1. PIONIER CERT Tomasz Nowocien Poznan Supercomputing and Networking Center PIONIER-CERT team address: ul. Noskowskiego 10 61-704 Poznan,POLAND phone: (+48 61) 8582066 e-mail: nowocien@man.poznan.pl

2. What is it about? ● PIONIER net ● PIONIER-CERT team ● DIHS by PIONIER-CERT – Whatfor? – How? – Why?

3. PIONIER

4. ● 21 MANs ● Internet access for: – Univesities – Libraries – Science intitutes – Supercomputing Centres

5. PIONIER connections ● GEANT (10Gb/s) ● Telia Sonera Internet - Hamburg and Warsaw (2.5Gb/s) ● Own fibres connections to nets in Germany and Czech Republic ● Connections to other ISPs: TELBANK, IPartners, NETIA, ProFuturo, ICPNet, ATMAN, DIALOG, ENERGIS

6. PIONIER-CERT ● Established in 2001 (POL34-CERT) ● 5 person in Poznan ● Additional person(s) in MANs. ● Main activity: Incident handling

7. PIONIER-CERT: Incident Handling ● determining the initial cause of the incident ● facilitating contact with other sites which may be involved ● facilitating contact with sec. teams/ law enforcement officials ● making reports to other CSIRTs ● composing announcements to users ● collecting statistics

8. PIONIER-CERT incidents ● Over 1100 reports a month ● Over 90% - SPAM ● Other: SCAN,Viruses,Copyright... ● Sometimes interaction to Polisch Police

9. PIONIER-CERT DIHS ● Distributed Incident Handling System

10. PIONIER-CERT DIHS

11. DIHS - Report Collector ● Role: – Collects reports from users – informs users about incident handling statusu ● Report chanels: – Web form – e-mail

12. DIHS - Report Collector

13. DIHS - Report Qualifier ● verifies reports ● qualifies reports

14. DIHS - Report Qualifier

16. DIHS - Incident Handler ● Distributed ● Documents all incident handling actions ● Gives insight view into incident handling history ● Drives through handling process according to procedures ● Helps to supervise incident handling process

17. DIHS - Incident Handler

21. DIHS – Incident Handler

22. Webpages ● Pages – http://www.pionier.gov.pl – http://noc.pionier.gov.pl – http://cert.pionier.gov.pl ● Reporting: – http://cert.pionier.gov.pl -> – http://reports.cert.pionier.gov.pl

23. Thank You :-)