eCSIRT.net : Public Statistics

The Purpose of Public Statistics

One of the goals of the eCSIRT.net project is to raise the awareness and understanding of the work of CSIRTs in the general public and among the CSIRTs. Therefore, in addition to the exchange of incident related data between CSIRTs, incident statistics will be made available - in a generalized and sanitized way - to the public. These statistics will provide valuable information about incidents handled by the participating teams and about the general hazard level of Internet connected systems.  

Statistics from January to August 2003

The project started with the first set of guidelines describing the needed information to build the desired statistics based on then available documents and earlier schemes for incident categorisation. Data was collected for the first 8 month of 2003.

• Statistics on the CSIRT operation (Type 1) : Jan-Aug 2003
  Meta information about factors describing the CSIRT operations are providing insights not in the incidents but the overall situation.

• Statistics on Incidents (Type 2) : Jan-Aug 2003
  Information on the various incidents handled by the teams are providing insights in the situations of victims and the needs for their support.

Improved Scheme for Statistics from September 2003 onwards

After reviewing the results of the first 8 month of data collected, the guidelines and requested data set was changed to facilitate the lessons learned.

Changes were mainly necessary, as the data acquisition of the teams deviated too strongly from the given categories. The interpretation clearance was too large. This applies in particular to the type 1 statistics on CSIRT operation.

• Statistics on the CSIRT operation (Type 1) : from Sep 2003 onwards

• Statistics on Incidents (Type 2) : from Sep 2003 onwards

• Harmonized Statistics on Incidents (Type 2) : from Jan 2003 onwards
  In an effort to correlate the data available for the first 8 month of 2003 these statistics were created.

Distributed IDS Sensor Network

In addition to the statistics gathered by the teams about their incident related operation and the incident handled, it was envisioned to acquire data about the status on Internet attacks automatically. As incidents are handled by human beings, the information about incidents is assessed and verified - and therefore usually more reliable. In addition it is a well accepted definition that an incident might consist of one or multiple attacks. It was expected that any automatic process collecting data about attacks would provide a very different viewpoint - and if combined with the information about CSIRT operations gathered from the teams - could provide new insights.

• Public Analysis of the distributed IDS Sensor Network

eCSIRT.net The European Computer Security Incident Response Team Network News | Sitemap | Imprint | Privacy Statement | Contact | Top Last changed: December 19, 2003 / OG Copyright © 2002-2003 by PRESECURE Consulting GmbH, Germany

Signed with PGP!