News and Updates

Is this the end ? (16 January 2004)

During the TF-CSIRT Meeting in Madrid, Spain, the take-up of the eCSIRT.net services was discussed within the community of European CSIRTs. Even before, there were some decisions made in regard to continuation of some of the services and efforts.

To make a long story short, there are three different approaches:

Input to TF-CSIRT Working Groups

Some results have been tailored towards the needs of the project. While they still serve as an example and have proven to be sufficient for the partners, such sensitive documents like any Code of Conduct needs more discussion within a group that should apply this code. In addition as the scope of the European CSIRT community is broader then the project, other considerations might as well provide enough reasons to change it or at least add to it.

Topics for TF-CSIRT Working Groups:

• Code of Conduct - The group of TI Accredidated Teams is developing a code, taken this document into consideration.
• eCSIRT.net Common Language (WP2 and WP3) - As the IETF finally concludes the work on the IODEF syntax definitions, the TF-CSIRT will continue to adopt an agreed upon interpretation of the IODEF exchange format. This will heavily build upon the Common Language defined in the project.

Take-Up by TI Accredited Teams

The stable pilot services developed in the project - WP4 Statistics Type 1 and 2 as well as WP5 Alerting - could become part of a service delivery available to the European CSIRT community. Discussions with the TI Accredidated Teams however showed, that although enough was said on the functions and techniques, they would like to get an impression of the "look and feel".

To overcome this factor, it was agreed that during the phase from Mid of February to End of March 2003 tests for all TI Accredidated that would wish to participate in the test will be arranged. Thereafter, after collecting the feedback from the field test, a proposal will be considered in time for the next TF-CSIRT Meeting in Hamburg in May 2004.

Continuation as Volunteers Project

As some part of the project - most interestingly the IDS sensor network - caused much discussion and as there was no consensus, whether such network would be benenficial to all, and as the setup is far from being anywhere near the definition of a "service", it was felt that the network should be continued based on the efforts of volunteers:

• NTP Crypto Time Server - This component is necessary and be continued by PRESECURE.
• Collector for Sensor Network - PRESECURE will continue to provide the hardware and resources for maintaining the Collector as well as to provide access from participating teams to it.
• Future Extensions - Future extensions like allowing an automatic update of configurations as well as signature files based on a secured master site needs to be developed. The work involved will be coordinated by PRESECURE, but efforts of all interested are needed to implement much desired new functions.
• Participation - To allow participation on the one hand without exposing the network to a group which does not know what to expect from each other, it was envisioned, that the participation would be offered to TI Accredidated Teams. Such teams would not need any other justification, while other teams - especially from the international realm - would need to be handled differently. It is mandatory, that each decision is taken by the group instead of one individuall, as the success of the network is also tied towards the security felt by the participants.

Where to find the Project Results?

Most likely you will find the relevant pointers of interest to you in the Sitemap. All topics can be reached from there. However if you know your topic of interest, you might find it right here:

Services of the eCSIRT.net

• Code of Conduct
• eCSIRT.net Common Language (WP2 and WP3)
  • Common Language for using IODEF within the context of the eCSIRT.net project
  • Guideline "How to apply the Common Language"
  • Integration of IODEF/IDMEF into CSIRT Operation
• eCSIRT.net Alert Function (WP5)
  • Policy Statement for the Alert Function
  • User Guide for the Internet based Alert System
  • User Guide for the Telephone based Alert System
• eCSIRT.net Statistic Function (WP4)
  • Policy Statement for the Statistic Function
  • User Guide for the Statistic Function
  • User Guide for the IDS sensors
• eCSIRT.net Statistics - Public Version only!
  • Statistics from January to August 2003
  • Improved Scheme for Statistics from September 2003 onwards
  • Distributed IDS Sensor Network
• Other Public Statistics
• Cases and Success Stories
• IODEF/IDMEF: XML based Formats - Products, Tools and Documents
• Publicly Accessable Services
• Presentations

Other Resources

• CSIRT Communities
• CSIRT Accreditation
• Establishing new CSIRTs
• CSIRT Training
• CSIRT Operations
• Vulnerability Advisories

eCSIRT.net The European Computer Security Incident Response Team Network News | Sitemap | Imprint | Privacy Statement | Contact | Top Last changed: January 17, 2003 / KPK Copyright © 2002-2004 by PRESECURE Consulting GmbH, Germany

Signed with PGP!