europe)
• eCSIRT - The European CSIRT Network 
• CHIHT (Clearinghouse for Incident Handling Tools)