SlideShare a Scribd company logo

Assessing cybersecurity_Anto Veldre

•
•
E-Government Center Moldova
E-Government Center Moldova
1 of 40
Assessing cybersecurity in a modern State of digital era Anto Veldre Information Security Expert CERT-EE Estonian Information System Authority
Tallinn, Estonia
Milk & gasoline ... http://y.delfi.ee/norm/102149/4987007_FZJEkH.jpeg
The lifestyle http://upload.wikimedia.org/wikipedia/commons/0/03/Kakerdaja_raba.jpg
State Information System Authority (www.ria.ee)
Abbreviations CERT - Computer Emergency Response Team CSIRT - Computer Security Incident Response Team
CERT typology Types: - national - govermental - ISP, company, etc - university CERT-EE – nat/gov, dual consistuency (.EE, ASxxxx) Compare to our neighbours - www.ficora.fi Keyword to remember – the constituency - кому работаешь?
State Information System Authority (1)
State Information System Authority (2)
State Information System Authority (3)
http://liesma.deviantart.com/art/organized-chaos- 160240663
Basic categories for inventarization (an analogy - phone numbers)  IP addresses (like 217.26.147.31)  Netblocks (like 217.26.147.0/24) Autonomous Systems (AS28990)  Domain Names (DNS) like www.xyz.md
Estonian Autonomous Systems?
Inventory - basics
Our Lego Objects we care - Timestamp - (category – virus, break-in, DDoS, defacement, SSH doorknock) - IP - FQDN – fully qualified domain name - URL (http://www.somewhat.md/infection.exe - An executable (.exe) - MD5("The quick brown fox jumps over the lazy dog") = 9e107d9d372bb6826bd81d3542a419d6
Important considerations Main equations - technical control != content control - IP address as private data? == a trap
Where to find information? Passive DNS Netflow statistics Listening to the Ethernet directly Webproxy logs, Statistics, hostcount ... ... These are standard tools present in router OS's. Intel exchange with partners. Honeypots.
Freedom on the Internet Candidate information to be censored: tax motivated sites "bad" information: - abortion - pr0n, CP - violence "extremism" - incl religious - device design blueprints, incl. (c)
Freedom of information methods of control - surveillance - filtering out (DNS or action based) - redirection - intrusion - combined It is extremely important to watershed between: - Technical Monitoring (for viruses, for CNC IP) - Content monitoring (for the word „terrorist“)
CERT: RFC2350 Constituency Clients Authority, legal possibilities Contacts, security level, pledges Service library Assisting in ... Solving … Publishing advisories, reports …
CERT vs LEO • CERT and the community Trusted communities Data feeds • CERT vs intel Technical – IP, FQDN, ASN (vs content) A nightman job – plumbing and pipes - ассенизаторская работа
Philosophy behind the CERT • Technical intelligence is the foundation for any CERT • Event vs incident. Ticketing. 15 min rule vs reporting&statistics needs • Reporting earning our salary People are the heart of a CERT
Philosophy behind the CERT (2) • Standard secrecy on the input Takes time to declassify Enables LEO and mil contacts • Mobile threats Cloud Automated authentication, joint IDs
Incidents (1) * DDoS (2007 and further) * malware - Zeus/SpyEye , Sinowal etc - drive-by infections - forum poisoning - false positive on svchost.exe - phishing letter from E-bay - tax related mail accounts
Incidents (2) - e-mail offending the President - intrusion somewhere (a registrar, a webhoster) - authentication library on “a system“ - an APT ( = Advanced Persistent Threat) - Tasmanian BGP → core network routers down - anchor related incidents (Baltic Sea)
Incidents (3) - domain related incidents - assessing technology incidents (RSA, DN, ID) - comments on public and PR incidents (firesheep) - testimonies at the court (Allaple) - lecturing (at universities, schools …) - i-voting tech support
What we do not do (but sometimes we could intermediate) - assist private persons (but sometimes ...) - repairing somebody's installation - copyright enforcement - filtering - content intelligence - pr0n, CP handling
People Seven (7) • Qualifications: - HelpDesk capability - network admin - programmer, coder - teacher, lecturer - CIO or CISO or CISA - system analyst - technical writer
Duties - contact point - consultancy - incident handling - input to legislators - advisories on threats - bringing people together - reporting - awareness raising - http://vimeo.com/22067817 - alerting
Systems • Mostly free software • Linux/BSD • FireShark, tcpdump, ... • AbuseHelper (see bitbucket, ClarifiedNetworks) • S4A (Snort for all) • VSR – Virtual Situation Room, (see bb, C)
Trusted Introducer
Back to CyberSec
CIIP Critical Information Infrastructure Protection • 2 whales: Communication & Energy • The Emergency Law: Vital Services – 43 fields - PVS - Provider of (a) vital service - IOCO - The Institution Organizing the Continuous Operation (of vital services) - CI - Co-ordinating Institution (in charge to contain and resolve the emergency) http://valitsus.ee/en/government-office/government-communication/handbook/crisis-communication http://ee.vlex.com/vid/emergency-act-siseministeeriumi- 204964755
CIIP workflow Define vital (critical) areas Analyze dependencies - foundation: energy and communications - ICT - other, not directly related to ICT Define or list vital providers Communicate, analyze
SCADA http://www.parijat.com/scadaproduct/images/MunicipalSCADA-2.jpg
Telco • Vital providers in telco field: - 420 of these in entrepeneurs DB - 3-4-5 large ones - by the definition * has an interchange point
Supervision Dept - ISKE - (IT Grundschutz by BSI, .de) Information Systems Three Level Security Baseline - Incident reports, CERT-EE Incidents DB - Compliance Problems / deficiencies noted by CERT or CIIP https://www.bsi.bund.de/ContentBSI/Aktuelles/Veranstaltungen/gstag/gstag_201010.html
Thank You! Anto Veldre www.ria.ee | anto.veldre@cert.ee | +372 663 0200 Estonian Information System's Authority | Rävala 5, 10112 Tallinn, Estonia

Recommended

Case study on Physical devices used in Computer forensics.
Case study on Physical devices used in Computer forensics.Case study on Physical devices used in Computer forensics.
Case study on Physical devices used in Computer forensics.Vishal Tandel
 
File000119
File000119File000119
File000119Desmond Devendran
 
IOT Forensic Challenges
IOT Forensic ChallengesIOT Forensic Challenges
IOT Forensic ChallengesAnukaJinadasa
 
Cybersecurity Critical Infrastructure Framework Course Textbook and the class...
Cybersecurity Critical Infrastructure Framework Course Textbook and the class...Cybersecurity Critical Infrastructure Framework Course Textbook and the class...
Cybersecurity Critical Infrastructure Framework Course Textbook and the class...AVEVA
 
FORENSIC COMPUTING MODELS: TECHNICAL OVERVIEW
FORENSIC COMPUTING MODELS: TECHNICAL OVERVIEWFORENSIC COMPUTING MODELS: TECHNICAL OVERVIEW
FORENSIC COMPUTING MODELS: TECHNICAL OVERVIEWcscpconf
 
Cyber Forensics Overview
Cyber Forensics OverviewCyber Forensics Overview
Cyber Forensics OverviewYansi Keim
 
Data Safety And Security
Data Safety And SecurityData Safety And Security
Data Safety And SecurityConstantine Karbaliotis
 
Sb securing-industrial-control-systems-with-fortinet
Sb securing-industrial-control-systems-with-fortinetSb securing-industrial-control-systems-with-fortinet
Sb securing-industrial-control-systems-with-fortinetIvan Carmona
 

Recommended

Case study on Physical devices used in Computer forensics.
Case study on Physical devices used in Computer forensics.Case study on Physical devices used in Computer forensics.
Case study on Physical devices used in Computer forensics.Vishal Tandel
 
File000119
File000119File000119
File000119Desmond Devendran
 
IOT Forensic Challenges
IOT Forensic ChallengesIOT Forensic Challenges
IOT Forensic ChallengesAnukaJinadasa
 
Cybersecurity Critical Infrastructure Framework Course Textbook and the class...
Cybersecurity Critical Infrastructure Framework Course Textbook and the class...Cybersecurity Critical Infrastructure Framework Course Textbook and the class...
Cybersecurity Critical Infrastructure Framework Course Textbook and the class...AVEVA
 
FORENSIC COMPUTING MODELS: TECHNICAL OVERVIEW
FORENSIC COMPUTING MODELS: TECHNICAL OVERVIEWFORENSIC COMPUTING MODELS: TECHNICAL OVERVIEW
FORENSIC COMPUTING MODELS: TECHNICAL OVERVIEWcscpconf
 
Cyber Forensics Overview
Cyber Forensics OverviewCyber Forensics Overview
Cyber Forensics OverviewYansi Keim
 
Data Safety And Security
Data Safety And SecurityData Safety And Security
Data Safety And SecurityConstantine Karbaliotis
 
Sb securing-industrial-control-systems-with-fortinet
Sb securing-industrial-control-systems-with-fortinetSb securing-industrial-control-systems-with-fortinet
Sb securing-industrial-control-systems-with-fortinetIvan Carmona
 
DocomUSA Cyber Security
DocomUSA Cyber SecurityDocomUSA Cyber Security
DocomUSA Cyber Securitydocomusa
 
Network Security Architecture
Network Security Architecture Network Security Architecture
Network Security Architecture InnoTech
 
cyber forensics
cyber forensicscyber forensics
cyber forensicsAmbuj Kumar
 
CiNPA Security SIG - Physical Security
CiNPA Security SIG - Physical SecurityCiNPA Security SIG - Physical Security
CiNPA Security SIG - Physical SecurityThreatReel Podcast
 
2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)
2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)
2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)Andris Soroka
 
Cybersecurity: Malware & Protecting Your Business From Cyberthreats
Cybersecurity: Malware & Protecting Your Business From CyberthreatsCybersecurity: Malware & Protecting Your Business From Cyberthreats
Cybersecurity: Malware & Protecting Your Business From CyberthreatsSecureDocs
 
Extracting and Decoding Smartphone and Tablet Evidence with the UFED Series: ...
Extracting and Decoding Smartphone and Tablet Evidence with the UFED Series: ...Extracting and Decoding Smartphone and Tablet Evidence with the UFED Series: ...
Extracting and Decoding Smartphone and Tablet Evidence with the UFED Series: ...Cellebrite
 
Tyler Technology Expo
Tyler Technology ExpoTyler Technology Expo
Tyler Technology ExpoTony DeGonia (LION)
 
File000114
File000114File000114
File000114Desmond Devendran
 
Analytical survey of active intrusion detection techniques in mobile ad hoc n...
Analytical survey of active intrusion detection techniques in mobile ad hoc n...Analytical survey of active intrusion detection techniques in mobile ad hoc n...
Analytical survey of active intrusion detection techniques in mobile ad hoc n...eSAT Publishing House
 
Business Intelligence (BI) Tools For Computer Forensic
Business Intelligence (BI) Tools For Computer ForensicBusiness Intelligence (BI) Tools For Computer Forensic
Business Intelligence (BI) Tools For Computer ForensicDhiren Gala
 
Cyber forensic readiness cybercon2012 adv j fick
Cyber forensic readiness cybercon2012 adv j fickCyber forensic readiness cybercon2012 adv j fick
Cyber forensic readiness cybercon2012 adv j fickJacqueline Fick
 
VMI based malware detection in virtual environment
VMI based malware detection in virtual environmentVMI based malware detection in virtual environment
VMI based malware detection in virtual environmentAyush Gargya
 
Introduction to security
Introduction to securityIntroduction to security
Introduction to securityMukesh Chinta
 
SEC440: Incident Response Plan
SEC440: Incident Response PlanSEC440: Incident Response Plan
SEC440: Incident Response PlanThomas Christopher Ty
 
Cyber incident response or how to avoid long hours of testimony
Cyber incident response or how to avoid long hours of testimony Cyber incident response or how to avoid long hours of testimony
Cyber incident response or how to avoid long hours of testimony David Sweigert
 
Cisco SAFE_Wireless LAN Security in Depth v2
Cisco SAFE_Wireless LAN Security in Depth v2Cisco SAFE_Wireless LAN Security in Depth v2
Cisco SAFE_Wireless LAN Security in Depth v2LinkedIn
 
Jure Sustersic Monetization through Ovi Services
Jure Sustersic Monetization through Ovi ServicesJure Sustersic Monetization through Ovi Services
Jure Sustersic Monetization through Ovi ServicesNokiaAppForum
 
CARTA RECONOCIMIENTO ABBOTT-SEVORANE
CARTA RECONOCIMIENTO ABBOTT-SEVORANECARTA RECONOCIMIENTO ABBOTT-SEVORANE
CARTA RECONOCIMIENTO ABBOTT-SEVORANEJulio Gabriel Rico Arreola
 
ELABORAR UN BANQUITO ADAPTADO ACCESIBLE DE CARTÓN Y PAPEL RECICLADO APT
ELABORAR UN BANQUITO ADAPTADO ACCESIBLE DE CARTÓN Y PAPEL RECICLADO APTELABORAR UN BANQUITO ADAPTADO ACCESIBLE DE CARTÓN Y PAPEL RECICLADO APT
ELABORAR UN BANQUITO ADAPTADO ACCESIBLE DE CARTÓN Y PAPEL RECICLADO APTFelipe Accesibilidad
 
Hazazi CV2 Updated 2015
Hazazi CV2 Updated 2015Hazazi CV2 Updated 2015
Hazazi CV2 Updated 2015Mohammad Hazazi
 
Advertising and Printing Solution By Vibgyor Creations, Chennai
Advertising and Printing Solution By Vibgyor Creations, Chennai Advertising and Printing Solution By Vibgyor Creations, Chennai
Advertising and Printing Solution By Vibgyor Creations, Chennai IndiaMART InterMESH Limited
 

More Related Content

What's hot

DocomUSA Cyber Security
DocomUSA Cyber SecurityDocomUSA Cyber Security
DocomUSA Cyber Securitydocomusa
 
Network Security Architecture
Network Security Architecture Network Security Architecture
Network Security Architecture InnoTech
 
CiNPA Security SIG - Physical Security
CiNPA Security SIG - Physical SecurityCiNPA Security SIG - Physical Security
CiNPA Security SIG - Physical SecurityThreatReel Podcast
 
2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)
2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)
2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)Andris Soroka
 
Cybersecurity: Malware & Protecting Your Business From Cyberthreats
Cybersecurity: Malware & Protecting Your Business From CyberthreatsCybersecurity: Malware & Protecting Your Business From Cyberthreats
Cybersecurity: Malware & Protecting Your Business From CyberthreatsSecureDocs
 
Extracting and Decoding Smartphone and Tablet Evidence with the UFED Series: ...
Extracting and Decoding Smartphone and Tablet Evidence with the UFED Series: ...Extracting and Decoding Smartphone and Tablet Evidence with the UFED Series: ...
Extracting and Decoding Smartphone and Tablet Evidence with the UFED Series: ...Cellebrite
 
Analytical survey of active intrusion detection techniques in mobile ad hoc n...
Analytical survey of active intrusion detection techniques in mobile ad hoc n...Analytical survey of active intrusion detection techniques in mobile ad hoc n...
Analytical survey of active intrusion detection techniques in mobile ad hoc n...eSAT Publishing House
 
Business Intelligence (BI) Tools For Computer Forensic
Business Intelligence (BI) Tools For Computer ForensicBusiness Intelligence (BI) Tools For Computer Forensic
Business Intelligence (BI) Tools For Computer ForensicDhiren Gala
 
Cyber forensic readiness cybercon2012 adv j fick
Cyber forensic readiness cybercon2012 adv j fickCyber forensic readiness cybercon2012 adv j fick
Cyber forensic readiness cybercon2012 adv j fickJacqueline Fick
 
VMI based malware detection in virtual environment
VMI based malware detection in virtual environmentVMI based malware detection in virtual environment
VMI based malware detection in virtual environmentAyush Gargya
 
Introduction to security
Introduction to securityIntroduction to security
Introduction to securityMukesh Chinta
 
Cyber incident response or how to avoid long hours of testimony
Cyber incident response or how to avoid long hours of testimony Cyber incident response or how to avoid long hours of testimony
Cyber incident response or how to avoid long hours of testimony David Sweigert
 
Cisco SAFE_Wireless LAN Security in Depth v2
Cisco SAFE_Wireless LAN Security in Depth v2Cisco SAFE_Wireless LAN Security in Depth v2
Cisco SAFE_Wireless LAN Security in Depth v2LinkedIn
 

What's hot (17)

DocomUSA Cyber Security
DocomUSA Cyber SecurityDocomUSA Cyber Security
DocomUSA Cyber Security
 
Network Security Architecture
Network Security Architecture Network Security Architecture
Network Security Architecture
 
cyber forensics
cyber forensicscyber forensics
cyber forensics
 
CiNPA Security SIG - Physical Security
CiNPA Security SIG - Physical SecurityCiNPA Security SIG - Physical Security
CiNPA Security SIG - Physical Security
 
2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)
2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)
2015 Cyber security solutions vs cyber criminals @WOHIT2015 (EU eHealth week)
 
Cybersecurity: Malware & Protecting Your Business From Cyberthreats
Cybersecurity: Malware & Protecting Your Business From CyberthreatsCybersecurity: Malware & Protecting Your Business From Cyberthreats
Cybersecurity: Malware & Protecting Your Business From Cyberthreats
 
Extracting and Decoding Smartphone and Tablet Evidence with the UFED Series: ...
Extracting and Decoding Smartphone and Tablet Evidence with the UFED Series: ...Extracting and Decoding Smartphone and Tablet Evidence with the UFED Series: ...
Extracting and Decoding Smartphone and Tablet Evidence with the UFED Series: ...
 
Tyler Technology Expo
Tyler Technology ExpoTyler Technology Expo
Tyler Technology Expo
 
File000114
File000114File000114
File000114
 
Analytical survey of active intrusion detection techniques in mobile ad hoc n...
Analytical survey of active intrusion detection techniques in mobile ad hoc n...Analytical survey of active intrusion detection techniques in mobile ad hoc n...
Analytical survey of active intrusion detection techniques in mobile ad hoc n...
 
Business Intelligence (BI) Tools For Computer Forensic
Business Intelligence (BI) Tools For Computer ForensicBusiness Intelligence (BI) Tools For Computer Forensic
Business Intelligence (BI) Tools For Computer Forensic
 
Cyber forensic readiness cybercon2012 adv j fick
Cyber forensic readiness cybercon2012 adv j fickCyber forensic readiness cybercon2012 adv j fick
Cyber forensic readiness cybercon2012 adv j fick
 
VMI based malware detection in virtual environment
VMI based malware detection in virtual environmentVMI based malware detection in virtual environment
VMI based malware detection in virtual environment
 
Introduction to security
Introduction to securityIntroduction to security
Introduction to security
 
SEC440: Incident Response Plan
SEC440: Incident Response PlanSEC440: Incident Response Plan
SEC440: Incident Response Plan
 
Cyber incident response or how to avoid long hours of testimony
Cyber incident response or how to avoid long hours of testimony Cyber incident response or how to avoid long hours of testimony
Cyber incident response or how to avoid long hours of testimony
 
Cisco SAFE_Wireless LAN Security in Depth v2
Cisco SAFE_Wireless LAN Security in Depth v2Cisco SAFE_Wireless LAN Security in Depth v2
Cisco SAFE_Wireless LAN Security in Depth v2
 

Viewers also liked

Jure Sustersic Monetization through Ovi Services
Jure Sustersic Monetization through Ovi ServicesJure Sustersic Monetization through Ovi Services
Jure Sustersic Monetization through Ovi ServicesNokiaAppForum
 
ELABORAR UN BANQUITO ADAPTADO ACCESIBLE DE CARTÓN Y PAPEL RECICLADO APT
ELABORAR UN BANQUITO ADAPTADO ACCESIBLE DE CARTÓN Y PAPEL RECICLADO APTELABORAR UN BANQUITO ADAPTADO ACCESIBLE DE CARTÓN Y PAPEL RECICLADO APT
ELABORAR UN BANQUITO ADAPTADO ACCESIBLE DE CARTÓN Y PAPEL RECICLADO APTFelipe Accesibilidad
 
Advertising and Printing Solution By Vibgyor Creations, Chennai
Advertising and Printing Solution By Vibgyor Creations, Chennai Advertising and Printing Solution By Vibgyor Creations, Chennai
Advertising and Printing Solution By Vibgyor Creations, Chennai IndiaMART InterMESH Limited
 
Microsoft Windows Azure - OCCMundial Case Study
Microsoft Windows Azure - OCCMundial Case StudyMicrosoft Windows Azure - OCCMundial Case Study
Microsoft Windows Azure - OCCMundial Case StudyMicrosoft Private Cloud
 
IdealTrip Adrián Corbal Martínez
IdealTrip Adrián Corbal MartínezIdealTrip Adrián Corbal Martínez
IdealTrip Adrián Corbal Martínezadriancorbal
 
Top Trends For 2009 Noblis Webinar Presentation
Top Trends For 2009 Noblis Webinar PresentationTop Trends For 2009 Noblis Webinar Presentation
Top Trends For 2009 Noblis Webinar PresentationAmy MacNulty
 
Mtr 1 ft6-configuration-simodrive-masterdrive-manual
Mtr 1 ft6-configuration-simodrive-masterdrive-manualMtr 1 ft6-configuration-simodrive-masterdrive-manual
Mtr 1 ft6-configuration-simodrive-masterdrive-manualRdi Automação
 
1 sociologia perspectiva sociologica (1)
1 sociologia perspectiva sociologica (1)1 sociologia perspectiva sociologica (1)
1 sociologia perspectiva sociologica (1)Teach for All
 
Intro sibelius6
Intro sibelius6Intro sibelius6
Intro sibelius6madtyn
 
Proyecto caligrafia
Proyecto caligrafiaProyecto caligrafia
Proyecto caligrafiapaezpacheco
 
Sage ERP X3 Technology & Architecture Review
Sage ERP X3 Technology & Architecture ReviewSage ERP X3 Technology & Architecture Review
Sage ERP X3 Technology & Architecture ReviewNet at Work
 
Cómo convertir energía mecánica en energía eléctrica (1)
Cómo convertir energía mecánica en energía eléctrica (1)Cómo convertir energía mecánica en energía eléctrica (1)
Cómo convertir energía mecánica en energía eléctrica (1)helenyanara
 
A IMPORTÂNCIA DO CONVÍVIO FAMILIAR ENTRE PAIS E FILHOS DE 0 A 4 ANOS
A IMPORTÂNCIA DO CONVÍVIO FAMILIAR ENTRE PAIS E FILHOS DE 0 A 4 ANOSA IMPORTÂNCIA DO CONVÍVIO FAMILIAR ENTRE PAIS E FILHOS DE 0 A 4 ANOS
A IMPORTÂNCIA DO CONVÍVIO FAMILIAR ENTRE PAIS E FILHOS DE 0 A 4 ANOSflaviaalessio
 

Viewers also liked (20)

Jure Sustersic Monetization through Ovi Services
Jure Sustersic Monetization through Ovi ServicesJure Sustersic Monetization through Ovi Services
Jure Sustersic Monetization through Ovi Services
 
CARTA RECONOCIMIENTO ABBOTT-SEVORANE
CARTA RECONOCIMIENTO ABBOTT-SEVORANECARTA RECONOCIMIENTO ABBOTT-SEVORANE
CARTA RECONOCIMIENTO ABBOTT-SEVORANE
 
ELABORAR UN BANQUITO ADAPTADO ACCESIBLE DE CARTÓN Y PAPEL RECICLADO APT
ELABORAR UN BANQUITO ADAPTADO ACCESIBLE DE CARTÓN Y PAPEL RECICLADO APTELABORAR UN BANQUITO ADAPTADO ACCESIBLE DE CARTÓN Y PAPEL RECICLADO APT
ELABORAR UN BANQUITO ADAPTADO ACCESIBLE DE CARTÓN Y PAPEL RECICLADO APT
 
Hazazi CV2 Updated 2015
Hazazi CV2 Updated 2015Hazazi CV2 Updated 2015
Hazazi CV2 Updated 2015
 
Advertising and Printing Solution By Vibgyor Creations, Chennai
Advertising and Printing Solution By Vibgyor Creations, Chennai Advertising and Printing Solution By Vibgyor Creations, Chennai
Advertising and Printing Solution By Vibgyor Creations, Chennai
 
Microsoft Windows Azure - OCCMundial Case Study
Microsoft Windows Azure - OCCMundial Case StudyMicrosoft Windows Azure - OCCMundial Case Study
Microsoft Windows Azure - OCCMundial Case Study
 
IdealTrip Adrián Corbal Martínez
IdealTrip Adrián Corbal MartínezIdealTrip Adrián Corbal Martínez
IdealTrip Adrián Corbal Martínez
 
Top Trends For 2009 Noblis Webinar Presentation
Top Trends For 2009 Noblis Webinar PresentationTop Trends For 2009 Noblis Webinar Presentation
Top Trends For 2009 Noblis Webinar Presentation
 
Mtr 1 ft6-configuration-simodrive-masterdrive-manual
Mtr 1 ft6-configuration-simodrive-masterdrive-manualMtr 1 ft6-configuration-simodrive-masterdrive-manual
Mtr 1 ft6-configuration-simodrive-masterdrive-manual
 
(2014-11-4) hombro doloroso (DOC)
(2014-11-4) hombro doloroso (DOC)(2014-11-4) hombro doloroso (DOC)
(2014-11-4) hombro doloroso (DOC)
 
1 sociologia perspectiva sociologica (1)
1 sociologia perspectiva sociologica (1)1 sociologia perspectiva sociologica (1)
1 sociologia perspectiva sociologica (1)
 
Intro sibelius6
Intro sibelius6Intro sibelius6
Intro sibelius6
 
Proyecto caligrafia
Proyecto caligrafiaProyecto caligrafia
Proyecto caligrafia
 
Estudio clínico de Rowatinex
Estudio clínico de RowatinexEstudio clínico de Rowatinex
Estudio clínico de Rowatinex
 
Catalanismo político
Catalanismo político Catalanismo político
Catalanismo político
 
Direccion estrategica fase2
Direccion estrategica fase2Direccion estrategica fase2
Direccion estrategica fase2
 
Sage ERP X3 Technology & Architecture Review
Sage ERP X3 Technology & Architecture ReviewSage ERP X3 Technology & Architecture Review
Sage ERP X3 Technology & Architecture Review
 
Moral development
Moral developmentMoral development
Moral development
 
Cómo convertir energía mecánica en energía eléctrica (1)
Cómo convertir energía mecánica en energía eléctrica (1)Cómo convertir energía mecánica en energía eléctrica (1)
Cómo convertir energía mecánica en energía eléctrica (1)
 
A IMPORTÂNCIA DO CONVÍVIO FAMILIAR ENTRE PAIS E FILHOS DE 0 A 4 ANOS
A IMPORTÂNCIA DO CONVÍVIO FAMILIAR ENTRE PAIS E FILHOS DE 0 A 4 ANOSA IMPORTÂNCIA DO CONVÍVIO FAMILIAR ENTRE PAIS E FILHOS DE 0 A 4 ANOS
A IMPORTÂNCIA DO CONVÍVIO FAMILIAR ENTRE PAIS E FILHOS DE 0 A 4 ANOS
 

Similar to Assessing cybersecurity_Anto Veldre

Ot ics cyberattaques dans les organisations industrielles
Ot ics cyberattaques dans les organisations industrielles Ot ics cyberattaques dans les organisations industrielles
Ot ics cyberattaques dans les organisations industrielles Cisco Canada
 
Modern Cyber Threat Protection techniques for Enterprises
Modern Cyber Threat Protection techniques for EnterprisesModern Cyber Threat Protection techniques for Enterprises
Modern Cyber Threat Protection techniques for EnterprisesAbhinav Biswas
 
Where Are All The ICS Attacks?
Where Are All The ICS Attacks?Where Are All The ICS Attacks?
Where Are All The ICS Attacks?EnergySec
 
Defcon 23 - Chris Sistrunk - nsm 101 for ics
Defcon 23 - Chris Sistrunk - nsm 101 for ics Defcon 23 - Chris Sistrunk - nsm 101 for ics
Defcon 23 - Chris Sistrunk - nsm 101 for ics Felipe Prado
 
Infrastructure Attacks - The Next generation, ESET LLC
Infrastructure Attacks - The Next generation, ESET LLCInfrastructure Attacks - The Next generation, ESET LLC
Infrastructure Attacks - The Next generation, ESET LLCInfosec Europe
 
Ansaldo STS at CPExpo 2013: "Risks and Security Management in Logistics and ...
Ansaldo STS at CPExpo 2013: "Risks and Security Management in Logistics and ...Ansaldo STS at CPExpo 2013: "Risks and Security Management in Logistics and ...
Ansaldo STS at CPExpo 2013: "Risks and Security Management in Logistics and ...Leonardo
 
Cyber Security in Railways Systems, Ansaldo STS experience
Cyber Security in Railways Systems, Ansaldo STS experienceCyber Security in Railways Systems, Ansaldo STS experience
Cyber Security in Railways Systems, Ansaldo STS experienceCommunity Protection Forum
 
SoleraNetworks
SoleraNetworksSoleraNetworks
SoleraNetworksJoe Levy
 
DEF CON 23 - NSM 101 for ICS
DEF CON 23 - NSM 101 for ICSDEF CON 23 - NSM 101 for ICS
DEF CON 23 - NSM 101 for ICSChris Sistrunk
 
The journey to ICS - Extended
The journey to ICS - Extended The journey to ICS - Extended
The journey to ICS - Extended Larry Vandenaweele
 
So You Want a Job in Cybersecurity
So You Want a Job in CybersecuritySo You Want a Job in Cybersecurity
So You Want a Job in CybersecurityTeri Radichel
 
2012 Reenergize the Americas 3B: Angel Avila
2012 Reenergize the Americas 3B: Angel Avila2012 Reenergize the Americas 3B: Angel Avila
2012 Reenergize the Americas 3B: Angel AvilaReenergize
 
The Internet of Things: We've Got to Chat
The Internet of Things: We've Got to ChatThe Internet of Things: We've Got to Chat
The Internet of Things: We've Got to ChatDuo Security
 
IT Security for the Physical Security Professional
IT Security for the Physical Security ProfessionalIT Security for the Physical Security Professional
IT Security for the Physical Security Professionalciso_insights
 
Ethical hacking at warp speed
Ethical hacking at warp speedEthical hacking at warp speed
Ethical hacking at warp speedSreejith.D. Menon
 

Similar to Assessing cybersecurity_Anto Veldre (20)

ISSA Siem Fraud
ISSA Siem FraudISSA Siem Fraud
ISSA Siem Fraud
 
Ot ics cyberattaques dans les organisations industrielles
Ot ics cyberattaques dans les organisations industrielles Ot ics cyberattaques dans les organisations industrielles
Ot ics cyberattaques dans les organisations industrielles
 
Modern Cyber Threat Protection techniques for Enterprises
Modern Cyber Threat Protection techniques for EnterprisesModern Cyber Threat Protection techniques for Enterprises
Modern Cyber Threat Protection techniques for Enterprises
 
Where Are All The ICS Attacks?
Where Are All The ICS Attacks?Where Are All The ICS Attacks?
Where Are All The ICS Attacks?
 
Cyber Security in Power Systems
Cyber Security in Power SystemsCyber Security in Power Systems
Cyber Security in Power Systems
 
Defcon 23 - Chris Sistrunk - nsm 101 for ics
Defcon 23 - Chris Sistrunk - nsm 101 for ics Defcon 23 - Chris Sistrunk - nsm 101 for ics
Defcon 23 - Chris Sistrunk - nsm 101 for ics
 
Infrastructure Attacks - The Next generation, ESET LLC
Infrastructure Attacks - The Next generation, ESET LLCInfrastructure Attacks - The Next generation, ESET LLC
Infrastructure Attacks - The Next generation, ESET LLC
 
Ansaldo STS at CPExpo 2013: "Risks and Security Management in Logistics and ...
Ansaldo STS at CPExpo 2013: "Risks and Security Management in Logistics and ...Ansaldo STS at CPExpo 2013: "Risks and Security Management in Logistics and ...
Ansaldo STS at CPExpo 2013: "Risks and Security Management in Logistics and ...
 
Cyber Security in Railways Systems, Ansaldo STS experience
Cyber Security in Railways Systems, Ansaldo STS experienceCyber Security in Railways Systems, Ansaldo STS experience
Cyber Security in Railways Systems, Ansaldo STS experience
 
SoleraNetworks
SoleraNetworksSoleraNetworks
SoleraNetworks
 
DEF CON 23 - NSM 101 for ICS
DEF CON 23 - NSM 101 for ICSDEF CON 23 - NSM 101 for ICS
DEF CON 23 - NSM 101 for ICS
 
The journey to ICS - Extended
The journey to ICS - Extended The journey to ICS - Extended
The journey to ICS - Extended
 
So You Want a Job in Cybersecurity
So You Want a Job in CybersecuritySo You Want a Job in Cybersecurity
So You Want a Job in Cybersecurity
 
cybersecurity-careers.pdf
cybersecurity-careers.pdfcybersecurity-careers.pdf
cybersecurity-careers.pdf
 
Cybersecurity - Jim Butterworth
Cybersecurity - Jim ButterworthCybersecurity - Jim Butterworth
Cybersecurity - Jim Butterworth
 
Avila 3 b
Avila 3 bAvila 3 b
Avila 3 b
 
2012 Reenergize the Americas 3B: Angel Avila
2012 Reenergize the Americas 3B: Angel Avila2012 Reenergize the Americas 3B: Angel Avila
2012 Reenergize the Americas 3B: Angel Avila
 
The Internet of Things: We've Got to Chat
The Internet of Things: We've Got to ChatThe Internet of Things: We've Got to Chat
The Internet of Things: We've Got to Chat
 
IT Security for the Physical Security Professional
IT Security for the Physical Security ProfessionalIT Security for the Physical Security Professional
IT Security for the Physical Security Professional
 
Ethical hacking at warp speed
Ethical hacking at warp speedEthical hacking at warp speed
Ethical hacking at warp speed
 

More from E-Government Center Moldova

The nexus of Social, Mobile, Cloud and Big Data Analytics
The nexus of Social, Mobile, Cloud and Big Data AnalyticsThe nexus of Social, Mobile, Cloud and Big Data Analytics
The nexus of Social, Mobile, Cloud and Big Data AnalyticsE-Government Center Moldova
 
Prezentare compartiment securitatea 05 03 2013 p sincariuc
Prezentare compartiment securitatea 05 03 2013 p sincariucPrezentare compartiment securitatea 05 03 2013 p sincariuc
Prezentare compartiment securitatea 05 03 2013 p sincariucE-Government Center Moldova
 
Can e government work in the cloud reichstaedter
Can e government work in the cloud reichstaedterCan e government work in the cloud reichstaedter
Can e government work in the cloud reichstaedterE-Government Center Moldova
 
Driving government efficiency and innovation through cloud computing k...
Driving government efficiency and innovation through cloud computing k...Driving government efficiency and innovation through cloud computing k...
Driving government efficiency and innovation through cloud computing k...E-Government Center Moldova
 
Unleashing the potential of cloud computing in europe francisco garcia moran
Unleashing the potential of cloud computing in europe francisco garcia moranUnleashing the potential of cloud computing in europe francisco garcia moran
Unleashing the potential of cloud computing in europe francisco garcia moranE-Government Center Moldova
 
Government innovation through cloud computing arthur riel
Government innovation through cloud computing arthur rielGovernment innovation through cloud computing arthur riel
Government innovation through cloud computing arthur rielE-Government Center Moldova
 

More from E-Government Center Moldova (20)

The new era of smart
The new era of smart The new era of smart
The new era of smart
 
The nexus of Social, Mobile, Cloud and Big Data Analytics
The nexus of Social, Mobile, Cloud and Big Data AnalyticsThe nexus of Social, Mobile, Cloud and Big Data Analytics
The nexus of Social, Mobile, Cloud and Big Data Analytics
 
Digital Transformation by Richard Baird
Digital Transformation by Richard BairdDigital Transformation by Richard Baird
Digital Transformation by Richard Baird
 
Mpay&Mcloud
Mpay&McloudMpay&Mcloud
Mpay&Mcloud
 
Presentation cert gov-md 05.03.2013
Presentation cert gov-md 05.03.2013Presentation cert gov-md 05.03.2013
Presentation cert gov-md 05.03.2013
 
Hannes astok data protection agency
Hannes astok data protection agencyHannes astok data protection agency
Hannes astok data protection agency
 
Prezentare compartiment securitatea 05 03 2013 p sincariuc
Prezentare compartiment securitatea 05 03 2013 p sincariucPrezentare compartiment securitatea 05 03 2013 p sincariuc
Prezentare compartiment securitatea 05 03 2013 p sincariuc
 
Hannes astok policy development
Hannes astok policy developmentHannes astok policy development
Hannes astok policy development
 
Digital security hannes astok
Digital security hannes astokDigital security hannes astok
Digital security hannes astok
 
MCloud operational framework
MCloud operational frameworkMCloud operational framework
MCloud operational framework
 
Arhitectura de securitate_MCloud
Arhitectura de securitate_MCloudArhitectura de securitate_MCloud
Arhitectura de securitate_MCloud
 
Ibm smart cloud solutions m-cloud
Ibm smart cloud solutions m-cloudIbm smart cloud solutions m-cloud
Ibm smart cloud solutions m-cloud
 
Ibm security virtual server protection
Ibm security virtual server protectionIbm security virtual server protection
Ibm security virtual server protection
 
Can e government work in the cloud reichstaedter
Can e government work in the cloud reichstaedterCan e government work in the cloud reichstaedter
Can e government work in the cloud reichstaedter
 
Driving government efficiency and innovation through cloud computing k...
Driving government efficiency and innovation through cloud computing k...Driving government efficiency and innovation through cloud computing k...
Driving government efficiency and innovation through cloud computing k...
 
Star storage m cloud week
Star storage m cloud weekStar storage m cloud week
Star storage m cloud week
 
Unleashing the potential of cloud computing in europe francisco garcia moran
Unleashing the potential of cloud computing in europe francisco garcia moranUnleashing the potential of cloud computing in europe francisco garcia moran
Unleashing the potential of cloud computing in europe francisco garcia moran
 
Government innovation through cloud computing arthur riel
Government innovation through cloud computing arthur rielGovernment innovation through cloud computing arthur riel
Government innovation through cloud computing arthur riel
 
4 francisco garcia_moran_moldova_2013
4 francisco garcia_moran_moldova_20134 francisco garcia_moran_moldova_2013
4 francisco garcia_moran_moldova_2013
 
3 platforma tehnologica_m-cloud
3 platforma tehnologica_m-cloud3 platforma tehnologica_m-cloud
3 platforma tehnologica_m-cloud
 

Assessing cybersecurity_Anto Veldre

  • 1. Assessing cybersecurity in a modern State of digital era Anto Veldre Information Security Expert CERT-EE Estonian Information System Authority
  • 3.
  • 4. Milk & gasoline ... http://y.delfi.ee/norm/102149/4987007_FZJEkH.jpeg
  • 5. The lifestyle http://upload.wikimedia.org/wikipedia/commons/0/03/Kakerdaja_raba.jpg
  • 6. State Information System Authority (www.ria.ee)
  • 7. Abbreviations CERT - Computer Emergency Response Team CSIRT - Computer Security Incident Response Team
  • 8. CERT typology Types: - national - govermental - ISP, company, etc - university CERT-EE – nat/gov, dual consistuency (.EE, ASxxxx) Compare to our neighbours - www.ficora.fi Keyword to remember – the constituency - кому работаешь?
  • 9. State Information System Authority (1)
  • 10. State Information System Authority (2)
  • 11. State Information System Authority (3)
  • 13. Basic categories for inventarization (an analogy - phone numbers)  IP addresses (like 217.26.147.31)  Netblocks (like 217.26.147.0/24) Autonomous Systems (AS28990)  Domain Names (DNS) like www.xyz.md
  • 16. Our Lego Objects we care - Timestamp - (category – virus, break-in, DDoS, defacement, SSH doorknock) - IP - FQDN – fully qualified domain name - URL (http://www.somewhat.md/infection.exe - An executable (.exe) - MD5("The quick brown fox jumps over the lazy dog") = 9e107d9d372bb6826bd81d3542a419d6
  • 17. Important considerations Main equations - technical control != content control - IP address as private data? == a trap
  • 18. Where to find information? Passive DNS Netflow statistics Listening to the Ethernet directly Webproxy logs, Statistics, hostcount ... ... These are standard tools present in router OS's. Intel exchange with partners. Honeypots.
  • 19. Freedom on the Internet Candidate information to be censored: tax motivated sites "bad" information: - abortion - pr0n, CP - violence "extremism" - incl religious - device design blueprints, incl. (c)
  • 20. Freedom of information methods of control - surveillance - filtering out (DNS or action based) - redirection - intrusion - combined It is extremely important to watershed between: - Technical Monitoring (for viruses, for CNC IP) - Content monitoring (for the word „terrorist“)
  • 21. CERT: RFC2350 Constituency Clients Authority, legal possibilities Contacts, security level, pledges Service library Assisting in ... Solving … Publishing advisories, reports …
  • 22. CERT vs LEO • CERT and the community Trusted communities Data feeds • CERT vs intel Technical – IP, FQDN, ASN (vs content) A nightman job – plumbing and pipes - ассенизаторская работа
  • 23. Philosophy behind the CERT • Technical intelligence is the foundation for any CERT • Event vs incident. Ticketing. 15 min rule vs reporting&statistics needs • Reporting earning our salary People are the heart of a CERT
  • 24. Philosophy behind the CERT (2) • Standard secrecy on the input Takes time to declassify Enables LEO and mil contacts • Mobile threats Cloud Automated authentication, joint IDs
  • 25. Incidents (1) * DDoS (2007 and further) * malware - Zeus/SpyEye , Sinowal etc - drive-by infections - forum poisoning - false positive on svchost.exe - phishing letter from E-bay - tax related mail accounts
  • 26. Incidents (2) - e-mail offending the President - intrusion somewhere (a registrar, a webhoster) - authentication library on “a system“ - an APT ( = Advanced Persistent Threat) - Tasmanian BGP → core network routers down - anchor related incidents (Baltic Sea)
  • 27. Incidents (3) - domain related incidents - assessing technology incidents (RSA, DN, ID) - comments on public and PR incidents (firesheep) - testimonies at the court (Allaple) - lecturing (at universities, schools …) - i-voting tech support
  • 28. What we do not do (but sometimes we could intermediate) - assist private persons (but sometimes ...) - repairing somebody's installation - copyright enforcement - filtering - content intelligence - pr0n, CP handling
  • 29. People Seven (7) • Qualifications: - HelpDesk capability - network admin - programmer, coder - teacher, lecturer - CIO or CISO or CISA - system analyst - technical writer
  • 30. Duties - contact point - consultancy - incident handling - input to legislators - advisories on threats - bringing people together - reporting - awareness raising - http://vimeo.com/22067817 - alerting
  • 31. Systems • Mostly free software • Linux/BSD • FireShark, tcpdump, ... • AbuseHelper (see bitbucket, ClarifiedNetworks) • S4A (Snort for all) • VSR – Virtual Situation Room, (see bb, C)
  • 32.
  • 35. CIIP Critical Information Infrastructure Protection • 2 whales: Communication & Energy • The Emergency Law: Vital Services – 43 fields - PVS - Provider of (a) vital service - IOCO - The Institution Organizing the Continuous Operation (of vital services) - CI - Co-ordinating Institution (in charge to contain and resolve the emergency) http://valitsus.ee/en/government-office/government-communication/handbook/crisis-communication http://ee.vlex.com/vid/emergency-act-siseministeeriumi- 204964755
  • 36. CIIP workflow Define vital (critical) areas Analyze dependencies - foundation: energy and communications - ICT - other, not directly related to ICT Define or list vital providers Communicate, analyze
  • 37. SCADA http://www.parijat.com/scadaproduct/images/MunicipalSCADA-2.jpg
  • 38. Telco • Vital providers in telco field: - 420 of these in entrepeneurs DB - 3-4-5 large ones - by the definition * has an interchange point
  • 39. Supervision Dept - ISKE - (IT Grundschutz by BSI, .de) Information Systems Three Level Security Baseline - Incident reports, CERT-EE Incidents DB - Compliance Problems / deficiencies noted by CERT or CIIP https://www.bsi.bund.de/ContentBSI/Aktuelles/Veranstaltungen/gstag/gstag_201010.html
  • 40. Thank You! Anto Veldre www.ria.ee | anto.veldre@cert.ee | +372 663 0200 Estonian Information System's Authority | Rävala 5, 10112 Tallinn, Estonia