CSIRT capability building and enhancement [Mark]

CSIRT capability building andenhancementCNCERT/CC ’05 Conference March 2005 –Guilin. Mark McPhersonAusCERTThe University of QueenslandBrisbane, Queensland 4072AUSTRALIAOverview •What is a CSIRT?•Building Capability •Enhancing CapabilityWhat is a CSIRT? (1)•Definition•Types and examplesWhat is a CSIRT? (2)An Incident Response Team (IRT) concerned with Computer Security.+But, how do IRTs respond?•IR is the act of doing something when a computer security incident occurs•IR can be an ad-hoc activityOR•Can take-place according to a predefined ‘IR plan’•Predefined IR plans:–usually nominate an Incident Response Team (IRT)•An IRT:–has predefined roles and responsibilities–acts when an incident occurs or when a precondition is met•eg The CEO’s PC is attacked..IRT -Types and examples •An Incident Response Team (IRT) can be:–An Incident-handling team (aka CSIRT)–On-site hands-on intervention team(eg Corporate or University IRT)–A ‘First Responder’team(eg Law Enforcement -electronic Evidence Team [EET])CSIRTs -types and examples (1)•An Incident Response Team (IRT) can be:–An Incident-handling team (aka CSIRT) What AusCERT does•ie Receives reports, provides advice, acts as aliaison between involved parties, disseminatesinformationCSIRTs -types and examples (2)–On-site hands-on intervention team (eg Corporate or University IRT)•An emergency team who physically respond toconfirmed or probable incidents•Take a hands-on approach to mitigationCSIRTs -types and examples (3)–A ‘First Responder’team•Forensic analysis teams (some Corporate IRTs dothis…)•Legal analysis by law enforcementeg Electronic Evidence Team (EET)Building CSIRT capability (1)•Establish the mandate or mission•Determine constituents/clients•Define services and scope•Determine staff and other resources required •Consider available financial models•Study existing models/CSIRTs•Build a libraryBuilding CSIRT capability (2)•Attend conferences and training–Existing staff•Hire expertise–Hire experienced staff or Train new staff•Run in trial mode•Liaise with other CSIRTs–To ascertain performance•Get client feedbackEnhancing capability Two example areas for enhancement:•Capabilities of the CSIRT •Capabilities of the IR team membersEnhancing capabilities of theCSIRT•Adding value through enhanced member services–Improvement of existing services–Creation of new servicesEnhancing capabilities of the IRteam members•Honing your teams skills using ‘fire drills’–Role-playing–Live DrillsEnhancing capabilities of the IR teammembersOther ideas…•Build a testing lab–Basic research etc..•Take-on technical projects–Work with other security organisations/agencies •Eg Industry groups, Universities, PoliceEnhanced member services Determining the work required…•Analysis of member satisfaction–Surveys–Feedback forums –meetings, BOFs–Membership churn•Face-to-face member forums•Conferences•Industry groups and initiativesEnhancing member services Improving existing services…Examples:•Member profiled information–Advisories/bulletins–Environment and OS-specific information–FAQs/ Best Practice guides•Automated incident response–Info-only or Member-driven reporting•Extended Incident Response–On-site or personalised servicesEnhanced member services Creating new services…–Interactive services•Member-only web-access•Discussion groups/forums/mailing lists –Monitoring/facilities management•Networks (eg DoS)•Websites (eg defacements)–Early-warning services•eg SMS‘Fire drill’–role-playing (1) Purpose:–Tests a team’s theoretical knowledge/experience –Improvement of current IR processes‘Fire drill’–role-playing (2)•The scenario…Exterminate!!!•Evaluation of answers•Processing ‘lessons-learned’‘Fire drill’–role-playing (3)Example scenario:“Playing one side against the other”Corporation’s management announces a secret penetration test •Informs IRT and asks to report actions of Site security teamSite security team reports possible attack•IRT logs the callSite security team deals with the attack and reports resultsIRT reports actions of Site security team to Management •Corporation’s management analyses security team’s performanceSite security team complains to IRT about ‘a lack of responsible disclosure’!‘Fire drill’–Live Drills (1) Purpose:–Test the teams effectiveness and practical application –Improvement of current IR processes‘Fire drill’–Live Drills (2)•The Drill–The actors–The scenario–The events and triggers•Evaluation–Critique of actions taken•Processes lessons-learned–Refresh policies and proceduresSummaryCSIRT types:CSIRT, on-site IRT & First-responder (eg EET) Starting-up (Building Capability):Mandate, Scope, Resourcing, Finance, Models, Library, Conferences, Staff expertise, Trial, Liaison & Feedback.Continuing evolution (Enhancing Capability):CSIRT: Improved & new servicesTeam Members: Fire drills –role-playing& live testsReferences•“Defining Incident Management Processes for CSIRTs: A work in progress”/archive/pdf/04tr015.pdf , 2004•“Handbook for Computer Security Incident Response Teams (CSIRTs)”/archive/pdf/csirt-handbook.pdf , 2003•“Incident Response”, Kenneth R. Van Wyk & Richard Forno, OReilly& Associates, 2001•AusCERT course (AUS-CSIRT-02) : “Establishing a Computer Security Incident Response team (CSIRT)”-for Technical Staff and IRTManagers, 2004Questions?Xie-Xie! ☺。