Computer Emergency Response Team CERT Computer Emergency Response Team Mubashir Sargana

OUTLINE CYBER SECURITY CONCEPT OF CERT ACRONYMS HISTORY OF CERT CERTs IN THE WORLD CERT TYPES CERT SERVICES CERT FRAMEWORK ORGANIZATIONAL MODEL CERT: to do list STEPS FOR CREATING A CERT

CYBER SECURITY CIA

CYBER SECURITY Risk Management Approach Security is a Process Risk = Threats + Vulnerabilities Known & Unknown Priorities & Strategies Approach Awareness and Capacity Building Technical Capabilities Security is a Process Up-to-date & Well Aware Preparedness & Readiness

CONCEPT OF CERT A Cybersecurity incident is a violation or imminent threat of violation of cyber security policies, acceptable use policies, or standard security practices. Examples: An attacker commands a botnet to send high volumes of connection requests to a web server, causing it to crash. Users are tricked into opening a “quarterly report” sent via email that is actually malware; running the tool has infected their computers and established connections with an external host. An attacker obtains sensitive data and threatens that the details will be released publicly if the organization does not pay a designated sum of money. (Source: NIST SP800-61Incident Handling Guide)

CONCEPT OF CERT A CERT is an organization or team that provides, to a defined constituency, services and support for both preventing and responding to computer security incidents.

ACRONYMS Various acronyms and titles have been given to CERT organizations over the years. These titles include CSIRT - Computer Security Incident Response Team CSIRC - Computer Security Incident Response Capability or Center CIRC - Computer Incident Response Capability or Center CIRT - Computer Incident Response Team IHT - Incident Handling Team IRC - Incident Response Center or Incident Response Capability IRT - Incident Response Team SERT - Security Emergency Response Team SIRT - Security Incident Response Team

HISTORY OF CERT Brain -The first computer virus was created in 1986 by two brothers from Pakistan. They just wanted to prevent their customers of making illegal software copies.

HISTORY OF CERT Morris is accompanied by his mother, after a day of jury selection in his trial on charges of infiltrating a nationwide computer network in Nov. 1988

HISTORY OF CERT Robert Tappan Morris then student at Cornell University launched on November 2, 1988 from MIT the first and fast self-replicating computer worms via the Internet. Crippled almost 10% (6000) of the computer connected to the Internet in Nov 1988.

CERTs IN THE WORLD

OUR NATIONAL CERT

CERT TYPES There could be some of the following types of CERTs: Regional CERT National CERT GovCERT Military CERT § Police CERT Finance CERT Health CERT Academic CERT ISP CERT Industry CERT

CERT SERVICES

CERT FRAMEWORK Constituency Mission Funding and Cost CERT Authority CERT Organizational Placement Policy and procedures Models and Legal Basis of Cooperation

ORGANIZATIONAL MODELS Security Team Internal Distributed CERT Internal Centralized CERT Combined Distributed & Centralized CERT Coordinating CERT

CERT: to do list Identify Stakeholders and participants Obtain management support and sponsorship Develop a CERT project plan Gather Information Identify the CERT Constituency Defined the CERT mission Secure funding for CERT operations Decide on the range and level of services the CERT will offer Determine the CERT reporting structure, authority and organizational model

CERT: to do list Identify required resources such as staff equipment and infrastructure Define interaction and interfaces Define roles responsibilities and the corresponding authority Document the workflow Develop policies and corresponding procedures Create and implementation plan and solicit feedback Announce the CERT when it becomes operational Define methods for evaluating the performance of the CERT Have a backup plan for every element of the CERT BE FLEXIBL

STEPS FOR CREATING A CERT Steps for Creating a CSIRT Stage 1 – Educate stakeholders about the development of CERT Stage 2 – Plan the CERT Stage 3 – Implement the CERT Stage 4 – Operate the CERT Stage 5 – Collaboration

Your Role?

Email@Mubashir.pk WWW. Mubashir.pk