Improving Cybersecurity Incident Response Team Effectiveness Using Teams-Based Research

The effective functioning of cybersecurity incident response teams (CSIRTs) is critical for the protection of digital information used by individuals and organizations around the world. However, because CSIRTs are a relatively new type of team, what is known about improving their effectiveness isn't as fully developed as it is for other teams with a richer research history. To improve the development and performance of CSIRTs, the authors point out important areas that can help CSIRTs function effectively as a team. Specifically, they focus on team adaptation, communication, problem solving, trust, and development of shared knowledge among team members.