Proposal for a new model for information sharing between CSIRTs Ir. - - PowerPoint PPT Presentation

▶
proposal for a new model for information sharing between
SMART_READER_LITE
LIVE PREVIEW

Proposal for a new model for information sharing between CSIRTs Ir. - - PowerPoint PPT Presentation

Sep 13, 2022 14 likes •404 views

Proposal for a new model for information sharing between CSIRTs Ir. David Durvaux - Security Analyst Christian Van Heurck Coordinator 24 th annual FIRST conference Malta - 17-22 June 2012 Knowledge is power . Knowledge shared is

slide-1
SLIDE 1

Proposal for a new model for information sharing between CSIRTs

  • Ir. David Durvaux - Security Analyst
24th annual FIRST conference – Malta - 17-22 June 2012

Christian Van Heurck – Coordinator

slide-2
SLIDE 2 24th annual FIRST conference Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 2

“ Knowledge is power . Knowledge shared is power multiplied.”

Robert Noyce

slide-3
SLIDE 3 24th annual FIRST conference

About CERT.be and us

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 3

CERT.be

The federal cyber emergency team

a service of Fedict

  • perated by Belnet
slide-4
SLIDE 4 24th annual FIRST conference

Agenda 1 Current situation 2 Proposal for a new model for sharing 3 New issues 4 Sharing time = Q&A

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 4
slide-5
SLIDE 5 24th annual FIRST conference

Propagation time

  • Internet delay: milliseconds
Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 5
slide-6
SLIDE 6 24th annual FIRST conference

Internet

Propagation time: milliseconds

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 6
slide-7
SLIDE 7 24th annual FIRST conference

Internet

Propagation time:

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 7
slide-8
SLIDE 8 24th annual FIRST conference

Internet

Propagation time: back to milliseconds

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 8
slide-9
SLIDE 9 24th annual FIRST conference

Propagation time: back to seconds

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 9

We need to

SHARE

more efficiently!

slide-10
SLIDE 10 24th Annual FIRST conference

1 Current situation

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 10
slide-11
SLIDE 11 24th annual FIRST conference

Information overflow

  • Numerous valuable sources
  • remote
  • local
  • near real-time
  • Processing all the data
  • how: scripting?
  • what to treat?
Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 11
slide-12
SLIDE 12 24th annual FIRST conference

Lack of large-scale overview

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 12
slide-13
SLIDE 13 24th annual FIRST conference

Contact point issues

Whom

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 13
slide-14
SLIDE 14 24th annual FIRST conference

Criminals are organised and DO share

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 14
slide-15
SLIDE 15 24th annual FIRST conference

CSIRTs are like islands

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 15
slide-16
SLIDE 16 24th annual FIRST conference

Legal issues

  • Allowed?
  • What?
  • With whom?
  • How?
Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 16
slide-17
SLIDE 17 24th annual FIRST conference

Political issues

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 17
slide-18
SLIDE 18 24th annual FIRST conference

Technical issues

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 18
slide-19
SLIDE 19 24th Annual FIRST conference

2

Proposal for a new model for sharing

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 19
slide-20
SLIDE 20 24th annual FIRST conference

Connecting our islands efficiently

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 20
slide-21
SLIDE 21 24th annual FIRST conference

Creating archipelagoes

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 21
  • European Union .eu
  • 27 countries

already sharing

  • Why not on

incidents?

slide-22
SLIDE 22 24th annual FIRST conference

Creating archipelagoes

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 22
  • Benelux .be .nl .lu
  • 3 countries sharing

since 1944

  • EU sub archipelago
slide-23
SLIDE 23 24th annual FIRST conference

Creating archipelagoes

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 23
  • Belgium .be
  • CERT.be proxy
  • Febelfin
  • Sectorial CSIRTs
  • ISP’s
  • Law Enforcement
slide-24
SLIDE 24 24th annual FIRST conference

Seeds for archipelagoes

  • Geo-political decisions / history
  • Existing organizations
  • FIRST
  • TF-CSIRT
  • ENISA
  • National / governmental CSIRTs
  • Fighting a common issue
  • DCWG.org
  • Anything that pushes countries to collaborate!
  • Requires TRUST!
Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 24
slide-25
SLIDE 25 24th annual FIRST conference

Decision tree

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 25

Political Support? Don’t Share Filter yes yes yes yes no no no no Event Legal? Need to Know? T

  • Sensitive?

Share

slide-26
SLIDE 26 24th annual FIRST conference

Routing model: top-down

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 26

Archipelago Sub Archipelago Sub Sub Archipelago Concerned Constituent Event

slide-27
SLIDE 27 24th annual FIRST conference

Security is no longer an island!

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 27

Archipelago ABC Island A Island B Island C Island N Archipelago EF Island E Island F Island Z

slide-28
SLIDE 28 24th annual FIRST conference

How can we share?

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 28

Island A Island B Island C Jabber S2S Only Jabber S2S Only Jabber S2S Only events e v e n t s events

slide-29
SLIDE 29 24th annual FIRST conference

What can we share?

  • Events
  • IP’s (src & dst) – Ports – Protocols
  • URL’s
  • Binaries and/or hashes of
  • malware
  • suspicious files
  • Information on domains, IP’s, AS’s
  • wner
  • history (passive DNS)
  • Binary answer to a question (yes/no)
  • have you seen that IP before?
  • Contacts
Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 29
slide-30
SLIDE 30 24th annual FIRST conference

Tools already exist … for years!

  • Phone
  • mail
  • chat
  • FTP
  • scripts
  • AbuseHelper
  • Megatron
  • fordrop
Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 30
slide-31
SLIDE 31 24th annual FIRST conference

AbuseHelper: the collaborative agents

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 31

?

♫ Notification Parser Agent Experts Reporting Storage
slide-32
SLIDE 32 24th annual FIRST conference

Megatron: the central vacuum cleaner

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 32
slide-33
SLIDE 33 24th annual FIRST conference

fordrop: human collaboration

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 33
slide-34
SLIDE 34 24th Annual FIRST conference

3 New issues

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 34
slide-35
SLIDE 35 24th annual FIRST conference

Correlated events: rating & feedback

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 35

Event B Event A Source A Source B

Processing

A Correlated Events Concerned Constituent

slide-36
SLIDE 36 24th Annual FIRST conference

4 Conclusion

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 36
slide-37
SLIDE 37 24th annual FIRST conference

You can share too

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 37

Please

SHARE

and help us do that

EFFICIENTLY

slide-38
SLIDE 38 24th annual FIRST conference

You are in good company

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 38

CERT .is

slide-39
SLIDE 39 24th annual FIRST conference

Sharing time!

Malta, 17-22 June 2012 Proposal for a new model for information sharing between CSIRTs 39

david@cert.be christian@cert.be