Skip Links

Network World

Security

CSIRT Management: Lessons from other group postmortems

My favorite graduate course in the Norwich University Master of Science in Information Assurance Program is the "Computer Security Incident Response Team Management" graduate seminar which I developed some years ago based in part on an extensive series of articles on the subject that appeared here in the Network World Security Strategies and that I collected for readers in a single document freely available on my Web site along with a free companion CD-ROM from the Defense Information Systems Agency on the subject.

In 2008, I was blessed with five excellent students who not only wrote their weekly essays well but also participate enthusiastically in the weekly discussions (we have three or occasionally four topics for them to use in sharing insights and experiences) and in Week 9 of the 11-week course, one of the questions was as follows:

"Postmortems are conducted in many other fields – well, for example, as autopsies! But perhaps some of you have actually participated in non-CSIRT teams where a postmortem was standard operating procedure. Examples might include, say, a sports team, any kind of problem-solving team, a marketing group looking at an advertising campaign, a group of professors evaluating a new course, and a group of detectives or attorneys looking at how an investigation or a courtroom proceeding turned out. Please share interesting experiences of this kind with your classmates and see if any of your insights can be constructively applied to CSIRT management."
Continued

Recent Newsletters | Archive

Question of the Day: IT Asked & Answered

I work with a PostgreSQL database that sits behind two SSH logins. The first machine is accessible from the Internet. The second machine is accessible only by SSH and only from the first machine. How...By Anon

Continue reading

trendwatch security

Enterprise network defenses can never be deep enough. Examining how to protect data in the age of openness:

View PDF version

More ways to stay informed

NetworkWorld content as you like it

News

View Security news | All news

Featured Video

Blogs

View all Blogs

Clear Choice Tests

View more Clear Choice Tests

Case Studies

View more Case Studies