An Exploratory Investigation of Factors Affecting Computer Security Incident Response Team Performance

There has been a huge amount of organizational investment to cope with computer security incidents, but the incidents continue and are expected to increase. Computer security incidents in organizations are primarily dealt with by computer security incident response teams (CSIRT). How the team successfully develops and operates is critical for effective and efficient responses to the incidents. However, no studies have been conducted in that context. This study investigates the factors affecting CSIRT performance based on team performance and crisis management literature through conducting a field study using Delphi method and questionnaire survey. The data are analyzed using Hierarchical Linear Modeling (HLM). We expect the study will provide a useful theoretical framework and practical implications to understand CSIRT performance and thus successfully counteract computer security incidents.