Logo of the European Computer Security Incident Response Team Network (eCSIRT.net)

WP4 Public Statistics

     
eCSIRT.net > Service > Documents > WP4 Statistics  

WP4: Clearinghouse Function - public statistics - Type 1 - 09/2003 -

Last update: Tue Dec 30 13:34:12 2003

On this page the eCSIRT.net type 1 statistics are shown. These data provide (meta) information about the workload and resources spent by the teams. Related to a single team an average value was calculated for each category of information from the collected data.

Please take into account that the basis for the data collection has changed. During an internal review of WP4 it was generally felt that some of the data fields did not refer well enough to the data collected by most of the teams. Therefore a redefinition of some fields was carried out.

Requests

The following chart shows the development of the average number of non-automated requests recieved by a team. These requests include as well all non-incident handling requests but no automatically generated messages (i.e. IDS) however.

Top

Requests and incidents

In this chart the average values for incoming requests and captured incidents (value from type 2 statistics) are compared.

Top

Incidents and opened incidents

The following chart shows the relation between the average number of captured incidents (value from type 2 statistics) and opened incidents. An opened incident announces activities which are carried out in reaction to an incident (also known as Incident Response).

Top

Opened and closed incidents

This chart shows the relation between opened and closed incidents per team in the respective month. According to the definition of an opened incident the completion of the activities is announced by a closed incident.

Top

Organizations involved

In this chart shows the average number of organizations per team which were involved in an opened incident. Each involved organization is counted for every incident once.

Top

Inbound and outbound communication

The following chart shows the relation between the average amount of inbound and outbound communication. Inbound communication contains all reports recieved by a team which constitute part of an opened incident. All reports sent by a team which constitute part of an opened incident are understood under outbound communication.

Top

Complexity of incidents

To determine an indicator for the average complexity of the incidents in the respective time period, the values for "outbound communication" is divided by "opened incidents". Of course this value can be understood only as a rough approximation. For a scientific assessment further factors must be consulted to become an accurate rating, also a more exact evaluation of single incidents will be necessary. However, the emerge of the outbound communication in reference to the open incidents should be sufficient for a trend.

Top

eCSIRT.net > Service > Documents > WP4 Statistics  
     
eCSIRT.net eCSIRT.net
The European Computer Security Incident Response Team Network
News | Sitemap | Imprint | Privacy Statement | Contact | Top
Last changed: 2003-12-23 / AUTO
Copyright © 2002-2003 by PRESECURE Consulting GmbH, Germany
eCSIRT.net