Incident Response and Early Warning Initiatives in Brazil
|
|
|
- Adam Bell
- 6 years ago
- Views:
Transcription
1 Incident Response and Early Warning Initiatives in Brazil Marcelo H. P. C. Chaves Computer Emergency Response Team Brazil CERT.br Brazilian Internet Steering Committee Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.1/35
2 Overview CERT.br The CERT.br Sponsor Mission, constituency and services Initiatives Early Warning Motivation The honeypots network public and private statistics and use in incident response Advantages, disadvantages and future work Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.2/35
3 CGI.br / CERT.br Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.3/35
4 CGI.br The CERT.br Sponsor The Brazilian Internet Steering Committee (CGI.br) created by the Interministerial Ordinance Nº 147, of May 31st 1995 altered by the Presidential Decree Nº 4,829, of September 3rd 2003 It is a multistakeholder organization composed of: sector Federal Government Corporate sector representatives number Ministries of Science and Technology, Communications, Defense, Industry, etc, 9 and Telcos Regulatory Agency (ANATEL) Industry, Telcos, ISPs, users 4 NGO s Sci. and Tech. Community Non profit organizations, etc Academia Internet expert Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.4/35
5 CGI.br The CERT.br Sponsor (cont.) Brazilian Internet Steering Committe s main attributions: to propose policies and procedures related to the regulation of Internet activities; to recommend standards for technical and operational procedures for the Internet in Brazil; to establish strategic directives related to the use and development of Internet in Brazil; to promote studies and technical standards for the network and services security in the country; to coordinate the allocation of Internet addresses (IPs) and the registration of domain names using <.br>; to collect, organize and disseminate information on Internet services, including indicators and statistics. Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.5/35
6 CGI.br The CERT.br Sponsor (cont.) Brazilian Internet Steering Committee Network Information Center Computer Emergency Response Team Brazil Domain Registration Internet Exchange Points Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.6/35
7 CERT.br Mission: An organization that is responsible for receiving, reviewing, and responding to computer security incident reports and activity related to networks connected to the Brazilian Internet. Constituency: Brazil - Internet.br domain and IP addresses assigned to Brazil. Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.7/35
8 CERT.br (cont.) Services: provide a focal point for reporting incidents related to Brazilian networks; provide coordinated support in incident response; establish collaborative relationships (law enforcement, service providers, telephone companies, financial sector, etc); increase security awareness and help new CSIRTs to establish their activities; CERT.br is a member of FIRST Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.8/35
9 CERT.br Initiatives Produce technical documents in Portuguese Maintain statistics (incidents and spam) Anti-Phishing Working Group Research Partner detect malware enabled fraud notify hosting sites send samples to 20+ AV vendors Honeypots and Honeynets research Honeynet Research Alliance Member Brazilian Honeypots Alliance - Distributed Honeypots Project Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.9/35
10 CERT.br Initiatives (cont.) CSIRT Development: Training: SEI Partner for 4 CERT /CC courses * Creating a Computer Security Incident Response Team * Managing Computer Security Incident Response Teams * Fundamentals of Incident Handling * Advanced Incident Handling for Technical Staff 140+ people trained Help new teams creation Maintain a list of Brazilian CSIRTs Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.10/35
11 Brazilian CSIRTs Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.11/35
12 CGI.br Initiatives sponsors 2 meetings/conferences free of charge per year, to the security and network communities (GTS/GTER) inoc-dba BR project to stimulate Brazilian networks to join the inoc-dba global network 100 IP phones were provided to ASNs 20 IP phones were provided to CSIRTs recognized by CERT.br inoc-dba global hotline phone system which directly interconnects the Network Operations Centers and Security Incident Response Teams Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.12/35
13 CGI.br Initiatives (cont.) Task Force on Spam (CT-Spam) to propose a national strategy to fight spam to articulate the actions among the different actors documents created Technologies and Policies to Fight Spam technical analysis of international antispam laws and brazilian proposals of new laws Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.13/35
14 Early Warning Initiative Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.14/35
15 Motivation Have a national early warning capability with the following characteristics: Widely distributed across the country in several ASNs and geographical locations Based on voluntary work of research partners High level of privacy for the members Useful for Incident Response Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.15/35
16 The Honeypots Network Brazilian Honeypots Alliance Distributed Honeypots Project Coordination: CERT.br Computer Emergency Response Team Brazil Brazilian Internet Steering Committee CenPRA Research Center Ministry of Science and Technology Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.16/35
17 The Honeypots Network (cont.) Technical requirements: secure configuration follow the project s standards (OS, configurations, updates, etc) no data pollution Privacy concerns (in a NDA): don t disclose IP/network information don t collect production network traffic don t exchange any information in clear text Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.17/35
18 The Honeypots Network (cont.) The architecture: low interaction honeypots OpenBSD + Honeyd using a netblock range emulating services (HTTP, SMTP, malwares backdoors, etc) a central server collects logs and uploaded malware performs a status check in all honeypots Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.18/35
19 The Honeypots Network (cont.) 31 research partner s institutions: Academia, Government, Industry, Military and Telcos networks They provide: hardware and network blocks (usually a /24) maintenance of their own honeypots Use the data for intrusion detection purposes less false positives than traditional IDSs Several have more than one honeypot Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.19/35
20 The Honeypots Network (cont.) # City Institutions 01 São José dos Campos INPE, ITA 02 Rio de Janeiro CBPF, Fiocruz, IME, PUC-RIO, RedeRio, UFRJ 03 São Paulo ANSP, CERT.br, Diveo, Durand, UNESP, USP 04 Campinas CenPRA, ITAL, HP Brazil, UNICAMP, UNICAMP FEEC 05 São José do Rio Preto UNESP 06 Piracicaba USP 07 Brasília Brasil Telecom, Ministry of Justice, TCU, UNB LabRedes 08 Natal UFRN 09 Petrópolis LNCC 10 Porto Alegre CERT-RS 11 Ribeirão Preto USP 12 São Carlos USP 13 Taubaté UNITAU 14 Florianópolis UFSC DAS 15 Americana VIVAX 16 Manaus VIVAX 17 Joinville UDESC 18 Lins FPTE 19 Uberlândia CTBC Telecom Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.20/35
21 The Honeypots Network (cont.) As of October, 2005 Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.21/35
22 Early Warning Private Statistics summaries including: specific information for each honeypot most active IPs, OSs, ports, protocols and Country Codes correlated activities (ports and IPs) Public Statistics: combined daily flows seen in the honeypots most active OSs, TCP/UDP ports and Country Codes (CC) * the top ports, OSs and CCs are calculated every day Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.22/35
23 Early Warning (cont.) Usefulness: observation of trends detect scans for potential new vulnerabilities partner institutions are detecting promptly: outbreaks of new worms/bots compromised servers network configuration errors collect new signatures and new malware Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.23/35
24 Public Statistics Generation convert the raw network data into flow data compute the amount of bytes/packets received by each port (or OS or CC) select the top 10 to plot the remaining will be displayed as others use RRDtool and ORCA to generate the flows graphics stack area graphics logarithmic scale Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.24/35
25 Public Statistics Generation (cont.) make pflog2flows.pl pflog files fprobe network flows flow capture flow files flow files flow print ascii flow files cidrgrep ascii flow files (filtered) ascii flow files (filtered) flow2ports.pl flow2cc.pl flow2srcos.pl TOP 10 tcp, TOP 10 udp, TOP 10 cc, TOP 10 srcos files Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.25/35
26 Public Statistics Generation (cont.) TOP 10 tcp TOP 10 udp TOP 10 cc TOP 10 srcos make honeyd stats.pl for each TOP 10 <type> file make orca stats.pl for each 4 hour data run ORCA feed RRDTool database PNG file PNG file store image for 4 hour period store daily image HTML files HTML file create HTML files store TOP 10 <type> files store daily file Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.26/35
27 Public Statistics Top UDP Ports September 17, 2005 Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.27/35
28 Public Statistics Top TCP Ports September 21, 2005 Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.28/35
29 Public Statistics Top Country Codes September 21, 2005 Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.29/35
30 Public Statistics Top Source OS September 13, 2005 Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.30/35
31 Incident Response Identify signatures of well known malicious/abusive activities worms, bots, scans, spam and other malware Notify the responsible networks of the Brazilian IPs with recovery tips Donate sanitized data of non-brazilian IPs to other CSIRTs (e.g. Team Cymru) Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.31/35
32 Architecture advantages Few false positives Ability to collect malware samples specific listeners: mydoom, kuang, subseven, etc. Ability to implement spam traps Permits the members expertise s improvement in several areas: honeypots, intrusion detection, PGP, firewalls, OS hardening Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.32/35
33 Architecture disadvantages It s more difficult to maintain Usually don t catch attacks targeted to production networks Need the partners cooperation to maintain and update the honeypots Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.33/35
34 Future Work Continuously expand the network 4 new partners in installation phase 17 partner candidates Have more frequent private summaries Provide monthy, weekly, and hourly public statistics Increase data donation to trusted parties Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.34/35
35 Related Links This presentation Computer Emergency Response Team Brazil CERT.br Brazilian Internet Steering Comittee CGI.br Brazilian Honeypots Alliance Distributed Honeypots Project Brazilian Honeypots Alliance Statistics The Honeynet Research Alliance Conferencia Internacional sobre Seguridad Informática Buenos Aires October/2005 p.35/35
Incident Response Initiatives in Brazil
Incident Response Initiatives in Brazil Klaus Steding-Jessen jessen@cert.br Computer Emergency Response Team Brazil CERT.br http://www.cert.br/ Brazilian Internet Steering Committee http://www.cgi.br/
Distributed Honeypot Deployment in Brazil
Distributed Honeypot Deployment in Brazil Klaus Steding-Jessen CERT.br - http://www.cert.br/ Honeynet.BR - http://www.honeynet.org.br/ Brazilian Honeypots Alliance - http://www.honeypots-alliance.org.br/
SpamPots Project: Using Honeypots to Measure the Abuse of End-User Machines to Send Spam. Cristine Hoepers General Manager
SpamPots Project: Using Honeypots to Measure the Abuse of End-User Machines to Send Spam Cristine Hoepers General Manager cristine@cert.br CERT.br Computer Emergency Response Team Brazil NIC.br - Network
SpamPots Project: Using Honeypots to Measure the Abuse of End-User Machines to Send Spam
SpamPots Project: Using Honeypots to Measure the Abuse of End-User Machines to Send Spam Klaus Steding-Jessen jessen@cert.br CERT.br Computer Emergency Response Team Brazil NIC.br Network Information Center
Port 25 Management in Brazil: A Multistakeholder Effort to Reduce Direct Delivery from End User Networks
Port 25 Management in Brazil: A Multistakeholder Effort to Reduce Direct Delivery from End User Networks Henrique Faulhaber, Board Member Brazilian Internet Steering Committee CGI.br Dr. Cristine Hoepers,
New Developments in the SpamPots Project
New Developments in the SpamPots Project Klaus Steding-Jessen Cristine Hoepers CERT.br CERT Brazil http://www.cert.br/ NIC.br Brazilian Network Information Center http://www.nic.br/
SpamPots Project: Using Honeypots to Measure the Abuse of End-User Machines to Send Spam. Cristine Hoepers General Manager
SpamPots Project: Using Honeypots to Measure the Abuse of End-User Machines to Send Spam Cristine Hoepers General Manager cristine@cert.br Klaus Steding-Jessen Technical Manager jessen@cert.br CERT.br
Presentation to the ITU on the Q-CERT Incident Management Team. Ian M Dowdeswell Incident Manager, Q-CERT
Presentation to the ITU on the Q-CERT Incident Management Team Ian M Dowdeswell Incident Manager, Q-CERT 2 Q-CERT Mission The Mission of Q-CERT is to be a world-class center of excellence providing expert
National Cyber Security Strategy - Qatar. Michael Lewis, Deputy Director
National Cyber Security Strategy - Qatar Michael Lewis, Deputy Director 2 Coordinating a National Approach to Cybersecurity ITU Pillars of Cybersecurity as a Reference Point providing the collected best
CIRT: Requirements and implementation
CIRT: Requirements and implementation By : Muataz Elsadig Sudan CERT Joint ITU-ATU Workshop on Cyber-security Strategy in African Countries Khartoum, Republic of Sudan, 24 26 July 2016 There is no globally
SouthernLight: New GOLE for Latin America
SouthernLight: New GOLE for Latin America 8th Annual Global LambdaGrid Workshop Seattle, October 2008 Michael Stanton Rede Nacional de Ensino e Pesquisa - RNP michael@rnp.br 2007 RNP Introduction The WHREN-LILA
Croatian National CERT ACDC project Darko Perhoc, Head of National CERT CISSP, CEH, CCNP Security R&S,CCDP
Croatian National CERT ACDC project Darko Perhoc, Head of National CERT CISSP, CEH, CCNP Security R&S,CCDP Croatian National CERT (HR-CERT) mission: Promoting and preserving information security of public
An overview of the CERT/CC and CSIRT Community
An overview of the CERT/CC and CSIRT Community Jason A. Rafail October 2007 2007 Carnegie Mellon University Overview CERT/CC CSIRTs with National Responsibility Partnerships and Trust Training Conclusion
Panama City, Panama May 02th, 2018
Panama City, Panama May 02th, 2018 (PTT.br) to ports and transport sharing LACNIC Forum (FTL) 2018 Julimar Lunguinho Mendes Engineering Team Goals This presentation intend
Global Response Centre (GRC) & CIRT Lite. Regional Cyber security Forum 2009, Hyderabad, India 23 rd to 25 th September 2009
Global Response Centre (GRC) & CIRT Lite Regional Cyber security Forum 2009, Hyderabad, India 23 rd to 25 th September 2009 IMPACT Service offerings Global Response Centre CIRT Lite Need for GRC Access
Bradford J. Willke. 19 September 2007
A Critical Information Infrastructure Protection Approach to Multinational Cyber Security Events Bradford J. Willke 19 September 2007 Overview A framework for national Critical Information Infrastructure
International Internet Connectivity Brazilian Experience
ITU Workshop on Apportionment of Revenues and International Internet Connectivity (Geneva, Switzerland, 23-24 January 2012) International Internet Connectivity Brazilian Experience Salerme Oliveira, Operational
The Case for National CSIRTs
The Case for National CSIRTs ENOG 12 Yerevan 3-4 Oct 2016 What is a CERT (CSIRT)? A Computer Security Incident Response Team (CSIRT) is a service organization that is responsible for receiving, reviewing,
PTTMetro - PTT.br The Brazilian Metropolitan IXP Project
PTTMetro - PTT.br The Brazilian Metropolitan IXP Project http://ptt.br/ 5o PTT Fórum 30 Nov 2011 Eduardo Ascenço Reis PTT.br Engineering Team 5o PTT Forum 30 Nov 2011 PTTMetro/PTT.br
Implementing a National Strategy : the case of the Tunisian CERT
Implementing a National Strategy : the case of the Tunisian CERT Belhassen ZOUARI, CEO, National Agency for Computer Security, Head of Cert-Tcc, E-mail : B.Zouari@ansi.tn a fast Historical Overview end
Centre for cybersecurity Belgium : Role, Missions et future capacities
Centre for cybersecurity Belgium : Role, Missions et future capacities NLO meeting 30/01/2018 Phédra Clouner Deputy Director CCB 01 CCB mission & services Page 2 Legal Basis R.D. 10/10/2014 Contribute
RFC2350 TLP1: WHITE. Έκδοση National CSIRT-CY RFC2350
Έκδοση 1.2-2018.02.14 TLP1: WHITE 1 TLP Sources may use TLP: WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release.
Cyber Security Experts Association of Nigeria (CSEAN) CYBER SECURE NIGERIA 2016 Conference
Cyber Security Experts Association of Nigeria (CSEAN) CYBER SECURE NIGERIA 2016 Conference Threat of Cyber- Terrorism to Critical Infrastructures Presented by Iyke Ezeugo Cyber-warfare Strategist Definitions
ThaiCERT Incident Response & Phishing cases in Thailand. By Kitisak Jirawannakool Thai Computer Emergency Response team (ThaiCERT)
ThaiCERT Incident Response & Phishing cases in Thailand By Kitisak Jirawannakool Thai Computer Emergency Response team (ThaiCERT) Agenda About ThaiCERT ThaiCERT IR Phishing in Thailand About ThaiCERT Ministry
Panel 1 National CSIRT Experience
Panel 1 National CSIRT Experience 2 nd Meeting of Government Cybersecurity Practitioners Sao Paulo, Brazil September 14-16, 2005 Andrew McAllister Senior Advisor, Cyber Security Public Safety and Emergency
Stakeholders Analysis
Stakeholders Analysis Introduction National Stakeholders ISP citizens CNIIP Media National CIRT Academia ONG, Public And Private Institutions sectoral CSIRTs Law enforcement 2 2 CIRT ISP A specialized
GÉANT. Michael Stanton - CLEI
GÉANT First network of the Bandwidth Age 20-fold increase in capacity over TEN-155 for the same cost Principal connections are 10 and 2.5 Gbps wavelengths Currently the largest capacity operational IP
Best Practices in Public Information Management in Sri Lanka. Presented by Nimal Athukorala D.C. Dissanayake
Best Practices in Public Information Management in Sri Lanka Presented by Nimal Athukorala D.C. Dissanayake Content Objectives Method of Information Management Case Study- GIC Call Center GIC Web Portal
Directive on Security of Network and Information Systems
European Commission - Fact Sheet Directive on Security of Network and Information Systems Brussels, 6 July 2016 Questions and Answers The European Parliament's plenary adopted today the Directive on Security
Special Action Plan on Countermeasures to Cyber-terrorism of Critical Infrastructure (Provisional Translation)
Special Action Plan on Countermeasures to Cyber-terrorism of Critical Infrastructure (Provisional Translation) December 15, 2000 1. Goals of the Special Action Plan The goal of this action plan is to protect
How do you decide what s best for you?
How do you decide what s best for you? Experience Transparency Leadership Commitment Cost reduction Security Trustworthiness Credibility Confidence Reliability Compliance Privacy Expertise Flexibility
Examining Cooperative Strategies through Cyber Exercises
Examining Cooperative Strategies through Cyber Exercises Presented to March Technical Colloquium Forum for Incident Response and Teams (FIRST) Ernest W. Drew, III March 26,2008 Tokyo, Japan Cyber Conflict
Cybersecurity, Cybercrime, Cyberwar, Cyberespionage...
Cybersecurity, Cybercrime, Cyberwar, Cyberespionage... can How the can Internet the Internet community community make the improve situation security better? Dr. Cristine Hoepers cristine@cert.br! Computer
Defining Computer Security Incident Response Teams
Defining Computer Security Incident Response Teams Robin Ruefle January 2007 ABSTRACT: A computer security incident response team (CSIRT) is a concrete organizational entity (i.e., one or more staff) that
ISAO SO Product Outline
Draft Document Request For Comment ISAO SO 2016 v0.2 ISAO Standards Organization Dr. Greg White, Executive Director Rick Lipsey, Deputy Director May 2, 2016 Copyright 2016, ISAO SO (Information Sharing
Regional Workshop on Frameworks for Cybersecurity and CIIP Feb 2008 Doha, Qatar
Regional Workshop on Frameworks for Cybersecurity and CIIP 18 21 Feb 2008 Doha, Qatar A National Cybersecurity Strategy aecert Roadmap Eng. Fatma Bazargan aecert Project Manager Technical Affairs Department
CE Advanced Network Security Honeypots
CE 817 - Advanced Network Security Honeypots Lecture 12 Mehdi Kharrazi Department of Computer Engineering Sharif University of Technology Acknowledgments: Some of the slides are fully or partially obtained
Cybersecurity for ALL
Cybersecurity for ALL An Overview of ITU s Cybersecurity Activities OAS Hemispheric Workshop on the Development of a National Framework for Cyber Security 16 in Rio de Janeiro, Brazil Souheil Marine Head,
The Insider Threat Center: Thwarting the Evil Insider
The Insider Threat Center: Thwarting the Evil Insider The CERT Top 10 List for Winning the Battle Against Insider Threats Randy Trzeciak 14 June 2012 2007-2012 Carnegie Mellon University Notices 2011 Carnegie
IPv6 & Internet Governance Developments. CANTO Nate Davis, Chief Operating Officer
IPv6 & Internet Governance Developments CANTO Nate Davis, Chief Operating Officer 13 August 2014 2 History of the Internet Protocol Internet Protocol version 4 (IPv4) Developed for the original Internet
Building Global CSIRT Capabilities
Building Global CSIRT Capabilities Barbara Laswell, Ph.D. September 2003 CERT Centers Software Engineering Institute Carnegie Mellon Pittsburgh, PA 15213 Sponsored by the U.S. Department of Defense 1 2003
NATIONAL STRATEGY:- MALAYSIAN EXPERIENCE
NATIONAL STRATEGY:- MALAYSIAN EXPERIENCE Devi Annamalai Security, Trust and Governance MCMC 28th August 2007 Hanoi. Vietnam BACKGROUND MCMC is a statutory body established under the Malaysian Communications
Defense-in-Depth Against Malicious Software. Speaker name Title Group Microsoft Corporation
Defense-in-Depth Against Malicious Software Speaker name Title Group Microsoft Corporation Agenda Understanding the Characteristics of Malicious Software Malware Defense-in-Depth Malware Defense for Client
CONTEMPORARY CYBER ATTACK TRENDS AND CHALLENGES DR SHASHWAT RAIZADA
CONTEMPORARY CYBER ATTACK TRENDS AND CHALLENGES DR SHASHWAT RAIZADA RECENT TRENDS IN CYBER ATTACKS Cyber Security Threats From Requests to Ransom Notes Source: www.ripandscam.com Source https://en.wikipedia.org/wiki/wannacry_ransomware_attack
IPS with isensor sees, identifies and blocks more malicious traffic than other IPS solutions
IPS Effectiveness IPS with isensor sees, identifies and blocks more malicious traffic than other IPS solutions An Intrusion Prevention System (IPS) is a critical layer of defense that helps you protect
Malware Research at SMU. Tom Chen SMU
Malware Research at SMU Tom Chen SMU tchen@engr.smu.edu www.engr.smu.edu/~tchen Outline About SMU and Me Virus Research Lab Early Worm Detection Epidemic Modeling New Research Interests TC/BT/11-5-04 SMU
Service Provider View of Cyber Security. July 2017
Service Provider View of Cyber Security July 2017 Quick Stats Caribbean and LatAm: 3 rd largest population of Internet Users You Are Here Visualization from the Opte Project of the various routes through
A Distributed Intrusion Alert System
A Distributed Intrusion Alert System Chih-Yao Lin, Hsiang-Ren Shih, and Yomin Hou Taiwan National Computer Emergency Response Team {chinyao, shr, yominhou}@twncert.org.tw Abstract In this paper, a distributed
The CERT Top 10 List for Winning the Battle Against Insider Threats
The CERT Top 10 List for Winning the Battle Against Insider Threats Dawn Cappelli CERT Insider Threat Center Software Engineering Institute Carnegie Mellon University Session ID: STAR-203 Session Classification:
ENISA & Cybersecurity. Dr. Udo Helmbrecht Executive Director, European Network & Information Security Agency (ENISA) 25 October 2010
ENISA & Cybersecurity Dr. Udo Helmbrecht Executive Director, European Network & Information Security Agency (ENISA) 25 October 2010 Agenda Some Definitions Some Statistics ENISA & Cybersecurity Conclusions
DHS Cybersecurity: Services for State and Local Officials. February 2017
DHS Cybersecurity: Services for State and Local Officials February 2017 Department of Established in March of 2003 and combined 22 different Federal departments and agencies into a unified, integrated
Welcome to the CyberSecure My Business Webinar Series We will begin promptly at 2pm EDT All speakers will be muted until that time
TM Plan. Protect. Respond. Welcome to the CyberSecure My Business Webinar Series We will begin promptly at 2pm EDT All speakers will be muted until that time Registration is open for the April webinar:
RFC 2350 YOROI-CSDC. Expectations for Computer Security Incident Response. Date 2018/03/26. Version 1.0
RFC 2350 YOROI-CSDC Expectations for Computer Security Incident Response Title RFC 2350 YOROI-CSDC Document Type Specification Date 2018/03/26 Version 1.0 Yoroi S.r.l. Parte del gruppo MAM www.yoroi.company
Italian government CERT: INITIAL RESULTS
Italian government CERT: INITIAL RESULTS ISCOM Conference on Network and Information Security: Political and Technical Challenges Gianluigi Moxedano GovCERT.it National Center for Informatics in Public
Privacy Policy. Third Party Links
Privacy Policy This Privacy Policy is provided by POP Tracker LLC, which is referred to within the policy collectively as "POP Tracker", "we", "us" and/or "our". It applies to all POP Tracker-owned websites,
Directive on security of network and information systems (NIS): State of Play
Directive on security of network and information systems (NIS): State of Play Svetlana Schuster Unit H1 Cybersecurity and Digital Privacy DG Communications Networks, Content and Technology, European Commission
Scalability, Fidelity, and Containment in the Potemkin Virtual Honeyfarm
Scalability, Fidelity, and in the Potemkin Virtual Honeyfarm Michael Vrable, Justin Ma, Jay Chen, David Moore, Erik Vandekieft, Alex C. Snoeren, Geoffrey M. Voelker, Stefan Savage Collaborative Center
The tale of one thousand and one ADSL modems
The tale of one thousand and one ADSL modems Fabio Assolini, Malware Researcher, twitter.com/assolini Virus Bulletin 2012 Dallas, USA PAGE 2 If we can t attack a computer or a server, we ll attack a router
National Policy and Guiding Principles
National Policy and Guiding Principles National Policy, Principles, and Organization This section describes the national policy that shapes the National Strategy to Secure Cyberspace and the basic framework
2 nd Cybersecurity Workshop Test and Evaluation to Meet the Advanced Persistent Threat
2 nd Cybersecurity Workshop Test and Evaluation to Meet the Advanced Persistent Threat Faye Francy Aviation ISAC February 2015 Company Organization Corporate Defense, Space & Security Boeing Capital Corporation
Is the Best Defense a Good Offense? Christopher T. Pierson, CIPP/US, CIPP/G James T. Shreve, CIPP/US, CIPP/IT
Is the Best Defense a Good Offense? Christopher T. Pierson, CIPP/US, CIPP/G James T. Shreve, CIPP/US, CIPP/IT Agenda & Disclaimer 1. Scenarios 2. Issues - Status of Cybersecurity and Hacking 3. Capabilities
Cybersecurity Strategy of the Republic of Cyprus
Cybersecurity Strategy of the Republic of Cyprus George Michaelides Commissioner of Electronic Communications and Postal Regulation http://www.ocecpr.org.cy 12 th February 2016 Cybersecurity Strategy of
CENTER FOR SECURITY STUDIES
CENTER FOR SECURITY STUDIES Swiss Federal Institute of Technology (ETH Zurich) A Generic National Framework for Critical Information Infrastructure Protection 2nd WSIS Action Line C5 Meeting ITU Headquarters,
Center for Internet Security Confidence in the Connected World
Center for Internet Security Confidence in the Connected World Northeast Headquarters 31 Tech Valley Dr., East Greenbush, NY 12061 Mid-Atlantic Headquarters 1700 North Moore St., Suite 2100, Arlington,
Statement for the Record
Statement for the Record of Seán P. McGurk Director, Control Systems Security Program National Cyber Security Division National Protection and Programs Directorate Department of Homeland Security Before
Panelists. Moderator: Dr. John H. Saunders, MITRE Corporation
SCADA/IOT Panel This panel will focus on innovative & emerging solutions and remaining challenges in the cybersecurity of industrial control systems ICS/SCADA. Representatives from government and infrastructure
The rise of major Adversaries is the most relevant trend in 2014, targeting Government and Critical Services
The rise of major Adversaries is the most relevant trend in 2014, targeting Government and Critical Services Major Trends of 2014 And relevant changes in Threat Scenario Most Target Countries and Sectors
About Issues in Building the National Strategy for Cybersecurity in Vietnam
Vietnam Computer Emergency Response Team - VNCERT About Issues in Building the National Strategy for Cybersecurity in Vietnam Vu Quoc Khanh Director General Outline Internet abundance Security situation
IBM Global Technology Services Provide around-the-clock expertise and protect against Internet threats.
IBM Global Technology Services Provide around-the-clock expertise and protect against Internet threats. Enhancing cost to serve and pricing maturity Keeping up with quickly evolving ` Internet threats
2nd ENISA Workshop German CERT-Activities. 5 th October, 2006 Brussels
2nd ENISA Workshop German CERT-Activities 5 th October, 2006 Brussels Overview Hosting Organisation CERT-Bund Background Projects CERT Services German CERT Activities International Cooperation Lessons
NetDefend Firewall UTM Services
NetDefend Firewall UTM Services Unified Threat Management D-Link NetDefend UTM firewalls (DFL-260/860/1660/2560/2560G) integrate an Intrusion Prevention System (IPS), gateway AntiVirus (AV), and Web Content
CSIRT in general CSIRT Service Categories Reactive Services Proactive services Security Quality Management Services CSIRT. Brmlab, hackerspace Prague
Brmlab, hackerspace Prague Lightning talks, November 2016 in general in general WTF is an? in general WTF is an? Computer Security in general WTF is an? Computer Security Incident Response in general WTF
Cybersecurity and Vulnerability Assessment
Cybersecurity and Vulnerability Assessment Wayne Zeuch Vice Chair: Working Group on Deployment of Technologies and Services ITU /CITEL Regional Cybersecurity Workshop for the Americas Salta, Argentina
.rio Registration Policies 2016 Dec 16
.rio Registration Policies 2016 Dec 16 Empresa Municipal de Informática SA [IPLANRIO], the registry for.rio domains, requires all registrants to abide by the policies detailed below or any successor policy
IMPACT Global Response Centre. Technical Note GLOBAL RESPONSE CENTRE
Technical Note GLOBAL RESPONSE CENTRE INTRODUCTION IMPACT s Global Response (GRC) acts as the foremost cyber threat resource centre for the global. It provides emergency response to facilitate identification
Security Audit What Why
What A systematic, measurable technical assessment of how the organization's security policy is employed at a specific site Physical configuration, environment, software, information handling processes,
How Boards use the NIST Cybersecurity Framework as a Roadmap to oversee cybersecurity
How Boards use the NIST Cybersecurity Framework as a Roadmap to oversee cybersecurity Why is the NIST framework important? GOH Seow Hiong Executive Director, Global Policy & Government Affairs, Asia Pacific
Vulnerabilities. To know your Enemy, you must become your Enemy. Information security: Vulnerabilities & attacks threats. difficult.
Vulnerabilities To know your Enemy, you must become your Enemy. "The Art of War", Sun Tzu André Zúquete Security 1 Information security: Vulnerabilities & attacks threats Discouragement measures difficult
The Gartner Security Information and Event Management Magic Quadrant 2010: Dealing with Targeted Attacks
The Gartner Security Information and Event Management Magic Quadrant 2010: Dealing with Targeted Attacks Mark Nicolett Notes accompany this presentation. Please select Notes Page view. These materials
Provisional Translation
Provisional Translation Environmental Change Vision to aim as a Goal Merger and Integration of Cyberspace and Real-space [expansion/penetration, progress of the use/application, global] Increasing Serious
Featured Articles II Security Research and Development Research and Development of Advanced Security Technology
364 Hitachi Review Vol. 65 (2016), No. 8 Featured Articles II Security Research and Development Research and Development of Advanced Security Technology Tadashi Kaji, Ph.D. OVERVIEW: The damage done by
Package of initiatives on Cybersecurity
Package of initiatives on Cybersecurity Presentation to Members of the IMCO Committee Claire Bury Deputy Director-General, DG CONNECT Brussels, 12 October 2017 Building EU Resilience to cyber attacks Creating
The latest version of this profile can be found on the location specified in 1.3
FORTHcert Profile according to RFC 2350 1. About this document 1.1 Date of Last Update This is version 1, published 2012/02/1. 1.2 Distribution List for Notifications The latest version of this profile
Avoiding Information Overload: Automated Data Processing with n6
Avoiding Information Overload: Automated Data Processing with n6 Paweł Pawliński pawel.pawlinski@cert.pl 26th annual FIRST conference Boston, June 23rd 2014 Who we are part of national CERT for Poland
MELANI: Information exchange a story of success
Federal Strategy Unit for Information Technology FSUIT Federal Intelligence Service Reporting and Analysis Centre for Information Assurance MELANI MELANI: Information exchange a story of success Max Klaus,
Fundamentals of Information Systems Security Lesson 8 Mitigation of Risk and Threats to Networks from Attacks and Malicious Code
Fundamentals of Information Systems Security Lesson 8 Mitigation of Risk and Threats to Networks from Attacks and Malicious Code Learning Objective Explain the importance of network principles and architecture
Resolution adopted by the General Assembly on 21 December [on the report of the Second Committee (A/64/422/Add.3)]
![Resolution adopted by the General Assembly on 21 December [on the report of the Second Committee (A/64/422/Add.3)]](/thumbs/81/84531605.jpg "Resolution adopted by the General Assembly on 21 December [on the report of the Second Committee (A/64/422/Add.3)]")
United Nations A/RES/64/211 General Assembly Distr.: General 17 March 2010 Sixty-fourth session Agenda item 55 (c) Resolution adopted by the General Assembly on 21 December 2009 [on the report of the Second
Security+ SY0-501 Study Guide Table of Contents
Security+ SY0-501 Study Guide Table of Contents Course Introduction Table of Contents About This Course About CompTIA Certifications Module 1 / Threats, Attacks, and Vulnerabilities Module 1 / Unit 1 Indicators
Global Alliance Against Child Sexual Abuse Online 2014 Reporting Form
Global Alliance Against Child Sexual Abuse Online 2014 Reporting Form MONTENEGRO Policy Target No. 1 Enhancing efforts to identify victims and ensuring that they receive the necessary assistance, support
Overview. Objectives. Components. Information and Communication Technologies Sector Development Project. Project
Ministry of Communication Technologies Information and Communication Technologies Sector Development Project Video conference on from strategy to implementation: Lessons learned in World Bank funded ICT
How NSFOCUS Protected the G20 Summit. Guy Rosefelt on the Strategy, Staff and Tools Needed to Ensure Cybersecurity
How NSFOCUS Protected the G20 Summit Guy Rosefelt on the Strategy, Staff and Tools Needed to Ensure Cybersecurity SPONSORED BY Rosefelt is responsible for developing NSFOCUS threat intelligence and web
Emergency Support Function #2 Communications Annex INTRODUCTION. Purpose. Scope. ESF Coordinator: Support Agencies: Primary Agencies:
ESF Coordinator: Homeland Security/National Protection and Programs/Cybersecurity and Communications Primary Agencies: Homeland Security/National Protection and Programs/Cybersecurity and Communications
Question 1: What steps can organizations take to prevent incidents of cybercrime? Answer 1:
Cybercrime Question 1: What steps can organizations take to prevent incidents of cybercrime? Answer 1: Organizations can prevent cybercrime from occurring through the proper use of personnel, resources,
Phishing Activity Trends Report March, 2005
Phishing Activity Trends Report March, 2005 Phishing is a form of online identity theft that uses spoofed emails designed to lure recipients to fraudulent websites which attempt to trick them into divulging
Swedish IT Incident Centre
Swedish IT Incident Centre Establishing a Government CERT from scratch the Swedish experience Establishment phase 2003 2004 CERTs in Europe Lessons Learned and Good Practices, Brussels 2005-12-13 Presentation
May the (IBM) X-Force Be With You
Ann Arbor, Michigan July 23-25 May the (IBM) X-Force Be With You A QUICK PEEK INTO ONE OF THE MOST RENOWNED SECURITY TEAMS IN THE WORLD Marlon Machado Worldwide Standardization Leader, Application Security
OAS Cybersecurity Capacity Building Efforts
OAS Cybersecurity Capacity Building Efforts Are We Ready in Latin America and the Caribbean? 2016 Cybersecurity Report www.cybersecurityobservatory.com The opinions expressed in this publication are of
locuz.com SOC Services
locuz.com SOC Services 1 Locuz IT Security Lifecycle services combine people, processes and technologies to provide secure access to business applications, over any network and from any device. Our security
Cyber Security Technologies
1 / Cyber Security Technologies International Seminar on Cyber Security: An Action to Establish the National Cyber Security Center Lisbon, 12 th September 2013 23 / Key highlights - Thales Group Thales
Firewall Identification: Banner Grabbing
Honey POt Firewall Identification: Banner Grabbing Banners are messages sent out by network services during the connection to the service. Banners announce which service is running on the system. Banner