Skip the navigation  Build a Computer Incident Response Team
With money and reputation on the line, a computer incident
response team must be speedy and organized.  July 15, 2002 12:00
PM ET  Computerworld - A computer incident response team, or
CIRT, is a lot like a firefighting crew - both are composed of
individuals trained to respond quickly to specific incidents
with the goal of limiting damage and reducing recovery time and
costs. "Like a fire department, you can use [CIRTs] for actual
incident response and for cleanup, for education and for
drills," says Richard Mogull, an analyst at GartnerG2 in
Stamford, Conn. A CIRT may be activated by virus or hacker
attacks, internal sabotage or even suspicious activity, such as
successive attempts to gain access to a system or transactions
that fall outside preset boundaries - such as a money transfer
exceeding $1 million. Incident response at companies that don't
have a CIRT tends to be expensive and ad hoc, says Steve Romig,
manager of the network security gro