REN-ISAC Research and Education Networking Information Sharing and Analysis Center Doug Pearson REN-ISAC Director Internet2 Security WG BoF October 14, 2003

ISAC Intro Information Sharing and Analysis Centers (ISACs) are a cooperation of critical sector private and public entities with the U.S. Department of Homeland Security (DHS) to facilitate the sharing of information and collaboration to protect against threat. Example critical sector ISACs include Food Industry, Water, Emergency Services, IT, Electric Power, Gas, etc.

REN-ISAC The REN-ISAC (Research and Education Networking Information Sharing and Analysis Center) supports U.S. higher education and research communities by providing advanced network security services, and supports efforts to protect the national cyber infrastructure by participating in the U.S. ISAC infrastructure. The REN-ISAC supports all of higher education – is not Internet Abilene-specific.

REN-ISAC Information Base The REN-ISAC utilizes information derived from its constituents, network engineers, network instrumentation, other ISACs, and the DHS. And, shares information in that community.

Use of Abilene NetFlow Data Through relation with Internet2 and the Indiana University Abilene NOC, the REN-ISAC has a view of Abilene NetFlow data. In conjunction with the IU Advanced Network Management Lab the NetFlow data is used to characterize general network security threat activity, and to identify specific critical threats. Custom analysis, and confidential reporting –/21s. Should we move to /24? Arbor Networks Peakflow

Policy REN-ISAC is working with Internet2 to develop a policy for how the NetFlow data can be used Highlights: –Publicly reported information is restricted to aggregate views of the network. Information that identifies specific institutions or individuals cannot be reported publicly. –Sensitive information must be communicated with designated representatives of the affected institutions and refer only to local activity, unless otherwise authorized.

Registry To include all of higher education, Abilene- connected institutions are the launching pad. Primary registrant is the CIO, IT Security Officer, or equivalent. Delegates (including 24x7) and Observers. Related information to serve network security management and response, e.g. address blocks, domains, network agreements (e.g. Abilene, NLR), etc.

Past Activities Blaster –Identified top sourcing institutions of MS RPC scanning on Abilene and sent to representatives of those institutions describing their relative position as a source, /21s involved, and mitigation techniques. Nachi –Characterized the overall level of ICMP on Abilene and pointed to mitigation techniques

Relationships Internet2 EDUCAUSE EDUCAUSE/Internet2 Security Task Force IU Abilene NOC IU Advanced Network Management Lab DHS

Questions In what ways can the REN-ISAC benefit the community? Policy considerations? The relationship of privacy and security. Development of the registry, contact, procedure and policy.