RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by...
Transcript of RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by...
![Page 1: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/1.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
RT for Incident Response (RTIR)
Andy Bone
JANET-CERT Manager
![Page 2: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/2.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
Plan of action
Brief Introduction MeRTIR Update JohnFuture of RT Me (again)Discussion & Views You lot (I hope)W G Proposalmini BOF With your cooperation
![Page 3: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/3.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
RT for Incident Response (RTIR)
John Green
JANET-CERT
![Page 4: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/4.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
OverviewIt’s designed to track issuesn It doesn’t really care what sort
What it gets used forn Bug tracking, helpdesk, customer service,
abuse, network operations, sales lead tracking, todo lists….
Mason, perl, mysql, apache
![Page 5: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/5.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
![Page 6: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/6.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
![Page 7: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/7.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
What we wanted to do
• Allow JANET-CERT staff to manage increasing workload effectively• Provide a base for other IR teams to build new tools• Be easily extensible as new services need to be provided• Save money
![Page 8: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/8.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
Starting over
• JANET-CERT contacted Best Practical• We put together a plan to extend RT for Incident Handling• RT was close, but didn’t have everything we needed
![Page 9: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/9.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
New functionality in RTIRIRT specific workflows‘clicky’ metadata extraction and trackingwhois integrationseparate “threads” for each conversationhigh-level overviewsconvenient searchingsimple scriptable actionsnew reporting functionality
![Page 10: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/10.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
How RTIR carves things up
Incident Reportsn Someone has a problem of some kind
Investigationsn IRT attempts to get to the root of the problem
Blocksn Track network level intervention against threat
Incidentsn Ties it all together. May have many related
incident reports, investigations and blocks
![Page 11: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/11.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
![Page 12: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/12.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
Incident Reports
![Page 13: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/13.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
![Page 14: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/14.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
![Page 15: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/15.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
Incidents
![Page 16: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/16.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
![Page 17: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/17.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
![Page 18: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/18.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
![Page 19: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/19.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
Where we are now
• Version 1.0 released end of August• In use by a number of teams• Tested and evaluated by many more• Only package (as far as we know) specifically
designed for IRT use
![Page 20: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/20.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
The future
Cross-IRT integrationn IODEF?n RT-native integration
Cross-tool integrationn PGP signing/validation
Continuing development and bugfixes
![Page 21: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/21.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
Finding out more
[email protected] Closed list for incident response team staff
http://www.bestpractical.comhttp:/www.bestpractical.com/rtir/
![Page 22: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/22.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
RT for Incident Response(RTIR Moving On)
Andy Bone
JANET-CERT Manager
![Page 23: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/23.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
The Dream Although RTIR is still in its infancy we believe that we need to think about the future:
What can we do:
• Leave it as it is.
• Each team go away and modify to its own specification.
• Create a consortium of teams within the TF-CSIRT to increase spending power and create a standard system.
![Page 24: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/24.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
Possible Training Course on RT/RTIR: Requested by CERT-POLSKA and ourselves.Bestpractical agreed but:
• Need minimum of 8 people.• Facilities• Smallish cost (negotiable and dependant on
attendees)
Training
![Page 25: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/25.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
Other Teams using RTIR Views and observations:
• ACOnet-CERT
• CERT-POLSKA
• Anyone out there
Discussion
![Page 26: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/26.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
I would like like to propose, that we form a WG through the TF-CSIRT to investigate the future of RTIR.With a mind to:
• Investigate and prepare requirements for RTIR V 2.
• To form a consortium of like minded teams to cooperate with Bestpractical in the implementation of RTIR V 2.
• Investigate and organise training on RT/RTIR.
Proposal
![Page 27: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/27.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
We intend to hold a brief BOF during the tea break if any teams would like to talk about the way forward and are interested in joining a WG, please join us and express your views.
BOF
![Page 28: RT for Incident Response (RTIR) · 2003-09-29 · Possible Training Course on RT/RTIR: Requested by CERT -POLSKA and ourselves. Bestpractical agreed but: • Need minimum of 8 people.](https://reader034.fdocuments.in/reader034/viewer/2022042623/5fb1f114a72ed60a76754e06/html5/thumbnails/28.jpg)
© JANET Association trading as UKERNA 2003 TF-CSIRT Amsterdam 24 September 2003
Questions