Security Officer: An NREN Secondee Perspective

Size: px

Start display at page:

Download "Security Officer: An NREN Secondee Perspective"

Maryann Pitts
9 years ago
Views:

1 Security Officer: An NREN Secondee Perspective Jan Kohlrausch, DANTE TF-CSIRT Meeting 18/19 September 2014 Rome

Background About me: Senior Incident Handler and Researcher with DFN-CERT Currently member of ACDC project (Fighting Botnets) NREN Security Officer / Secondee at DANTE Position from

2 Background About me: Senior Incident Handler and Researcher with DFN-CERT Currently member of ACDC project (Fighting Botnets) NREN Security Officer / Secondee at DANTE Position from 14 th July to 23 rd December Motivation: Win-Win situation Content: Overview of the Security Officer Role Preliminary Results Benefits for the constituency and other security teams 2

14 th July to 23 rd December Motivation: Win-Win situation Content: Overview of the

3 Motivation New Chances and Threats: Cloud Computing Mobile Devices New Challenges: Targeted Attacks (APT) Large-scale DDoS (Reflector attacks) Large increase of number of malware samples and attacks Increased collaboration among security teams: Incident Data Exchange IOC Trust becomes more and more important 3

increase of number of malware samples and attacks Increased collaboration

4 Security Officer

Security Team - Proposed New Structure Head of Infrastructure & Information Security GEANT Security Co-ordinator Senior Security Engineer (Infrastructure) Security Engineer (Infrastructure) Security

5 Security Team - Proposed New Structure Head of Infrastructure & Information Security GEANT Security Co-ordinator Senior Security Engineer (Infrastructure) Security Engineer (Infrastructure) Security Officer (Information) Security Officer Role Recommendation of the NREN & ISP Security Working Group Separation into Information Security Operational Security (Infrastructure Security) Assistant Security Engineer (Infrastructure) Objectives Achievements Challenges Conclusions GN3 Overall Q&A 5

Recommendation of the NREN & ISP Security Working Group Separation into Information Security Operational Security

6 Security Officer Objectives Security Policies and Guidelines Cloud Computing BYOD AUP Review of Incident Handling Processes Prepare for TI Certification Initiate project for ISO certification Important for building trust in the CSIRT community 6

Prepare for TI Certification Initiate project for ISO 27001

Building Trust Following Best Practice Security Controls to protect the GÈANT Network Enforcing and Auditing Security Polices Data Protection and Security Incident Handling Code of Conduct

7 Building Trust Following Best Practice Security Controls to protect the GÈANT Network Enforcing and Auditing Security Polices Data Protection and Security Incident Handling Code of Conduct Collaboration with constituency and security teams Demonstrating responsibility Providing help and information Security Audit Following Standards (ISO Series) Trusted Introducer Accreditation/Certification NREN Security Working Group Review 7

constituency and security teams Demonstrating responsibility Providing help and information Security Audit

8 Cloud and BYOD Policy Challenges: Benefit from Cloud Services and Mobile Devices omitting specific Risks Coping with the loss of governance Selecting the appropriate scope: Cloud Models (SaaS, PaaS, and IaaS) Eligible Mobile Devices and Operating Systems Preliminary Results: Survey of Best Practices Requirement collection for both polices Current and future requirements 8

Models (SaaS, PaaS, and IaaS) Eligible Mobile Devices and Operating Systems Preliminary

9 ISO Certification Overview: Information Security Standard Used to specify a Information Security Management System 14 Groups of controls, e.g.: Information Security Policies Human Resources Information Security Incident Handling Compliance Approach: Threat Analysis Definition of scope: e.g. Focus on DANTE CSIRT Implementation of controls Further improvement 9

10 TI Certification Trusted Introducer: Clearing House for CSIRTs Directory of CSIRTs Supporting data exchange Levels of Trust Registration Accreditation Certification TI Certification uses the SIM3 Model to assess CSIRTs maturity Gap Analysis of required documents and TI certification process 10

Accreditation Certification TI Certification uses the SIM3 Model to

11 Conclusion and Outlook Conclusion Separation of operational and information security as advised by the NREN & ISP Security Working Group NREN Secondee position to define Security Officer role First preliminary results on security polices and TI/ISO certification Outlook Further work on policy creation and enforcement Continuing with the ISO certification process Further involvement of the NREN community: Continuation of the Security Officer role as NREN Secondee? Collaboration with NREN CSIRTs pertaining new security services 11

Outlook Further work on policy creation and enforcement Continuing with the ISO 27001 certification process Further involvement of the

12 Thank you Any questions?

DANCERT RFC2350 Description Date: 10-10-2014 Dissemination Level:

DANCERT RFC2350 Description Date: 10-10-2014 Dissemination Level: 10-10-2014 Date: 10-10-2014 Dissemination Level: Owner: Authors: Public DANCERT DANTE Document Revision History Version Date Description of change Person 1.0 10-10-14 First version issued Jan Kohlrausch