51 Match each item with a statement below. b. A CSIRT staffing model where an organization performs all its IR work f. A CSIRT staffing model used when an organization does not have enough qualified employees e. Equipment needed to detect and manage incidents h. An incident response philosophy that focuses on the defense of data and systems a. An incident response philosophy that focuses on the identification and apprehension of the intruder d. Examples of this are monitoring security-related mailing lists and researching new rootkits that are publicly available g. Measurement used for comparison of past security measures and current CSIRT efforts i. Should be included in the announcement of an operational CSIRT c. A critical nontechnical skill for CSIRT members a. apprehend and prosecute b. employees c. teamwork d. technology watch e. packet sniffer f. fully outsourced g. response time h. protect and forget i. operating hours