It thus came as a major shock when, on November 2^nd, Robert Tappan Morris, then a student at Cornell University, launched the world's first self-replicating computer worm via the internet. 

Known as the "Morris Worm" the malicious code crippled 6,000 computers, or almost 10% of the computers that were then connected to the internet.  The incident was resolved five days later, but required international collaboration to resolve and resulted in massive duplication of effort and wasted resources. 

Out of the chaos caused by the Morris Worm, the Computer Emergency Response Team /Coordination Center, or CERT/CC, was formed. 

Organized as a non-profit, federally-funded research and development center, CERT/CC became the driving force behind CSIRTs.

Nowadays, cybersecurity threats can emanate from almost anywhere, requiring organizations to devote significant resources to hardening and continually evaluating their security. 

No matter what the investment or the range of security measures that are in place, all organizations must acknowledge that they have some level of vulnerability to attack, and must stand ready to deal with security incidents.

That's where the CSIRT comes in.

The CSIRT and its role

Put simply, a CSIRT is a team that's assigned the responsibility for coordinating and supporting the response to a computer security event or incident. CSIRTs can be created for almost any entity, such as nation-states, governmental entities, businesses, power grids, educational institutions and non-profit organizations.

Depending on the entity that a CSIRT serves, their mission, structure and specific responsibilities may vary, but all CSIRTs endeavor to do these things:

• Minimize and control the damage from computer security incidents

• Provide guidance for recovery activities

• Work to prevent incidents from happening in the future

Every CSIRT should have a well-defined plan of action, should an incident occur. The goal of a CSIRT plan is to maintain mission-critical services and to protect assets and data in the event of a cyberattack or other malicious activity. 

According to CERT, a successful CSIRT plan should include processes for these task:

• Notification and communication

• Analysis, response and resolution

• Collaboration and coordination

• Maintenance and tracking of records

• Evaluation and quality assurance

Your CSIRT should consist of individuals who are highly familiar with your information security infrastructure, network, core business functions and business partners. 

Should the need arise, your CSIRT team should be the best-qualified to detect, respond and resolve security incidents, while keeping all parties involved and informed.

The CSIRT and our defined contribution plan system

Much like the early internet, America's defined contribution system is a decentralized, interconnected web that includes these players:

• Plan sponsors

• Recordkeepers

• Third-party administrators

• Asset managers

• Other parties

Sensitive, protected information resides within each entity and often moves between them, representing a tempting target for bad actors. Therefore, it's important that every organization in this chain – small, medium or large – establish a CSIRT. 

It's also critical that there be a robust level of coordination established between retirement industry CSIRTs, in the event a widespread incident occurs with the potential to affect multiple entities within the defined contribution system. 

Effective communication amongst retirement industry CSIRTS could become a crucial advantage should large elements of the system be attacked.

While this level of widespread collaboration does not presently exist, there are signs that it's coming. 

Recently, the Department of Labor's ERISA Advisory Council and other industry organizations such as SPARK, have begun to examine cybersecurity issues and to establish cybersecurity standards for recordkeepers.  

We believe that this effort should ultimately be extended to include computer security incident response teams, or CSIRTs. 

Let's hope that our defined contribution system never has to experience its own version of the Morris Worm.

Mike Goode is Retirement Clearinghouse's Chief Information Officer and oversees a staff of IT professionals who build, support and secure applications and technology infrastructure.