eCSIRT.net Project Plan

Project Outline

The project will continue until December 2003. The workplan is divided into 4 technical workpackages, WP 2 to 5, which are discussed in more detail below. Three accompanying workpackages, WP 1, 6 and 7, are addressing the following issues:

• WP 1 : project management
• WP 6 : measurement and evaluation of results
• WP 7 : dissemination of results

Preparation Phase (WP2)

Workpackage 2: Preparation Phase ("defining a common language") addresses the specification, adaptation and integration of available techniques, and the development of a necessary common framework, to enable and facilitate the further work.

The expected results from this phase are:

• Code of Conduct supported by partners
• Product list - overview of IODEF /IDMEF enabled/capable solutions available to CSIRTs
• Documentation of a Common Language for incident data storage and exchange based on IODEF/IDMEF
  Where IODEF/IDMEF specifies mainly the syntax of the "common language", the semantics have to be specified as well.
• Documentation on the integration of common language into CSIRT operation
• Guideline "How to apply common language"

The preparation phase is scheduled until early 2003 and will be followed by its exploitation. This means, that the results of the preparation are actually used within the production environment of the partners.

Usage Phase (WP3)

Workpackage 3 : Usage Phase ("using the common language between partners") is based on the established common framework of WP 2 and covers the actual usage of identified solutions by the partners.

The expected results from this phase are:

• Updates on the Product list regarding the overview of IODEF /IDMEF enabled/capable solutions available to CSIRTs
• Updates on the Guideline "How to apply common language"

Clearinghouse Function (WP4)

Workpackage 4 : Clearinghouse Function ("gathering incident statistics from partners using the common language") addresses the established common framework of WP 2 to collect incident statistics from the partners and serve these in an integrated fashion to the partners, and - in a generalized way - to a wider audience. Suitable international contacts can contribute to and benefit from this scheme if they adopt the developed common framework.

The expected results from this phase are:

• Clearinghouse policy
• User Guide for the Statistic Function
• User Guide for the IDS sensors
• Aggregated generalized statistics suitable for a public audience
• References to public statistics related to CSIRTs
• Collection of sanitized case and success stories for a public audience

Alert Function (WP5)

Workpackage 5 : Alert Function ("gathering incident data from partners to derive early warnings and emergency alerts from, and spread these to partners securely") addresses the established common framework to collect incident data from the partners and then deploy techniques to intelligently combine these to yield early warning information, in the form of warnings or emergency alerts to the partners. For the spreading of warnings and alerts suitable techniques will be adopted, in-band (using the Internet) or out-of-band - in the latter case leaning on infrastructures available or developed elsewhere.

Suitable international contacts can contribute to and benefit from this scheme if they adopt the developed common framework. This is especially true for international bodies that can provide information for the alert function outside European business hours.

The expected results from this phase are:

• Alert Policy
• Specified and established techniques for in-band Internet based alerting
• Specified and established techniques for "out-of-band" (not Internet based) alerting

eCSIRT.net The European Computer Security Incident Response Team Network News | Sitemap | Imprint | Privacy Statement | Contact | Top Last changed: December 30, 2003 / AL Copyright © 2002-2003 by PRESECURE Consulting GmbH, Germany

Signed with PGP!