National Infrastructure Security Co-ordination Centre NISCC – Interdepartmental Organisation. Mission – to help protect Critical National Infrastructure from Electronic Attack – Hacking, DDoS, Viruses, Worms, etc Peter Burnett Head of Information Sharing www.niscc.gov.uk

Home Secretary 1999 “…working with the private sector…to ensure adequate standards of protection for the key systems falling within the critical national infrastructure… raising awareness and standards of information security more generally in the private sector… developing a dialogue with international partners I have established the NISCC to act as a point of contact for those involved in this work in both government and the private sector.”

What is NISCC? NISCC is an interdepartmental centre which co-ordinates activity in support of this aim across a range of organisations. Each of these contributes resources and expertise to NISCC’s programme of work according to its own remit, its own priorities, in relation to the challenge in hand, and depending on what value it can add.

“an Interdepartmental Centre” Security Service Cabinet Office – Civil Contingencies Secretariat (CCS) Communications-Electronics Security Group (CESG) Office of e-Envoy CSIA DSTL (ex DERA) Department of Trade & Industry (DTI) National Hi-Tech Crime Unit (NHTCU) Ministry of Defence Home Office

What is the CNI? Those parts of the United Kingdom’s infrastructure for which continuity is so important to national life that loss, significant interruption or degradation of service would have life-threatening, serious economic or other grave social consequences for the community, or would otherwise be of immediate concern to the Government. NISCC’s aim is to minimise the risk to the critical national infrastructure from electronic attack.

The CNI Sectors Telecommunications Energy Finance Central Government Water and Sewerage Health Services Emergency Services Transport Hazards Food

INFORMATION SHARING NISCC Functional Model Investigating and Assessing the threat of eA Promoting Protection and Assurance Vulnerabilities Exploits Responding to incidents Critical National Infrastructure Research and Development/ Policy/ Mapping INFORMATION SHARING

NISCC – Information Sharing Strategic Objectives Increase IT Security Awareness, Education : Healthier e-environment (reduce Viruses, Worms, Trojans, DDoS etc) Provide useful and timely warnings Gather IT security incident reports Crime reports (only with consent) Statistics, Trends, Threat assessment Attack detection

Information Sharing UK CERTs forum Encouraging new CERTs in UK Encouraging Information Sharing Bodies Reporting System (NHTCU/NISCC) National Warning System Partnership arrangements Symantec, Microsoft Conceive & establish Information Exchanges Finance, Telecomms, SCADA, MSPs Conceive & promote WARPs Warning, Advice & Reporting Points

Local authority, trade association, interest group, industry sector The WARP model CERTs, WARPs, etc WARP This is roughly how a WARP could work – first identify a community. This community might be a regional group of SMEs who already cooperate under a Business Llink scheme for example, or a group with special requirements not served well by commercial services, e.g. partially-sighted users, a group of schools, educational consultants, a group of banks, or any group of businesses or individuals that have some common concerns, or a specialised requirement for software or hardware. A WARP for all local authorities is one clear community. A single local or regional authority may then wish to extend this concept down to its own community to encourage safe use of IT right down to the home user, for the benefit of local e-government. There is scope for a lot of research required to establish the best models for different sectors, but there is also a need for action today. There is a lot of work out there to draw upon from the ISACs and CERTs, and UNIRAS is willing to help any new WARPs to get established. The WARP would be linked into a network of other WARPs, CERTs, ISACs possibly, security research centres, CIP organisations perhaps, any European Warning and Information Sharing system. Incident Reports Problems Warnings Advice e-COMMUNITY Local authority, trade association, interest group, industry sector

The WARP Model - Functions NISCC – Information Sharing The WARP Model - Functions Issue Warnings to its community Provide Advice on Internet problems & share Good Practice amongst members Gather, sanitise, and share Incident Reports This is the model we conceived to do it. Very much like a CERT, but with different responsibilities, level of resourcing, skill sets, and especially, very low-cost. 3 key activities, which will develop roughly in this order.

WARP for London Boroughs (www.lcwarp.org) LondonConnects WARP London Borough A London Borough C etc. London Borough B Future ‘LA’ WARPs CERTs Bugtraq UNIRAS 33 London Boroughs NISCC CSIRTs Sans Other Secure system with fallback contingency Authorised users in each Borough Secure links Secure link Supported by SOCITM, OeE & NISCC 1 Technical FTE 1 Admin.

The WARP TOOLBOX Toolbox Business Cases Security Policy Filtered Warning & Alerting System (FWAS) Tick-List Software Good Practice & Advice Brokering Service (GPABS) Bulletin Board Reporting and Trusted Sharing Service (RTSS) Business Cases Security Policy Commercial sponsorship Independent Study

A Shared Solution WARP WARP Warnings Advice Problems e-COMMUNITY Open Sources, CERTs WARP WARP Problems Warnings Advice This is roughly how a WARP could work – first identify a community. This community might be a regional group of SMEs who already cooperate under a Business Llink scheme for example, or a group with special requirements not served well by commercial services, e.g. partially-sighted users, a group of schools, educational consultants, a group of banks, or any group of businesses or individuals that have some common concerns, or a specialised requirement for software or hardware. A WARP for all local authorities is one clear community. A single local or regional authority may then wish to extend this concept down to its own community to encourage safe use of IT right down to the home user, for the benefit of local e-government. There is scope for a lot of research required to establish the best models for different sectors, but there is also a need for action today. There is a lot of work out there to draw upon from the ISACs and CERTs, and UNIRAS is willing to help any new WARPs to get established. The WARP would be linked into a network of other WARPs, CERTs, ISACs possibly, security research centres, CIP organisations perhaps, any European Warning and Information Sharing system. Filter Prioritise Supplement Add Value Incident Reports Good Practice Solutions Skills e-COMMUNITY e-COMMUNITY Experience, Expertise, Solutions

Kent Gets its Own WARP

Thank You for listening patiently

Contact me on 020 7821 1330 ext 4508 peterb@niscc.gov.uk QUESTIONS ? Contact me on 020 7821 1330 ext 4508 peterb@niscc.gov.uk