IODEF Purpose (historical – 2000-2002) A uniform incident classification enables applications such as: uniform statistic generation and exchange, for both domestic use and exchange of data between teams. Over time a distributed incident statistics infrastructure can evolve trend-analyses for reoccurrence of incidents, victims, attackers, etc. trend-analyses for relations between scans and attacks and thus begin working on pro-active incident response uniform internal incident storage incident handling between teams made easier (only one team needs to classify and analyze the complete incident, the other team can re-use this data) uniform incident reporting by victims to CSIRTs |