Eric.freyssinet: 1 revision imported

2015-02-07T14:24:30Z

1 revision imported

← Older revision	Revision as of 14:24, 7 February 2015
(No difference)

Eric.freyssinet: a déplacé Proactive Detection of Network Security Incidents vers Proactive detection of network security incidents

2012-05-03T19:42:05Z

a déplacé Proactive Detection of Network Security Incidents vers Proactive detection of network security incidents

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.enisa.europa.eu/activities/cert/support/proactive-detection/proactive-detection-report/at_download/fullReport www.enisa.europa.eu (pdf)
|Author=Katarzyna Gorzelak, Tomasz Grudziecki, Paweł Jacewicz, Przemysław Jaroszewski, Łukasz Juszczyk, Piotr Kijewski,
|NomRevue=
|Date=2011-12-07
|Editor=Enisa
|Year=2011
|ISBN=
|Page=
|Abstract=This document is the final report of the ‘Proactive Detection of Network Security Incidents’ study.
The goal of the study was to investigate ways in which CERTs – national and governmental ones in
particular – proactively detect incidents concerning their constituencies, identify good practice and
recommended measures for new and already established CERTs, analyse problems they face and
offer recommendations to relevant stakeholders on what can be done to further this process. It is
important to note that the results of the study are largely community driven. That is, they are based
not just on research and the experience of the experts who conducted the study, but to a large
extent on the results of a survey carried out amongst 105 different CERTs (which resulted in 45
responses overall) and external expert group input. The outcome is thus a work by the community
for the CERT community.
Proactive detection of incidents is the process of discovery of malicious activity in a CERT’s
constituency through internal monitoring tools or external services that publish information about
detected incidents, before the affected constituents become aware of the problem. It can be
viewed as a form of early warning service from the constituents’ perspective. Effective proactive
detection of network security incidents is one of the cornerstones of an efficient CERT service
portfolio capability. It can greatly enhance a CERT’s operations, improve its situational awareness
and enable it to handle incidents more efficiently, thus strengthening the CERT’s incident handling
capability, which is one of the core services of national / governmental CERTs.1
The report covers 30 external services identified that can be used by CERTs to obtain information
about their constituency, often in an automated manner. Some are public and some have restricted
access. Most of them are free. In many cases, national and governmental CERTs can gain access to
data covering an entire country. Additionally, 12 different categories of internal tools were identified
(with specific tools as examples) that can be used by a CERT to detect incidents. Both external
services and tools were rated according to several criteria defined during the study, and priorities for
their implementation suggested.
The study has identified that CERTs are currently not fully utilising all possible external sources at
their disposal – despite their wide availability and relative ease of use, and despite the fact that many
CERTs declare their readiness to adopt new sources of information. Similarly, a large number of
CERTs do not collect incident data about other constituencies. Even those that do, often do not share
this data with other CERTs. This is an area of concern as exchange of such information is key to the
effective combating of malware and malicious activities and is extremely important in a cross-border
environment.
These and other shortcomings (16 overall) in the process of detection of incidents are examined in
more depth, both on a technical and legal/organisational level. The most important technical gaps
identified include problems with data quality (such as the existence of false positives in reports, poor

timeliness of delivery, lack of contextual information, no validity indicators, unclear data aging
policies), and lack of automation and correlation, partly due to data quality issues, but also due to
the lack of standard formats, tools or simply resources and skills. The most important legal problem
involves privacy regulations and personal data protection laws that often hinder the exchange of
information – an obstacle faced by CERTs but unfortunately not by miscreants responsible for
network attacks.
For each identified shortcoming, one or more recommendations are formulated as part of the study.
They are aimed at a) data providers, b) data consumers and c) organisations at the EU or national
level. For data providers key recommendations focus on suggestions on how to better reach out to
CERTs, better data format and distribution approaches as well as data quality improvement and
enrichment. For data consumers a guide on how to acquire access to datasets is given, suggestions
on better integration of external feeds with internal monitoring systems put forward, additional
activities that can be performed by a CERT to verify quality of data feeds enumerated, and specific
deployments of new technologies recommended. Finally, at the EU or national level , activities are
pointed out that are aimed at achieving a balance between privacy protection and security provision
needs, the encouragement of the adoption of common formats and underused technologies and the
integration of statistical incident data on a wider scale. Research is also suggested into the area of
data leakage reporting.
The summary of recommendations made per stakeholder group is provided in Section 8 (Summary of
recommendations). Detailed shortcomings identified, together with extended recommendations to
mitigate them, are provided in Section 7 (Identification of shortcomings in the proactive detection of
incidents).
It is hoped that the results published here will encourage national/government CERT managers of
both new and established CERTs to obtain access to many identified external sources of incident
information as well as to consider additional internal tools to collect such information that they can
deploy at their organisation. Enhancing their own network incident detection infrastructure enables
them not only to get better at proactively detecting incidents in their own constituency but also to
detect incidents that concern others. This fosters cooperation and data sharing between CERTs,
which helps to resolve the incidents and improve the security of the Internet.
|Botnet=,
|Malware=,
|CCProtocol=,
|Operation=,
|Keyword=,
}}

Proactive detection of network security incidents - Revision history

Eric.freyssinet: 1 revision imported

Eric.freyssinet: a déplacé Proactive Detection of Network Security Incidents vers Proactive detection of network security incidents