CSIRT

Today organizations in every industry face the increased probability of data security breaches. As a result, more companies realize the need for a formal Computer Security Incident Response Team, or CSIRT. Whether the aim is to steal sensitive customer data, hacktivism, or industrial espionage, modern cyber attacks are calculated, sophisticated undertakings, and any enterprise can find itself under siege. Quelling pervasive threats requires an organized, vigilant approach to computer security—supported by the establishment of a CSIRT.

The Services Provided by a Formal CSIRT

Assembling a permanent CSIRT and defining an incident response plan will help an enterprise to efficiently detect, contain and recover from computer security incidents. By taking timely, appropriate action, an incident response team can respond to potential attacks before an organization's systems and networks are significantly altered or damaged. The swiftness with which an organization can recognize and respond to threats is crucial in minimizing the impact of and accelerating recovery from info security breaches.

The core responsibility of the incident response team is to respond systematically to security incidents when they happen, performing reactive services such as incident management, which involves taking action to identify the causes of an incident and restore and protect affected systems and networks. The CSIRT may also provide proactive services, offering assistance to IT and security personnel in order to improve an organization's security controls and processes. This may include:

• Supporting security auditing efforts through the implementation of best practice reviews, vulnerability scanning, and penetration testing
• Ensuring the proper configuration, maintenance and patching of network security tools, applications, and systems
• Developing new security tools and technologies and scripts that enhance the functionality of existing security infrastructure

A key component of a successful information security program, a formally established CSIRT serves as a central point of contact regarding computer security incidents and security-related policies, allowing for the centralization of information to assess existing risks. Further, if the team is able to contribute to security management services such as risk analysis and disaster recovery planning, the accumulated knowledge of a CSIRT can strengthen the overall security posture of an organization.

The Critical Intelligence and Security Capabilities Supporting Our Customers

At Akamai, our CSIRT team analyzes and accumulates the latest threat intelligence, enabling us to continuously improve our product capabilities and provide our customers with up-to-date threat advisories and practicable advice on mitigating complicated cyber attacks like the BREACH attack. Our CSIRT can help you more effectively leverage the Cloud Security Solutions we have built into the Akamai Intelligent Platform. These solutions include our Kona Site Defender and Web Application Firewall, a scalable, globally distributed layer of defense against harmful network and web application attacks such as a DDoS attack or SQL injection attack.

Learn more about how Akamai's solutions can safeguard your web sites and applications.