1. 1  Carnegie Mellon University Overview of the CERT/CC and the Survivable Systems Initiative Andrew P. Moore apm@cert.org CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213 Sponsored by the U.S. Department of Defense

2. 2  Carnegie Mellon University *FFRDC - Federally Funded Research and Development Center

3. 3  Carnegie Mellon University Talk Overview CERT Coordination Center Survivable Systems Initiative Intrusion-Aware Design and Analysis

4. 4  Carnegie Mellon University CERT Coordination Center

5. The Beginning of the CERT/CC

6. 6  Carnegie Mellon University CERT/CC Mission Respond to security emergencies on the Internet Serve as a focal point for reporting security vulnerabilities and incidents Raise awareness of security issues Serve as a model to help others establish incident response teams

7. 7  Carnegie Mellon University CERT/CC Principles Provide valued services -proactive as well as reactive Ensure confidentiality and impartiality -we do not identify victims but can pass information anonymously and describe activity without attribution -unbiased source of trusted information Coordinate with other organisations and experts -academic, government, corporate -distributed model for incident response teams (coordination and cooperation, not control) Principles

8. 8  Carnegie Mellon University CERT Coordination Center Teams

9. 9  Carnegie Mellon University CERT Vulnerability Handling & Analysis Receives vulnerability reports - forms, email, phone calls Verifies and analyzes reports/artifacts - veracity, scope, magnitude, exploitation Works with vulnerability reporters, vendors, experts - understanding and countermeasures Publicizes information about vulnerabilities and countermeasures - vulnerability notes, advisories

10. 10  Carnegie Mellon University CERT Incident Handling & Response Receives reports related to computer security from Internet sites - break-ins, service denial, probes, attempts Provides 24-hr. emergency incident response Analyses report and provides feedback to reporting sites involved - attack method, scope, magnitude, correlation, response Informs Internet community - incident notes, summaries, advisories - assist formation and development of CSIRTs

11. 11  Carnegie Mellon University Recent CERT/CC Experiences 199719981999 2000 2001 3,285 4,9429,859 21,756 52,658 Incidents Handled 3,285 4,9429,859 21,756 52,658 196262 417 1,090 2,437 Vulnerabilities reported 196262 417 1,090 2,437 38,40631,93334,612 56,365 118,907 Email msgs processed 38,40631,93334,612 56,365 118,907 CERT Advisories, Vendor 443420 69 363 Bulletins, and Vul Notes 443420 69 363 CERT Summaries and 61513 14 19 Incident Notes 61513 14 19

12. 19901991199219931994199519961997199819992000 hijacking sessions sniffers packet spoofing GUI intruder tools automated widespread attacks widespread denial-of- service attacks "stealth"/ advanced scanning techniques email propagation of malicious code distributed attack tools distributed denial-of- service tools executable code attacks (against browsers) Attack Sophistication vs. Required Intruder Knowledge widespread attacks on DNS infrastructure increase in wide- scale Trojan horse distribution automated probes/ scans Internet social engineering attacks techniques to analyze code for vuls without source widespread attacks using NNTP to distribute attack windows-based remote controllable Trojans (back orifice) Sophistication of attacks Intruder knowledge needed to execute attacks dates indicate major release of tools or widespread use of a type of attack