How to set up a CSIRT in an print - FIRST · Quality Report (Act) How to set up a CSIRT in an ITIL...
16
How to set up a CSIRT in an ITIL driven organization Christian Proschinger Raiffeisen Informatik GmbH
-
Upload
truongminh -
Category
Documents
-
view
217 -
download
0
Transcript of How to set up a CSIRT in an print - FIRST · Quality Report (Act) How to set up a CSIRT in an ITIL...
How to set up a CSIRT in an ITIL driven organization
Christian ProschingerRaiffeisen Informatik GmbH
Raiffeisen Informatik | 26.01.2010 | 2How to set up a CSIRT in an ITIL driven organization | public
Introduction R-IT CERT Idea Introduction to ITIL Example Vulnerability Management Lessons Learned
Raiffeisen Informatik | 26.01.2010 | 3How to set up a CSIRT in an ITIL driven organization | public
Outside of Europe:• China
• Südafrika •Kasachstan
Raiffeisen Informatik Group27 Locations3,000 EmployeesTurnover 2009: 1.2 Billion Euro40 years experience
IT Services IT Operations Outsourcing Security Services Client Management IT & Software Consulting Output Services
Raiffeisen Informatik | 26.01.2010 | 4How to set up a CSIRT in an ITIL driven organization | public
Security Competences at Raiffeisen Informatik
Department Information Security Management Information Security Management System ISO 27001 Focus on Risk Management
Department Security Competence Center Founded 2005 Headquarter of Raiffeisen Informatik CERT Austria Penetration Testing
Responsible person/team for each Business Service as well as foreach Technical Component
Raiffeisen Informatik | 26.01.2010 | 5How to set up a CSIRT in an ITIL driven organization | public
General Situation
Large scale IT organization have to be standardized and to be compliant IT Infrastructure Library Business process maps ISO 27001 COBIT
CSIRT Customized services for constituency Guidelines helpful but generic
Raiffeisen Informatik | 26.01.2010 | 6How to set up a CSIRT in an ITIL driven organization | public
General Situation
IT Infrastructure Library Best practice library De-facto standard
76 % of organizations align IT Service Management to ITIL* Popular processes Incident Management Service Desk Incident Management Process
Problem Management Information Security Management
*IT Service Management Studie MATERNA
Raiffeisen Informatik | 26.01.2010 | 7How to set up a CSIRT in an ITIL driven organization | public
What are the implications of ITIL concerning setting up a CSIRT operate a CSIRT
Questions
ITIL driven organizationCSIRT
Raiffeisen Informatik | 26.01.2010 | 8How to set up a CSIRT in an ITIL driven organization | public
Introduction to IT Infrastructure Library 5 Core publications Service strategy Service design Service transition Service operation Continual service improvement
Target is an IT alignment to business processes
Source: ITIL v3 The official Introduction to the Service Lifecycle: TSO (OGC); 2007
Raiffeisen Informatik | 26.01.2010 | 9How to set up a CSIRT in an ITIL driven organization | public
Service Strategy
Service DesignService Design TransitionTransition IT OperationsIT Operations Service ImprovementService ImprovementService StrategyService Strategy
Management of: Service Catalog Service Level Capacity Availability IT Service Continuity Information Security Supplier
Strategy development Service Portfolio
Management Financial Management Demand Management
Planning and Support Service Asset and
Configuration Mgmt Chance Mgmt Release and Deployment
Mgmt Service Validation &
Testing Evaluation Knowledge Mgmt
Event Management Incident Management Problem Management Request Fulfillment Access Management
Service Reporting 7-Step
Improvement process
quality improvement Service
Measurement
Raiffeisen Informatik | 26.01.2010 | 10How to set up a CSIRT in an ITIL driven organization | public
Example Vulnerability Management
Information(Plan)
Countermeasure(Do)
Audit(Check)
Information Security Management Process ISO 27001:2005 Deming Cycle (Plan-Do-Check-Act)
CSIRT can produce added value Economies of scale Quality
Report(Act)
Raiffeisen Informatik | 26.01.2010 | 11How to set up a CSIRT in an ITIL driven organization | public
Example Vulnerability Management
Vulnerability Management != Patch Management TRUE Workarounds Configuration issues Design issues Functional patches
Raiffeisen Informatik | 26.01.2010 | 12How to set up a CSIRT in an ITIL driven organization | public
Example Vulnerability Management
Report Information Security
Management
Information Input
Penetration Tests –CSIRT Service triggered by Information Security Management
Security Advisories – CSIRT Service
Service Desk
CountermeasureProblem Management
Problem Tickets: Penetration Testing measures, Less critical vulnerabilities
Incident ManagementHigh critical vulnerabilities
AuditVulnerability
Scanning – CSIRT Service
PLANPLAN DODO CHECKCHECK ACTACT
Raiffeisen Informatik | 26.01.2010 | 13How to set up a CSIRT in an ITIL driven organization | public
Patch Management: affected ITIL Processes
Financial Management
COST CONTROL
Service DesignService Design TransitionTransition IT OperationsIT Operations Service ImprovementService ImprovementService StrategyService Strategy
Service Level Management: costumer relations interface
Review of infrastructure requirements
Continuity Management to minimize impacts
Risk assessment Vulnerability
Management process
Planning and Support Service Asset and
Configuration Mgmt Change Mgmt Release and Deployment
Mgmt Service Validation &
Testing Evaluation Knowledge Mgmt
Incident Management: patch (critical)
Problem Management: patch, root problem search
Service Reporting Service Measurement
Raiffeisen Informatik | 26.01.2010 | 14How to set up a CSIRT in an ITIL driven organization | public
Lessons Learned
Vulnerability Management != Patch Management Incident != Security Incident Service Strategy Utility Warranty USP Constituency
Service Design Information Security Management
ISO 27001:2005 good preparation for FIRST accreditation (Site Visit) Information Security Management System Define clear „interfaces“ Use the experience of your ISM Team Easy way to achieve “separation of duties”
Service Operation Incident Management: Service Desk
Process can be easily adopted for security incident management Problem Management: Good way to implement penetration test measures
Raiffeisen Informatik | 26.01.2010 | 15How to set up a CSIRT in an ITIL driven organization | public
Summary
Considering ITIL offers advantages Important processes
Incident Management Problem Management Information Security Management ISO 27001:2005 provides a good basis
Maybe a possibility to set up the process of CSIRTs easier
Raiffeisen Informatik | 26.01.2010 | 16How to set up a CSIRT in an ITIL driven organization | public
Thank you for your attention!
Raiffeisen Informatik GmbHLilienbrunngasse 7-9 A-1020 Wien
T +43 1/99 3 99 - 0 F +43 1/99 3 99 - 1100 E [email protected]
www.raiffeiseninformatik.at
![CSIRT - Hackerspace Prague [brmlab]CSIRT in general CSIRT Service Categories Reactive Services Proactive services Security Quality Management Services CSIRT Pavel Ru˚ziˇ ckaˇ](https://static.fdocuments.in/doc/165x107/5e6445bebae81a2b335bcc14/csirt-hackerspace-prague-brmlab-csirt-in-general-csirt-service-categories-reactive.jpg)
