eCSIRT.net Services

Access to Services

As the eCSIRT.net project has concentrated on the developement of the common grounds necessary for any co-operation between CSIRTs, almost all services will be available only for participating CSIRTs.

But one of the services, used internally to provide an infrastructure element, was made available:

• Cryptographically authenticated time server (Crypto NTP)
  eCSIRT.net offers free access to a cryptographically authenticated time server based on a DCF-77 radio clock. - As the file contains critical information make sure to check it using our pgp signature!

Documents about Services and related Topics

• Code of Conduct
  In order to be able to store and exchange incident data between CSIRTs - whether based on the common language or not - a shared and agreed upon code of conduct between all partners is necessary. The eCSIRT.net partners agreed on a code of conduct in December 2002, which was established based on a code of conduct put into practice by a group of German CSIRTs in Summer 2002.
• eCSIRT.net Common Language (WP2 and WP3)
  Where IODEF/IDMEF specifies mainly the syntax for exchanging specific information, any co-operation needs to define a common understanding first, how to represent and interprete the exchanged data. To overcome this problem, which will make the adoption of IODEF especially much more difficult, a "common language" was defined to define the semantics for use of IODEF among the eCSIRT.net partners.
  • Common Language for using IODEF within the context of the eCSIRT.net project
  • Guideline "How to apply the Common Language"
  • Integration of IODEF/IDMEF into CSIRT Operation

• eCSIRT.net Alert Function (WP5)
  Alerts are distributed to the participating teams via the Internet (encrypted mailing list) or the telephone system including a SMS message to designated point of contacts. A policy statement governs the whole function.
  • Policy Statement for the Alert Function
  • User Guide for the Internet based Alert System
  • User Guide for the Telephone based Alert System

• eCSIRT.net Statistic Function (WP4)
  Statistical information from the participating teams are collected via the Internet (protected web site) or by automatic means (IDS sensor network). A policy statement governs the whole function.
  • Policy Statement for the Statistic Function
  • User Guide for the Type 1 and Type 2 Statistics
  • User Guide for the Type 3 Statistics

  The publicly available statistics as result of the project are explained below.

• eCSIRT.net Public Statistics
  One of the project goals was to generate statistics that provide some insights into the work of CSIRTs and the general level of threats to internet connected systems.
  • Statistics from January to August 2003
  • Improved Scheme for Statistics from September 2003 onwards
  • Distributed IDS Sensor Network
• Other Public Statistics
  In addition to the statistics collected by eCSIRT.net, information about other publicly available sources should be collected and presented. Therefore references to CSIRT statistics, information from several network monitoring projects were collected. In addition links to public statistics on computer security incidents and cybercrime as well as the summarize of relevant surveys were listed.
• Cases and Stories on Incidents
  The project group also collected information on available cases and stories providing more detailed information on incidents as well as the associated circumstances.
• IODEF/IDMEF: XML based Formats - Products, Tools and Documents
  An Overview of IODEF/IDMEF enabled or capable solutions available to CSIRTs.

Some Presentations

• eCSIRT.net project presentation from May 2003
  Presentation of the status of the project at the TF-CSIRT meeting May 29, 2003 in Warsaw, Poland.   [PDF/ZIP file, 179 kB]
• Automatic Exchange of Incident Related Data and its Application in CSIRT Operations
  Presentation of the status and progress of the eCSIRT.net project on Automatic Incident Related Data Exchange issues at the FIRST Conference June 25, 2003 in Ottawa, Canada. With some remarks about IODEF/IDMEF.   [PDF/ZIP file, 392 kB]
• eCSIRT.net project presentation from September 2003
  Presentation of the status of the project at the TF-CSIRT meeting September 25, 2003 in Amsterdam, The Netherlands.   [PDF/ZIP file, 1.544 kB]
• eCSIRT.net Common Language Specification
  Presentation of the common language agreed on in the eCSIRT.net project at the INCH working group meeting at the 58th IETF conference November 13, 2003 in Minneapolis, MN, USA.   [PDF file, 105 kB]
• IHSH: A Small LibAir-based IODEF tool
  Presentation of the Incident Handling Shell, a tool created in the eCSIRT.net project to enable easy creation and processing of IODEF objects. Held at the INCH working group meeting at the 58th IETF conference November 13, 2003 in Minneapolis, MN, USA.   [PDF file, 96 kB]

Other Resources

Some links to other important websites.

• CSIRT Communities
• CSIRT Accreditation
• Establishing new CSIRTs
• CSIRT Training
• CSIRT Operations
• Vulnerability Advisories

Interest in eCSIRT.net Services?

The eCSIRT.net Services are currently discussed within the European CSIRT community. Some of the services will be continued, either as a regular service or as project to further investigate issues outside the scope of the original project but of interest to the CSIRT community.

If you are interested in eCSIRT.net and would like to participate in the CSIRT community or if you are interested in the future of the services, please contact us directly.

eCSIRT.net The European Computer Security Incident Response Team Network News | Sitemap | Imprint | Contact | Top Last changed: December 19, 2003 / OG Copyright © 2002-2003 by PRESECURE Consulting GmbH, Germany

Signed with PGP!