ICANNs Identifier Systems Security, Stability and Resiliency Team - - PowerPoint PPT Presentation

icann s identifier systems
SMART_READER_LITE
LIVE PREVIEW

ICANNs Identifier Systems Security, Stability and Resiliency Team - - PowerPoint PPT Presentation

ICANNs Identifier Systems Security, Stability and Resiliency Team ITU Workshop on Child Online Safety Lilongwe: July /20 /2016 bob.ochieng@icann.org What is ICANN? The Internet Corporation for Assigned Names and Numbers (ICANN) is a


slide-1
SLIDE 1

ICANN’s Identifier Systems Security, Stability and Resiliency Team

ITU Workshop on Child Online Safety – Lilongwe: July /20 /2016 bob.ochieng@icann.org

slide-2
SLIDE 2

| 2

What is ICANN?

The Internet Corporation for Assigned Names and Numbers (ICANN) is a global multistakeholder, private sector-led organization that manages Internet resources for the public benefit  ICANN coordinates the top-level of the Internet's system of unique identifiers via global, multistakeholder, bottom-up consensus policy processes, with the outcome of those processes implemented via the IANA Functions.

slide-3
SLIDE 3

| 3

ISSSR Team: Areas of Operation

Threat Awareness and Preparedness

Analytics Trust- based Collaboration Capability Building

slide-4
SLIDE 4

| 4

slide-5
SLIDE 5

| 5

Threat Awareness

ICANN’s ISSSR Team exchanges

  • r acts on threat intelligence or

incidents involving global Internet identifiers to mitigate threats

  • DNS Coordinated

Vulnerability Disclosure

  • Tactical response to attacks
  • Collaborative incident

response

https://www.flickr.com/photos/opacity/

slide-6
SLIDE 6

| 6

Capability Building

The IS SSR Team

  • Provides technical training to ccTLD
  • perators or public safety communities

– Registry operations – DNSSEC – Investigating identifier systems abuse

  • Collaborates on cybersecurity matters

with security communities

– APWG, MAAWG, DNS OARC…

  • Shares cybersecurity subject matter expertise with

legislation or policy makers or government agencies

slide-7
SLIDE 7

| 7

Analytics

ICANN’s ISSSR Team studies identifier system abuse or performance using event or reputation data

  • Security threats e.g., spam,

phishing, C2, malware…

  • Whois accuracy
  • DNS security, stability,

resiliency

slide-8
SLIDE 8

| 8

Trust-based Collaboration

ICANN’s ISSSR team engages with cybersecurity and public safety communities

  • To identify or mitigate

identifier system abuse

  • Share information related to

identifier system misuse Team also acts as a trusted introducer between DNS and information security communities

https://www.flickr.com/photos/slagheap/

slide-9
SLIDE 9

| 9

How Does Trust-based Collaboration Work? Most harm occurs in first hours of attack Motive distinguishes the nature and

  • bjectives of attacks

3

Technology is motive agnostic: criminals, investigators, admins use the same tools

  • Private- and public sector investigators cooperate

24x7 using trusted communications channels

  • Information sharing
  • Malware, phishing, spam samples
  • Host names, URLs, addresses, geo-location
  • Activities of persons of interest (e.g., social media posts)
  • Points of contact (targets, victims, operators, investigators)
  • Coordination or hand off
  • Mitigating DDoS by squelching sources
  • Providing evidence of AUP violation to operator for action
slide-10
SLIDE 10

| 10

Trust is Earned Most harm occurs in first hours of attack Motive distinguishes the nature and

  • bjectives of attacks

3

Technology is motive agnostic: criminals, investigators, admins use the same tools

  • New participants earn nominations from existing

members and are vetted prior to admission

  • Personal references,
  • Prior collaboration and
  • Reputation
  • Individuals put own reputation and membership at

risk when they nominate

  • Strict codes of conduct
  • Self-policing model
slide-11
SLIDE 11

| 11

Is trust-based collaboration effective? Most harm occurs in first hours of attack Motive distinguishes the nature and

  • bjectives of attacks

3

Technology is motive agnostic: criminals, investigators, admins use the same tools

  • Yes. It reduces the attack surface in several ways:
  • Sharing “data feeds” forms the bases for action
  • Sharing malware samples expedites remediation
  • Sharing intelligence improves dossiers on suspected

criminal actors

  • Reduces time from threat identification to

containment or mitigation

  • Gives participating law enforcement agents insights
  • ther than direct complaints
slide-12
SLIDE 12

| 12

Thank you