RT for Incident Response (RTIR)
|
|
|
- Audrey Robertson
- 10 years ago
- Views:
Transcription
1 RT for Incident Response (RTIR) Andy Bone JANET-CERT Manager
2 What is RTIR A tool for incident handling Currently in Beta
3 Why Change History Increasing volume of incidents Requirement for multiple person triage System struggling to cope Need to increase resilience (BCP) Increase automation
4 JANET-CERT was using Remedy-ARS / IMAP based tool Unmaintained Designed for small team and smaller friendlier internet Required manual interaction for each incoming message New development would have been costly Limited platform support History Little built in workflow or integration with external tools Hard for multiple staff to work in parallel on the same incident
5 History What we wanted to do Allow JANET-CERT staff to manage increasing workload effectively Provide a base for other IR teams to build new tools Be easily extensible as new services need to be provided Save money
6 History How did we start Began by mapping workflow (through triage) Define requirements >
7 Define Requirements The buzz words Usable Cross platform Open-source Maintainable using current team skills Extensible using current team skills Securable Supported
8 History How did we start Began by mapping workflow (through triage) Define requirements > Evaluate current IHS solutions Request Tracker chosen >>
9 Request Tracker Chosen Why Request Tracker Designed to track issues It doesn t really care what sort What s it used for Bug tracking, helpdesk, customer service, abuse, network operations, sales lead tracking, to do lists. RT was close, but didn t have everything we needed
10 RT
11 RT
12 History How did we start Began by mapping workflow (through triage) Define requirements > Evaluate current IHS solutions Request Tracker chosen >> Extra development and support required >>>
13 New development What we wanted extra IRT specific workflows clicky data extraction and tracking whois integration >
14 whois
15 whois
16 New development What we wanted extra IRT specific workflows clicky data extraction and tracking whois integration > separate threads for each conversation convenient searching simple scriptable actions new reporting functionality tied into our new SLA requirement
17 History How did we start Began by mapping workflow (through triage) Define requirements > Evaluate current IHS solutions Request Tracker chosen >> Extra development and support required >>> Agree Statement of Work with Best Practical Work commenced Nov 2002 expected completion June 2003.
18 Home page
19 RTIR Structure Incident Reports Someone has a problem of some kind
20 Incident Reports
21 Incident Reports
22 RTIR Structure Incident Reports Someone has a problem of some kind Investigations IRT attempts to get to the root of the problem
23 Investigations
24 Investigations
25 RTIR Structure Incident Reports Someone has a problem of some kind Investigations IRT attempts to get to the root of the problem Blocks Track network level intervention against threat
26 Blocks
27 RTIR Structure Incident Reports Someone has a problem of some kind Investigations Blocks IRT attempts to get to the root of the problem Track network level intervention against threat Incidents Ties it all together. May have many related incident reports, investigations and blocks
28 Incidents
29 Incidents
30 Incidents
31 Incidents
32 The future Cross-IRT integration IODEF? RT-native integration Cross-tool integration PGP signing/validation Automatically create new incident reports for phenomena detected, but not if RT already knows about it. Auto-categorization of incoming incident reports? Other team implementations
33 Finding out more Closed list for incident response team staff
34 Questions
Request Tracker for Incident Response (RTIR)
Request Tracker for Incident Response (RTIR) Kevin Falcone Best Practical Solutions RT/RTIR RT RTIR Extending RTIR Future development of RTIR REQUEST TRACKER RT is a ticketing system Bugtracking Helpdesk
RT and RT for Incident Response
RT and RT for Incident Response I represent a software vendor We sell support, training, consulting and customization for RT, RTIR and RTFM This talk could be dangerously close to a sales pitch. I m not
RT and RT for Incident Response
RT and RT for Incident Response Carlos Fuentes Bermejo RTIR WG - Primary Technical Contact RedIRIS IRIS-CERT - Security Specialist Si habla español Couldn t be here today :( Jesse Vincent Designed RT and
Designing and Developing an Application for Incident Response Teams
Designing and Developing an Application for Incident Response Teams Kees Leune and Sebastiaan Tesink Tilburg University, The Netherlands FIRST 2006, Baltimore, MD, USA High-quality Internet for higher
Copyright 2005-2010 Soleran, Inc. esalestrack On-Demand CRM. Trademarks and all rights reserved. esalestrack is a Soleran product Privacy Statement
RTIR incident handling work-flow
RTIR incident handling work-flow JANET CSIRT JANET(UK) WI/JCSIRT/003 Page 1 of 18 INTRODUCTION Request Tracker for Incident Response (RTIR) is the incident handling and ticketing system used by JANET CSIRT,
OTRS: Issue Management System Meets Workflow of Security Team Pavel Kácha, 2007 CESNET, z. s. p. o.
HOMO Vulnerabilis Aghast Awarensis Dexterous Securis OTRS: Issue Management System Meets Workflow of Security Team Pavel Kácha, 2007 CESNET, z. s. p. o. History postmaster@, hostmaster@, abuse@ Mailbox
IT Support Tracking with Request Tracker (RT)
IT Support Tracking with Request Tracker (RT) Archibald Steiner AfNOG 2013 LUSAKA Overview What is RT? A bit of terminology Demonstration of the RT web interface Behind the scenes configuration options
Comindware Tracker. Reviewer s Guide. 2012 Comindware Inc.
Comindware Tracker Reviewer s Guide 2012 Comindware Inc. 1 Dear Editor, We appreciate that you decided to try Comindware Tracker and write a review about it. We would like to make it easier for you and
PNMsoft Sequence Ticketing Solution (PSTS)
PNMsoft Sequence Ticketing Solution (PSTS) PNMsoft Sequence Ticketing Solution (PSTS) is a software solution built on an industry leading Business Process Management platform. It enables organizations
BOOTSTRAPPING YOUR INFORMATION SECURITY PROGRAM. Brian Smith-Sweeney [email protected] @bsmithsweeney
BOOTSTRAPPING YOUR INFORMATION SECURITY PROGRAM Brian Smith-Sweeney [email protected] @bsmithsweeney GOALS OF BOOTSTRAPPING Gain visibility Build capability Form relationships Get quick wins Establish
Incident Informa.on Exchange in Darknet Monitoring System dra9- suzuki- mile- darknet- 00
Incident Informa.on Exchange in Darknet Monitoring System dra9- suzuki- mile- darknet- 00 Mio Suzuki Cybersecurity Laboratory Network Security Research Institute National Institute of Information and Communications
Add Approval Workflow
Add Approval Workflow Add Approval workflow to a list or library The workflows included with SharePoint products are features that you can use to automate your business processes, making them both more
User and Customer Interviews How XSOL has assisted ERP implementations. Survey
User and Customer Interviews How XSOL has assisted ERP implementations Survey Summary I can honestly say I have worked with a lot of technology companies and this is the first time I ve had the same resounding
How to Build a Service Management Hub for Digital Service Innovation
solution white paper How to Build a Service Management Hub for Digital Service Innovation Empower IT and business agility by taking ITSM to the cloud Table of Contents 1 EXECUTIVE SUMMARY The Mission:
Written by: Johan Strand, Reviewed by: Chafic Nassif, Date: 2006-04-26. Getting an ipath server running on Linux
Getting an ipath server running on Linux Table of Contents Table of Contents... 2 1.0. Introduction... 3 2.0. Overview... 3 3.0. Installing Linux... 3 4.0. Installing software that ipath requires... 3
The problem with privileged users: What you don t know can hurt you
The problem with privileged users: What you don t know can hurt you FOUR STEPS TO Why all the fuss about privileged users? Today s users need easy anytime, anywhere access to information and services so
FULLY MANAGED SERVICE COMPLETE SUPPORT FOR YOUR MOBILE ENTERPRISE
FULLY MANAGED SERVICE COMPLETE SUPPORT FOR YOUR MOBILE ENTERPRISE At Spirit, we realise that our customers are looking for choice, flexibility and value. That s why we have developed our special Fully
everything HelpDesk [Ease of Use] [100% Web Help Desk] [Business Process Automation] [World Class Customer Service]
![everything HelpDesk [Ease of Use] [100% Web Help Desk] [Business Process Automation] [World Class Customer Service]](/thumbs/24/4359104.jpg "everything HelpDesk [Ease of Use] [100% Web Help Desk] [Business Process Automation] [World Class Customer Service]")
everything HelpDesk [Ease of Use] [100% Web Help Desk] [Business Process Automation] [World Class Customer Service] [Essential Third Party Integration] [Cross Platform Service Desk Solution] [Reporting
Add Feedback Workflow
Add Feedback Workflow Add Feedback Collection workflow to a list or library The workflows included with SharePoint products are features that you can use to automate your business processes, making them
WRS CLIENT CASE STUDIES
WRS Billing Services are great: the fees are low, I can track everything on the computer, and it s all very easy for me to look at. Emily Gordon, M.D. Vital Signs Medical Associates Middletown, NY Vital
Meanings of different Social Services meetings
Meanings of different Social Services meetings Your Advocate will talk to you before a meeting to find out what you want to say, in case you don t want to talk yourself. Your Advocate can talk to you after
How to measure your business resiliency
How to measure your business resiliency Define the KPI s/kri s and scorecards to control your security and business continuity capabilities Krzysztof Pulkiewicz BCMLogic [email protected]
How Freshservice helped Moneycorp streamline their IT Support
How Freshservice helped Moneycorp streamline their IT Support Moneycorp (TTT Moneycorp Limited) is a UK company offering foreign exchange services to individual and corporate customers. It operates in
The MANTIS Framework Cyber-Threat Intelligence Mgmt. for CERTs Siemens AG 2014. All rights reserved
B. Grobauer, S.Berger, J. Göbel, T. Schreck, J. Wallinger Siemens CERT The MANTIS Framework Cyber-Threat Intelligence Mgmt. for CERTs Note MANTIS is available as Open Source under GPL v2+ from https://github.com/siemens/django-mantis
Looking back on how desktop support has evolved, it s interesting to see how tools
DECEMBER 2013 Desktop Support Technology Written by Michael Hanson Data analysis by Jenny Rains Looking back on how desktop support has evolved, it s interesting to see how tools have changed. Many years
quality hosting solution. we manage your hosting. so that you can manage your business.
quality hosting solution. we manage your hosting. so that you can manage your business. Orisma Technology Co., Ltd. 1104/2 Pattanakarn Rd. Suanluang, Suanluang Bangkok 10250, Thailand Tel. 66 2187 2591-3
PCI DSS Compliance: The Importance of Privileged Management. Marco Zhang [email protected]
PCI DSS Compliance: The Importance of Privileged Management Marco Zhang [email protected] What is a privileged account? 2 Lots of privileged accounts Network Devices Databases Servers Mainframes Applications
Business Continuity Planning
Business Continuity Planning We believe all organisations recognise the importance of having a Business Continuity Plan, however we understand that it can be difficult to know where to start. That s why
How to Define SIEM Strategy, Management and Success in the Enterprise
How to Define SIEM Strategy, Management and Success in the Enterprise Security information and event management (SIEM) projects continue to challenge enterprises. The editors at SearchSecurity.com have
Why Companies are Integrating DAM & Online Proofing
Why Companies are Integrating DAM & Online Proofing DAM There are a growing number of organizations who have or are planning to integrate their Digital Asset Management (DAM) system with an Online Proofing
UW Connect Update & Incident Management Overview
UW Connect Update & Incident Management Overview Mary Mulvihill, Service Management Office Mike Houlihan, Process Owner Service Management Board Meeting May 19, 2014 Outline UW Connect implementation update
Software Development Lifecycle. Steve Macbeth Group Program Manager Search Technology Center Microsoft Research Asia
Software Development Lifecycle Steve Macbeth Group Program Manager Search Technology Center Microsoft Research Asia About Me Currently manage a team of 10 Program Managers at Microsoft Research Asia Over
Kayako 4.0 Helpdesk Upgrade Questionnaire Form 1: Users. https://kayako-test.cv.nrao.edu/
Kayako 4.0 Helpdesk Upgrade Questionnaire Form 1: Users NAME ROLE: USER To submit helpdesk tickets you can access the helpdesk directly at: https://kayako-test.cv.nrao.edu/ NOTE: Due diligence needs to
How to Exercise a Business Continuity Plan (BCP)
How to Exercise a Business Continuity Plan (BCP) This document provides a step by step guide to exercising a Business Continuity Plan (BCP). The exercise of a BCP should not be undertaken in isolation,
Beta UX DistributionMaster
Beta UX DistributionMaster High-Performance Output Management System for Unix Platforms Centralized administration and distribution of documents throughout the company regardless of the originating platform,
Re-thinking IT End User Support A simple, clear and compelling End User support strategy for the future
Mark Bennett 25 th November 2015 Re-thinking IT End User Support A simple, clear and compelling End User support strategy for the future Rethinking IT Support IT Care Leadership & Culture IT Care Self
SQL Azure and SqlBulkCopy
SQL Azure and SqlBulkCopy Presented by Herve Roggero Managing Partner, Blue Syntax Consulting SQL Azure MVP Email: [email protected] Twitter: @hroggero LinkedIn: SQL Azure and SQL Server Security
4. Exercise: Developing CERT Infrastructure 4.1 GENERAL DESCRIPTION 4.2 EXERCISE COURSE. 4.3 Introduction to the exercise. CERT Exercises Handbook
29 29 4. Exercise: Developing CERT Infrastructure Main Objective Targeted Audience Total Duration To learn what kind of software and hardware solutions could be used to provide a particular CERT service
AUDIT OF INFORMATION TECHNOLOGY Management (Action Plan) Responses February 2005 # PRIORITY DESCRIPTION MANAGEMENT RESPONSE
AUDIT OF INFORMATION TECHNOLOGY Management (Action Plan) Responses February 2005 # PRIORITY DESCRIPTION MANAGEMENT RESPONSE Ref: Chapter 3.1 GOVERNANCE FRAMEWORK Information Technology Steering Committee
Seven Things To Consider When Evaluating Privileged Account Security Solutions
Seven Things To Consider When Evaluating Privileged Account Security Solutions Contents Introduction 1 Seven questions to ask every privileged account security provider 4 1. Is the solution really secure?
Coverity White Paper. Effective Management of Static Analysis Vulnerabilities and Defects
Effective Management of Static Analysis Vulnerabilities and Defects Introduction According to a recent industry study, companies are increasingly expanding their development testing efforts to lower their
Managing Agile Projects in TestTrack GUIDE
Managing Agile Projects in TestTrack GUIDE Table of Contents Introduction...1 Automatic Traceability...2 Setting Up TestTrack for Agile...6 Plan Your Folder Structure... 10 Building Your Product Backlog...
Manual. Ticket Center Manual. Ticket Center 2: 1.0 1.1. May 17, 2013. AdNovum Informatik AG. Released. AdNovum Informatik AG. All rights reserved.
DESCRIPTION: Ticket Center RELEASE: Ticket Center 2: 1.0 DOCUMENT VERSION: 1.1 DATE: May 17, 2013 AUTHORS: AdNovum Informatik AG STATUS: Released AdNovum Informatik AG. All rights reserved. Contents 1
SES / CIF. Internet2 Combined Industry and Research Constituency Meeting April 24, 2012
SES / CIF Internet2 Combined Industry and Research Constituency Meeting April 24, 2012 Doug Pearson Technical Director, REN-ISAC [email protected] Background on REN-ISAC The REN-ISAC mission is to
Data Wrangling: The Elephant in the Room of Big Data. Norman Paton University of Manchester
Data Wrangling: The Elephant in the Room of Big Data Norman Paton University of Manchester Data Wrangling Definitions: a process of iterative data exploration and transformation that enables analysis [1].
Momentum offers you free training, webinars and much more to: help you understand the power of your current LANDESK products
LANDESK Momentum Momentum offers you free training, webinars and much more to: help you understand the power of your current LANDESK products improve your ROI Upcoming Webinars: Visit: www.landesk.com/momentum
A How-to Guide By: Riaan Van Der Merwe, General Manager, Dynamics, Neudesic
Managing Dynamics CRM 2013 Applications from Cradle to Grave A How-to Guide By: Riaan Van Der Merwe, General Manager, Dynamics, Neudesic Table of Contents Introduction...3 Creating the Right Fit...3 Solutions
MANAGEMENT SYSTEM BASED ON OPEN SOURCE TOOLS
10th ICALEPCS Int. Conf. on Accelerator & Large Expt. Physics Control Systems. Geneva, 10-14 Oct 2005, WE3A.4-6O (2005) MANAGEMENT SYSTEM BASED ON OPEN SOURCE TOOLS I. Verstovšek 1, J. Kamenik 1 1Cosylab,
Best Practices for Java Projects Horst Rechner
Best Practices for Java Projects Horst Rechner Abstract: The combination of automated builds with module and integration tests and centralized bug and work tracking using a combination of Eclipse, Mylyn,
Implementing HIPAA into a Compliance Program
Implementing HIPAA into a Compliance Program HCCA Annual Conference April 24, 2002 Kenneth W. Fody, Esq. - Independence Blue Cross Carole A. Klove, RN, JD Deloitte & Touche Agenda Introductions The HIPAA
Free Software Configuration Management (SCM) Is it worth it?
d Free Software Configuration Management (SCM) Is it worth it? Considerations When Comparing Open- Source SCM to Commercial SCM Solutions Authored by: David Kelly and Heather Ashton Upside Research, Inc.
23.9.2015. Kangas Cybersecurity strategy
Kangas Cybersecurity strategy Vision of Kangas Smart Kangas Life and living at Kangas is convenient, easy and safe. Kangas is resource-wise and it is attractive place of work. Security and safety measures
A Process is Not Just a Flowchart (or a BPMN model)
A Process is Not Just a Flowchart (or a BPMN model) The two methods of representing process designs that I see most frequently are process drawings (typically in Microsoft Visio) and BPMN models (and often
The Challenge. Key Challenges at CG Power Systems (Ireland) When Stephen McSharry (Engineering Manager), took over the responsibility
The Challenge Key Challenges at CG Power Systems (Ireland) When Stephen McSharry (Engineering Manager), took over the responsibility of the maintenance department in CG Power Systems Ireland (CG) in 2007,
Real world experiences for CMDB Success
Real world experiences for CMDB Success Gaurav Dutt Uniyal Infosys Technologies Limited The CMDB and CMS - the Powerhouse of Service Management 8 th July 2008 Agenda The present state CMDB implementation
Business Continuity Policy and Business Continuity Management System
Business Continuity Policy and Business Continuity Management System Summary: This policy sets out the structure for ensuring that the PCT has effective Business Continuity Plans in place in order to maintain
Operational Lessons from the RSA/EMC CIRC: People, Process, & Threat Intel
Operational Lessons from the RSA/EMC CIRC: People, Process, & Threat Intel @Ben_Smith Ben Smith, CISSP Field CTO (US East), Security Portfolio A Security Maturity Path CONTROLS COMPLIANCE IT RISK BUSINESS
By default, the Dashboard Search Lists show tickets in all statuses except Closed.
Set Up 1. Login with NetId at http://fpweb.utk.edu 2. The first time you login, you will be asked to run this: 3. Enable Pop ups from FootPrints Creating Searches to Show Active Status Tickets By default,
HTML5 Data Visualization and Manipulation Tool Colorado School of Mines Field Session Summer 2013
HTML5 Data Visualization and Manipulation Tool Colorado School of Mines Field Session Summer 2013 Riley Moses Bri Fidder Jon Lewis Introduction & Product Vision BIMShift is a company that provides all
A White Paper from AccessData Group. Cerberus. Malware Triage and Analysis
A White Paper from AccessData Group Cerberus Malware Triage and Analysis What is Cerberus? Cerberus is the first-ever automated reverse engineering tool designed to show a security analyst precisely what
DATATRAK Customer Case Study
DATATRAK Customer Case Study DATATRAK: A Success Story of Traceability and Process Transparency This case study explores how DATATRAK International, Inc., a company offering software solutions and consulting
Workflow/Business Process Management
1 Workflow/Business Process Management Andy C. Tran Staff Systems Engineer 2 Agenda Business Process Management Overview Demo 3 Generic Case based Work Flow Pattern Case Initiation Case Assessment & Assignment
Graduating CRM Beyond Pipeline Management CRM
Graduating CRM Beyond Pipeline CRM Graduating CRM Beyond Pipeline Graduating CRM Beyond Pipeline So you ve got your CRM deployment running smoothly. Congrats to you! If you re like most of our customers,
How To Use Open Source Software For Library Work
USE OF OPEN SOURCE SOFTWARE AT THE NATIONAL LIBRARY OF AUSTRALIA Reports on Special Subjects ABSTRACT The National Library of Australia has been a long-term user of open source software to support generic
Zoho Projects. Social collaborative project management platform
Zoho Projects is a feature- rich and easy- to- use cloud- based collaborative project management platform for small to medium- sized businesses as well as teams and departments in larger companies. Its
T-MOBILE USES SOCIAL MEDIA ANALYTICS TO BOOST EFFICIENCY
T-MOBILE USES SOCIAL MEDIA ANALYTICS TO BOOST EFFICIENCY The Dutch T-Mobile has been active on social media for almost 5 years now. Initially, their focus was on forums, which have now been accompanied
WORKPLACE SAFETY AND INSURANCE APPEALS TRIBUNAL
2005 ONWSIAT 1489 WORKPLACE SAFETY AND INSURANCE APPEALS TRIBUNAL DECISION NO. 627/05 [1] This appeal was heard in Ottawa on April 1, 2005, by a Tribunal Panel consisting of: B. Alexander: Vice-Chair,
SaaS project development PERSIA, THE APPLICATION FOR RECRUITMENT PROCESSES AUTOMATION. www.persiahr.com
SaaS project development PERSIA, THE APPLICATION FOR RECRUITMENT PROCESSES AUTOMATION www.persiahr.com PROJECT DESCRIPTION Persia is a Web application that automates human resources recruiting processes.