Describe the goals of the given CSIRTImplementing Cisco Cybersecurity Operations (210-255)
A Computer Security Incident Response Team (CSIRT) can come in several different forms.
- Internal CSIRT – an Internal CSIRT is established by an organization to handle incident response for their own organization.
- National CSIRT – National CSIRTs provide services for a nation and will provide assistance to other CSIRTs
- Coordination Centers – Coordination Centers help to share incident response information US-CERT is an example.
- Analysis Centers – synthesis information from various sources to determine trends and patterns
- Vendor Teams – Vendors often have Product Security IRTs (PSIRT) that analyze and release information about product vulnerabilities
- Incident Response Providers (MSSP) – Managed Security Service Providers provide IRT to organizations that choose to purchase services instead of having their own team.