* Suggested rules for help desk triage
This is another in an occasional series of brief articles looking at computer incident response team (CIRT) management. A primary source for this series is the U.S. Defense Information Systems Agency training course listed at the end of the article.
“Triage” in French (my native language) means “sorting.” In emergency medicine, the term was applied to the process of prioritizing treatment for patients arriving at trauma hospitals near combat zones in World War I. The same concept has been applied to help desks.
For example, the “Help desk triage policy” from Courtesy Computers illustrates how a help desk team can categorize problems to ensure that important issues receive faster service than less important problems. Importance is defined in terms of the number of users affected, the effects on mission-critical functions, and the costs of downtime or of less-than-optimal functions. The five priority levels suggested in the document mentioned above are typical of the kind of triage categories established in many help desk departments (adapted from a table in the Courtesy Computers document)
Priority 1
* Issue of the highest importance – mission-critical systems with a direct impact on the organization (Examples: widespread network outage, payroll system, sales system, telecom system, etc.)
* Contact: Immediate – 5 minutes
* Resolution: 30 minutes
Priority 2
* Single user or group outage that is preventing the affected user(s) from working (Examples: failed hard drive, broken monitor, continuous operating system lockups, etc.)
* Contact: 15 minutes
* Resolution: 1 hour
Priority 3
* Single user or group outage that can be permanently or temporarily solved with a workaround (Examples: malfunctioning printer, PDA synchronization problem, PC sound problem, etc.)
* Contact: 30 minutes
* Resolution: Same Day
Priority 4
* Scheduled work (Examples: new workstation installation, new equipment/software order, new hardware/software installation)
* Contact: 1 hour
* Resolution: 1 to 4 days
Priority 5
* Nonessential scheduled work (Examples: office moves, telephone moves, equipment loaners, scheduled events)
* Contact: Same Day
* Resolution: 5 days
In his helpful overview, “CIRT – Framerwork and Models,” Ajoy Kumar summarizes the functions of triage as follows: “Triage: The actions taken to categorize, prioritize, and assign incidents and events. It includes following sub processes:
* Categorize events.
* Correlate various events. Personnel involved in such teams typically also belong to Forensic teams.
* Prioritize events.
* Assign events for handling and response.
* Communicate information to ‘Respond’ process for further handling.
* Reassign (and close) events not belonging to CIRT.”
The DISA training materials suggest three broader categories of interactions with help desks and CIRTs: “incidents, vulnerabilities, and information requests.” Incidents involve breaches of security; vulnerabilities include reports of security weaknesses (and may be reported as part of an incident); and information requests are often managed using lists of frequently asked questions (FAQ).
The DISA instructors go on to define factors which can help CIRTs prioritize incidents as follows:
* “The sensitivity and/or criticality of the data affected
* The amount of data affected
* Which host machines are involved
* Where and under what conditions the incident occurred
* Effects of the incident on mission accomplishment
* Whether the incident is likely to result in media coverage
* Number of users affected
* Possible relationships to other incidents currently being investigated
* The nature of the attack
* Economic impact and time lost
* Number of times the problem has recurred; and even
* Who reports the incident.”
On this last point, the DISA writers point out that the organizational rank of someone calling in an incident may bear on its priority – but that it may be wise to cross-check the report with a security expert who can speak to whether the report is sound.
In summary, it is important to establish a sound basis for staff members of the CIRT to carry out triage effectively. Once the rules for evaluating incidents have been clarified, staff members should practice analyzing a number of cases to train themselves in applying the rules consistently. Role-playing exercises based on historical records or on made-up examples can provide an excellent and enjoyable mechanism for staff members to establish a common standard for this difficult and sensitive task.
* * *
DISA (2001). Introduction to Computer Incident Response Team (CIRT) Management. Defense Information Systems Agency, U.S. Department of Defense. Go here for information about free training materials and to download an order form.
