A computer security incident response team (**CSIRT**) is a specialised group of *security professionals that are trained in incident management and response*. During incident response, teams can encounter a variety of different challenges. For incident response to be effective and efficient, there must be clear **command, control, and communication** of the situation to achieve the desired goal. - *Command* refers to having the appropriate leadership and direction to oversee the response. - *Control* refers to the ability to manage technical aspects during incident response, like coordinating resources and assigning tasks. - *Communication* refers to the ability to keep stakeholders informed. Establishing a CSIRT organisational structure with clear and distinctive roles aids in achieving an effective and efficient response. ### Roles in CSIRTs CSIRTs are organization dependent, so they can vary in their structure and operation. Structurally, they can exist as a separate, dedicated team or as a task force that meets when necessary. CSIRTs involve *both non-security and security professionals*. Non-security professionals are often consulted to offer their expertise on the incident. These professionals can be from external departments, such as human resources, public relations, management, IT, legal, and others. Security professionals involved in a CSIRT typically include three key security related roles: - Security analyst - Technical lead - Incident coordinator #### Security analyst The job of the security analyst is to continuously monitor an environment for any security threats. This includes: - Analysing and triaging alerts - Performing root-cause investigations - Escalating or resolving alerts If a critical threat is identified, then analysts *escalate it to the appropriate team lead*, such as the technical lead. #### Technical lead The job of the technical lead is to *manage all of the technical aspects of the incident response process*, such as applying software patches or updates. They do this by first determining the root cause of the incident. Then, they create and implement the strategies for containing, eradicating, and recovering from the incident. Technical leads often collaborate with other teams to ensure their incident response priorities align with business priorities, such as reducing disruptions for customers or returning to normal operations. #### Incident coordinator Responding to an incident also requires cross-collaboration with non-security professionals. CSIRTs will often consult with and leverage the expertise of members from external departments. The job of the incident coordinator is to *coordinate with the relevant departments during a security incident*. By doing so, the lines of communication are open and clear, and all personnel are made aware of the incident status. Incident coordinators can also be found in other teams, like the SOC.