PIONIER CERT

Tomasz NowocienPoznan Supercomputing and Networking Center

PIONIER-CERT teamaddress: ul. Noskowskiego 1061-704 Poznan,POLANDphone: (+48 61) 8582066e-mail: nowocien@man.poznan.pl

What is it about?

● PIONIER net● PIONIER-CERT team● DIHS by PIONIER-CERT

– Whatfor?– How?– Why?

PIONIER

PIONIER

● 21 MANs● Internet access for:

– Univesities– Libraries– Science intitutes– Supercomputing Centres

PIONIER connections● GEANT (10Gb/s)● Telia Sonera Internet - Hamburg and Warsaw (2.5Gb/s)

● Own fibres connections to nets in Germany and Czech Republic

● Connections to other ISPs: TELBANK, IPartners, NETIA, ProFuturo, ICPNet, ATMAN, DIALOG, ENERGIS

PIONIER-CERT

● Established in 2001 (POL34-CERT)● 5 person in Poznan● Additional person(s) in MANs.● Main activity: Incident handling

PIONIER-CERT: Incident Handling

● determining the initial cause of the incident

● facilitating contact with other sites which may be involved

● facilitating contact with sec. teams/ law enforcement officials

● making reports to other CSIRTs● composing announcements to users ● collecting statistics

PIONIER-CERT incidents

● Over 1100 reports a month● Over 90% - SPAM● Other: SCAN,Viruses,Copyright...● Sometimes interaction to Polisch Police

PIONIER-CERT DIHS

● Distributed Incident Handling System

PIONIER-CERT DIHS

DIHS - Report Collector

● Role:– Collects reports from users– informs users about incident handling statusu

● Report chanels:– Web form– e-mail

DIHS - Report Collector

DIHS - Report Qualifier

● verifies reports● qualifies reports

DIHS - Report Qualifier

DIHS - Report Qualifier

DIHS - Incident Handler

● Distributed● Documents all incident handling actions

● Gives insight view into incident handling history

● Drives through handling process according to procedures

● Helps to supervise incident handling process

DIHS - Incident Handler

DIHS - Incident Handler

DIHS - Incident Handler

DIHS - Incident Handler

DIHS – Incident Handler

Webpages

● Pages– http://www.pionier.gov.pl– http://noc.pionier.gov.pl– http://cert.pionier.gov.pl

● Reporting: – http://cert.pionier.gov.pl -> <incident reporting>

– http://reports.cert.pionier.gov.pl

Thank You :-)