Tom Barton (WG Chair) University of Chicago and Internet2 SIRTFI WG Update Tom Barton (WG Chair) University of Chicago and Internet2

SIRTFI - security incident response trust framework for federated identity Be willing to collaborate in responding to a federated security incident. Apply basic operational security protections to your federated entities in line with your organization’s priorities. Self-assert SIRTFI “tag” so that others will know to trust this about you.

Overall arc of work1 Sirtfi v1.0 and related Done Establish means to indicate compliance and how to contact Define roles and responsibilities of the various parties in managing federated security incidents, information sharing guidelines, tools, procedures, and templates In process Establish means for proactive notification of an account compromise when it can be expected to produce a substantial impact to an at-risk SP organisation Queued [1] https://wiki.refeds.org/display/GROUPS/SIRTFI

Current deliverables Incident Response in R&E Federations Handbook intended to minimise time to mount an effective response to an incident increase sharing of useful non-confidential info Per-role documents Provide people with the details they need when they need it, material from the handbook by role Template IR policies for fed operators Give federations (& other orgs?) a starting point if they need it SIRTFI website Where to go for everything IR in R&E Feds

Incident Response for R&E Federations: Outline Intro What Triggers an Incident Response? Stages of Federated Incident Response On-Going Preparatory Activities Handling the “Something’s Odd” Report and Opening an Incident Adding New Members to the IR Team Identify, Contain, and Eradicate Recovery Incident Wrap-Up Table of All Roles and All Responsibilities Appendices (sharing guidelines, templates, preparation guides)

Incident Response Team Support Organisation An actual organisation is needed to anchor Fed IR processes, pay license costs, provide support staffing: Maintain readiness of IR Team collaboration tools Secure chat Secure file drop On-board persons to an IR Team Coordination of “Something’s Odd” report and opening an incident Incident coordinator, or identify each incident’s coordinator Maintain SIRTFI website Queued: possible role in implementing proactive notification

Related activities Sirtfi+ Registry incubation GÉANT-developed security contact checking tool InCommon POC for keeping security contacts fresh eduGAIN security team Security Communications Challenge Coordination Joint Working Group WISE, SIG-ISM, IGTF, REFEDS, anyone who wants to pitch in Any others, besides SIRTFI? Established sharing and response centers: REN-ISAC, CSIRTs, ...