Audrey J. Dorofee

Computer Security Incident Response Team Development and Evolution

When computer security incidents occur, its critical that organizations be able to handle them in a timely manner. The speed with which an organization can recognize, analyze, and respond to an incident will affect the damage and lower recovery costs. Organized incident management requires defined, repeatable processes and the ability to learn from incidents that threaten the confidentiality, availability, and integrity of critical systems and data. Some organizations assign responsibility for incident management to a defined group of people or a designated unit, such as a computer security incident response team. This article looks at the development, purpose, and evolution of such specialized teams; the evolving nature of attacks they must deal with; and methods to evaluate the performance of such teams as well as the emergence of information sharing as a core service.

A Systemic Approach for Assessing Software Supply-Chain Risk

In todays business environment, multiple organizations must routinely work together in software supply chains when acquiring, developing, operating, and maintaining software products. The programmatic and product complexity inherent in software supply chains increases the risk that defects, vulnerabilities, and malicious code will be inserted into a delivered software product. As a result, effective risk management is essential for establishing and maintaining software supply-chain assurance over time. The Software Engineering Institute (SEI) is developing a systemic approach for assessing and managing software supply-chain risks. This paper highlights the basic approach being implemented by SEI researchers and provides a summary of the status of this work.

Managing Information Security Risks across the Enterprise

There are many ways to approach information security. This chapter looks at information security from a risk management point of view by focusing on the evaluation of information security risks. The evaluation looks at information-related assets that are critical to the success and survivability of an enterprise. By looking at these critical assets, determining how they are at risk, and developing mitigation plans and protection strategies, the enterprise can take a strategic approach to securing vital information. Taking a broad look at all types of threats, enterprises can spend their limited resources wisely, without falling down the rat hole of a technology-centric solution.