PIONIER CERT Tomasz Nowocien Poznan Supercomputing and Networking Center PIONIER-CERT team address: ul. Noskowskiego Poznan,POLAND phone: (+48 61)

What is it about? ● PIONIER net ● PIONIER-CERT team ● DIHS by PIONIER-CERT – Whatfor? – How? – Why?

PIONIER

● 21 MANs ● Internet access for: – Univesities – Libraries – Science intitutes – Supercomputing Centres

PIONIER connections ● GEANT (10Gb/s) ● Telia Sonera Internet - Hamburg and Warsaw (2.5Gb/s) ● Own fibres connections to nets in Germany and Czech Republic ● Connections to other ISPs: TELBANK, IPartners, NETIA, ProFuturo, ICPNet, ATMAN, DIALOG, ENERGIS

PIONIER-CERT ● Established in 2001 (POL34-CERT) ● 5 person in Poznan ● Additional person(s) in MANs. ● Main activity: Incident handling

PIONIER-CERT: Incident Handling ● determining the initial cause of the incident ● facilitating contact with other sites which may be involved ● facilitating contact with sec. teams/ law enforcement officials ● making reports to other CSIRTs ● composing announcements to users ● collecting statistics

PIONIER-CERT incidents ● Over 1100 reports a month ● Over 90% - SPAM ● Other: SCAN,Viruses,Copyright... ● Sometimes interaction to Polisch Police

PIONIER-CERT DIHS ● Distributed Incident Handling System

PIONIER-CERT DIHS

DIHS - Report Collector ● Role: – Collects reports from users – informs users about incident handling statusu ● Report chanels: – Web form –

DIHS - Report Collector

DIHS - Report Qualifier ● verifies reports ● qualifies reports

DIHS - Report Qualifier

DIHS - Incident Handler ● Distributed ● Documents all incident handling actions ● Gives insight view into incident handling history ● Drives through handling process according to procedures ● Helps to supervise incident handling process

DIHS - Incident Handler

DIHS – Incident Handler

Webpages ● Pages – – – ● Reporting: – -> –

Thank You :-)