A presentation given at the 4th APCERT session of APRICOT 2015 on Wednesday, 4th March 2015.

1. Copyright © 2014 NTT corp. All Rights Reserved.
NTT-‐‑‒CERT Activities
Yoshiki Sugiura
NTT-‐‑‒CERT
March 4th, 2015

2. 2Copyright©2014 NTT corp. All Rights Reserved.
Introduction
• As a CSIRT member
• JPCERT/CC from 1998 to 2002
• Supporting to create and manage
CSIRTs
• NTT-CERT
• Intelli-CSIRT
• Steering committee of NCA
• Guest researcher of Meiji Univ.
• Team building
• Theory of management and Social
psychology

3. 3Copyright©2014 NTT corp. All Rights Reserved.
Agenda
3
Why CSIRT?
Organizations
Activities
Collaboration

4. 4Copyright©2014 NTT corp. All Rights Reserved.
Agenda
4
Why CSIRT?
Organizations
Activities
Collaboration

5. 5Copyright©2014 NTT corp. All Rights Reserved.
Why CSIRT?
5
http://en.wikipedia.org/wiki/Swiss_̲cheese_̲model

6. 6Copyright©2014 NTT corp. All Rights Reserved.
Agenda
6
Why CSIRT?
Organizations
Activities
Collaboration

7. 7Copyright©2014 NTT corp. All Rights Reserved.

8. 8Copyright©2014 NTT corp. All Rights Reserved.
NTT HQ Organization Chart

9. 9Copyright©2014 NTT corp. All Rights Reserved.
Agenda
9
Why CSIRT?
Organizations
Activities
Collaboration

10. 10Copyright©2014 NTT corp. All Rights Reserved.
Security Quality
Management Services
Security Consultation
Security Education
Evaluation of products
and technologies
Security Training
Reactive Services
Vulnerability handling
Incident handling
Artifact handling
Proactive Services
Security Reporting
Security Alerts
Security Diagnosis
Monitoring of
Defaced Websites
NTT-‐‑‒CERT

11. 11Copyright©2014 NTT corp. All Rights Reserved.
NTT Group Companies
(in direct contact with NTT-CERT)
Business Units
Business Units
Business Units
NTT Group Companies
(in direct contact with NTT-CERT)
Business Units
Business Units
Business Units
NTT
(Holding Company)
NTT R&D
NTT-CERT
@SC-Lab
Incident handling
Vulnerability handling
Security Alerts/ Reports
etc.
Other
Sources
Subsidiary
Companies
NTT Group Companies
(in direct contact with NTT-CERT)
Business Units
NTT Group companies in
direct contact with NTT-‐‑‒CERT
Subsidiary
Companies
Subsidiary
Companies
Other NTT Group
companies in
indirect contact with
NTT-CERT
Obtaining security
information and
supports through their
parent companies
Subsidiary
Companies
Subsidiary
Companies
Subsidiary
Companies
Customers of NTT
Group
Obtaining security
information and
supports from NTT
Group companies
Business Units
Business Units
Ø NTT-‐‑‒CERT cooperates with NTT group companies for security activities. NTT-‐‑‒CERT
supports big subsidiaries and they support their own subsidiaries.
PoC (Point of Contact)
PoC (Point of Contact)
PoC (Point of Contact)
NTT-‐‑‒CERT Relationship with NTT Group

12. 12Copyright©2014 NTT corp. All Rights Reserved.
NTT-‐‑‒CERT incident response activity
Apr. 2012 〜～ Mar. 2014
Security Alert
unpublished vulnerability
Incident handling
Number of
handling
FY2012 469
FY2013 504
Including response to other
organizations

13. 13Copyright©2014 NTT corp. All Rights Reserved.
Reactive Services
6.
Vulnerability
Handling
5.
Incident
Handling
Support response to vulnerabilities (in cooperation with outside organizations)
Support company with handling of incidents that have occurred or have been
detected (data leaks, suspicious accesses, intrusion and falsification, etc.)
Proactive Services
1.
Security
Alerts
Security Quality Management Services
10.
Security
Training
9.
Security
Educa=on
11.
8.
Security
Consulta=on
Report vulnerability information to companies and, when necessary,
coordinate with external organizations
Implementation of various initiatives to prepare for emergencies such as cyber
security practice
Provide and promote opportunities such as development of education
materials and holding of security workshops
Support for security evaluation of self-‐‑‒developed products and commercial
products
Widespread support in terms of information security such as a support for
CSIRT construction
7.
Ar=fact
Handling
Technical inspection and analysis of detected malwares
2.
Security
Repor=ng
Distribute investigation results and obtain information (latest data, technical
information, articles of interest, etc.)
Evalua=on
of
Products
and
Technologies
3.
Security
Diagnosis
Check public servers of each company over networks for flaws of security
settings, etc.
4.
Monitor each
company’s
web pages periodically
to
confirm
those
pages
are
not
defaced
to
distribute malwares, using client honeypots developed in NTT labs
Monitoring
of
Defaced
Websites
Current Activities of NTT-‐‑‒CERT

14. 14Copyright©2014 NTT corp. All Rights Reserved.
事業会社事業会社
Cooperation
Trusted
third parties
Information
Requests
for support
Detection
Support and coordination
Provide experience
Deep investigation with
detection tools
Forensic support
Provide laboratory expertise
Incident handling
Support and coordination to minimize damage from incidents that have occurred
Obtain and organize information
Share data and investigations with
relevant departments
Adjustments at time of publishing
Handling unpublished vulnerability information
Coordination with relevant departments of the NTT Group on investigation,
countermeasures and preparations for the day of publication regarding
unpublished vulnerabilities
Subsidiaries
Subsidiaries
Subsidiaries
Reactive Services/ Incident and
Vulnerability Handling

15. 15Copyright©2014 NTT corp. All Rights Reserved.
Provide companies with early warnings, alerts and cautions obtained from JPCERT/CC
Filter the huge amount of vulnerability information issued by the “iDefense”
vulnerability information distribution service down to what is needed by the
companies (optimized by prior registration and feedback)
iDefense
Distribute early warnings, alerts and useful information
Get early warnings,
alerts and useful information
Get data from public
monitoring
Mail
About 10,000
vulnerability cases/year Mail
Distribute system-‐‑‒specific vulnerability information
Prior registration and optimization
Auto/manual filtering
Subsidiaries
Subsidiaries
Proactive Services/ Security alerts and
vulnerability information

16. 16Copyright©2014 NTT corp. All Rights Reserved.
Public monitoring
Information from Web monitors and phone
conferencing with personnel in the U.S.
Info exchange
Investigate suspected malware sites
Lists from
cooperating
organizations, lists
from received spam
mail, and site
blacklists
Investigate blacklisted sites and suspected
sites obtained from spam mail for malware
Analysis
tools
Automatic
patrolling
NTT-‐‑‒A
NTT-‐‑‒B
NTT-‐‑‒C
Dynamic testing of NTT Group site integrity
with client honey pot
(Approx. 5,000 pages on 185 NTT Group companiesʼ’ site)
Investigate NTT Web site forgeries
Analysis
tools
Twitter NEWS
DRG, Shadow server
CAIS, SMC
Investigation
Investigation
Proactive services/ Incident Detection

17. 17Copyright©2014 NTT corp. All Rights Reserved.
Agenda
17
Why CSIRT?
Organizations
Activities
Collaboration

18. 18Copyright©2014 NTT corp. All Rights Reserved.
CSIRT and communities
18
FIRST
• World wide
• Over 300 Team
TF-‐‑‒CSIRT
• Europe
APCERT
• APAC
• National CSIRT
Local
communities
• Japan, Germany,
and so on
• Vulnerability information
• Best practices
• Knowledge

19. 19Copyright©2014 NTT corp. All Rights Reserved.
19
• Official name
• 日本コンピュータセキュリティインシデント対応チーム協議会
• aka:日本シーサート協議会
• aka in English: NIPPON CSIRT ASSOCIATION (NCA)
• http://www.nca.gr.jp/
• Mission
• Establish collaborative environment for member CSIRTs to
work on common security concerns and issues
• Member driven initiative to contribute to better secured
information society
• History
• March 27th, 2007 Founded by 6 CSIRTs (five of
which are from commercial enterprises)
• July 31st, 2007 Established operational framework
• August 1st, 2007 Steering committee formed
NIPPON CSIRT ASSOCIATION

20. 20Copyright©2014 NTT corp. All Rights Reserved.
Increasing CSIRTs in Japan
NCA members
0
10
20
30
40
50
60
70
80
2007 2008 2009 2010 2011 2012 2013 2014 2015

21. 21Copyright©2014 NTT corp. All Rights Reserved.
Nippon CSIRT Association
Communities
NCA

22. 22Copyright©2014 NTT corp. All Rights Reserved.
US-‐‑‒CERT (USA)
Deutsche Telekom CERT
Shadow Server
（USA）
TERENA
（Europe）
NCSC-‐‑‒NL (NLD)
CAIS/RNP (BRA)
Honeynet Project
(overseas organization)
Juniper SIRT Telefonica-‐‑‒CSIRT
ID-‐‑‒SIRTII (IDN)
IBM
Web of Trust
HIRT（Hitachi）
National
CSIRT
Enterpris
e
CSIRT
Research
Team
JPCERT/CC
Nippon CSIRT
Association（NCA）
Japan
Chapter
FIRST
Japanʼ’s
National
CSIRT
JSOC（LAC）
MUFG-‐‑‒CERT
Exchanges information of
honeypot technologies and
malware, etc.
Collects information about
attackerʼ’s IP addresses,
etc.
Cooperates in fields of CSIRT
construction and education, etc.
FIRST : Forum of Incident Response and
Security Teams
Associated Organizations

23. 23Copyright©2014 NTT corp. All Rights Reserved.
23
CONCLUSION

24. 24Copyright©2014 NTT corp. All Rights Reserved.
・ As the CSIRT organization for the NTT Group,
NTT-‐‑‒CERT and other CSRITs contribute to keeping
the group secure through incident handling and
response
・We contribute to the security of the Internet as a
whole by providing information and analysis of
security threats that are evolving day by day
・We cooperate with organizations outside the Group
as needed, such as NISC, NIST, JPCERT/CC,
National Police Agency of Japan, NCA, FIRST, etc.