From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned...

23
From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

Transcript of From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned...

Page 1: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

From bullet point journal to lessons learnedHow to manage coordination and cooperation development in ad-hoc working environment

Page 2: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

Agenda

What we do @ NCSC-FI?

How we do it?

»Bullet point journal

How do we improve it?

»Lessons learned

11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen 2

Page 3: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

Warning!

11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen 3

This presentation is not technical and does nothave any technical details!

It is about handling the flow of technical cases

Page 4: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

What we do?

NCSC-FI as an operational team

11.6.20174

Page 5: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

Incidents handled yearly

Incident reports per year

Incident reports Over 1000

Vulnerability coordination Over 10

NCSC-FI monitoring systems

Autoreporter 50 - 410 000

HAVARO Over 100

11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen 5

TLP: white

Page 6: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

Publications yearly

11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen 6

Public

Blog posts 80

Facebook & Twitter Over 100

Distribution lists

Week reports 52

Monthly summaries 12

Daily news letters 360

Vulnerability letters 99 (from june 2016)

CIP-messages 238

TLP: White

Page 7: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen 7

1 duty officer/1week• Incident response 24/7/365• triage• News follow up

2 duty officer/1week• Blog posts• Aids 1. duty officer

Coordinator/3weeks• Coordinates significant incidents• Follows and coordinates situation

awereness

3 duty officer/1week• HAVARO monitoring

TLP: white

Page 8: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

"CERT Public announcements" awarded as information securityphonemon of the year 2016

11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen 8

TLP: white

Page 9: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

Bullet point journal in coordination

How it is done?

11.6.20179

Page 10: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

Problems and questions

1. Mostly ad-hoc cases

2. Obtained from variety of sources

3. All having different kind of problems

4. Several people handling them

5. With many cooperation parties

1. What is important and to whom?

2. What to follow for longer?

3. What is the overall situation?

4. Where is it going?

5. Did we do it correctly?

Page 11: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

What is a bullet point journal?

Source: www.bulletjournal.com

11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen 11

From "Big Picture" to "small details" Aid with topics and symbols

TLP: white

Page 12: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

Cyberweather follows 6 topics

Espionage

DDoS

Malware and Vulnerabilities

Fraud & Phishing

Network Functionality

IoT

11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen 12

TLP: white

Page 13: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

Weekly (report)

Espionage

DDoS

Malware and vulnerabilites

Fraud & Phishing

Network functionability

IoT

Yearly (year book)

Summary & Forecast

Analyze: TOP5 threatsand solutions

Daily (morning brief)

New cases

Topic news

Vulnerabilities

IOC's data

Monitoring systems

Customer contacts & networks

Monthly (trends)

Cyberweather collage

Update of statistics and trends

Bullet point journal @ NCSC-FI?

11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen 13

TLP: green

Page 14: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

#cyberweather in May2017

6.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen 14

Espionage• Affecting elections worries all over

Europe• ICT-service providers as a spread

vector to organizations

Denial of service• Gigabit DDoSes everyday in Finland• Several notifications of threatening

with DDoSes

Fraud & Phishing• Continues bank and Apple ID

phishing has become new normal• Subscription traps common

Malware and vulnerabilities• WannaCry ransomware spread all

over world • Finland suffered few hits

Functionality of communication services• No significant disturbances lately• Significantly less disturbances than

year ago

IoT• Minimum requirements discussed in

EU level• Scanning industrial control systems

2017 revealed unprotected critical devices in network

• .

Worldwide problems from aggressive WannaCry –ransomware

Page 15: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

NCSC-FI daily week timetableMon Tue Wed Thu Fri

Daily Morning brief(coordinator)

Morningbrief(coordinator)

Morningbrief(coordinator)

Morningbrief(coordinator)

Shift of duty(1. duty officer)

Report Weeklyreport- AMBER

Weeklyreport- GREEN

Work Group meetings

NCSC-FI meeting

11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen 15

TLP: green

Page 16: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

NCSC-FI weekly month timetable

week Mon Tue Wed Thu Fri

1st DL: Cyberweathermaterial

Update: Cyber-weather

2nd DL: Sectorreportsmaterial

Networkfunctionality

DoS Sectorreports

3rd Lessonslearned

Malware and vulnerabilites

Espionage

4th Phishing IoT

11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen 16

TLP: green

Page 17: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

All gathers to a Year Book

11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen 17

TLP: white

https://www.viestintavirasto.fi/attachments/tietoturva/Information_Security-2016_ViVi-27-03.pdf

Page 18: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

Lessons learned

Improving the way of work

11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen

Page 19: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

What is lessons learned?

11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen 19

TLP: white

http://www.projectmanagers.net/i/top-mistakes-in-project-management/you-will-make-mistakes/

Page 20: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

Lessons learned in action

Once a month held discussion session

2-4 cases picked up brought up by the employees

What did we do right/wrong?

» Improvement ideas listed

» Taken to management

» Management decides what ideas are taken into actionsto improve future way of work

11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen

Improvement ideas and feed back brought upby the employees

20

TLP: white

Page 21: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

Results of lessons learned 2016

11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen 21

22 casesdiscussed

In 9 sessions We found

•75 ideas!

•Manysuccessstories

TLP: white

Page 22: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

|

Conclusions

Simplify - with simple topics

Check points - for freedom of doing in ad-hoc

Learn - from the mistakes and successes!

11.6.2017Head of Cooperation and Situation Awereness | Jarna Hartikainen 22

TLP: white

Page 23: From bullet point journal to lessons learned - FIRST...From bullet point journal to lessons learned How to manage coordination and cooperation development in ad-hoc working environment

www.ncsc.fiwww.ficora.fi

[email protected]


Lessons Learned

Lessons Learned

Lessons Learned Remote PM+ Cohort Integrated K+S · Lessons Learned Below are key lessons learned on providing Remote PM+ Training of Helpers. These lessons learned are based off

Lessons Learned Remote PM+ Cohort Integrated K+S · Lessons Learned Below are key lessons learned on providing Remote PM+ Training of Helpers. These lessons learned are based off

Lean lessons learned - lean startup methodology and lessons learned from Blossom

Lean lessons learned - lean startup methodology and lessons learned from Blossom

Lessons learned from accident investigation Seminar/IHS - Day 2... · LESSONS LEARNED FROM OTHERS LESSONS LEARNED FROM UAE ... Lessons Learned . ... Dealing with survivors and bereaved

Lessons learned from accident investigation Seminar/IHS - Day 2... · LESSONS LEARNED FROM OTHERS LESSONS LEARNED FROM UAE ... Lessons Learned . ... Dealing with survivors and bereaved

LEARNED LESSONS:

LEARNED LESSONS:

Lessons Learned:

Lessons Learned:

LESSONS LEARNED AND GOOD PRACTICES...Lessons Learned Lessons are learned for sharing and applying to similar projects. Project lessons are learned from experiences, both inspiring

LESSONS LEARNED AND GOOD PRACTICES...Lessons Learned Lessons are learned for sharing and applying to similar projects. Project lessons are learned from experiences, both inspiring

Lessons Learned from “Lessons Learned” · 2 LESSONS LEARNED FROM “LESSONS LEARNED” 2. The NRC set safety goals in its Safety Goal Policy Statement, initiated not long after

Lessons Learned from “Lessons Learned” · 2 LESSONS LEARNED FROM “LESSONS LEARNED” 2. The NRC set safety goals in its Safety Goal Policy Statement, initiated not long after

Lessons Learned Handbook · 2011-10-12 · • Lessons Learned, an adjective, describes anything related to a Lessons Learned procedure. E.g. Lessons Learned process, Lessons Learned

Lessons Learned Handbook · 2011-10-12 · • Lessons Learned, an adjective, describes anything related to a Lessons Learned procedure. E.g. Lessons Learned process, Lessons Learned

Dodging the Bullet: Lessons Learned From Recent Dam ... Lessons Learned, Van...• Inspected periodically by engineer • Observed daily by maintenance staff Events leading to failure

Dodging the Bullet: Lessons Learned From Recent Dam ... Lessons Learned, Van...• Inspected periodically by engineer • Observed daily by maintenance staff Events leading to failure

Lessons Learned from Failures Dec 2014 - MTS Houston · 212 on board, 123 perished, 89 survivors ... Lessons Learned Lessons Learned. ... Lessons Learned from Failures Dec 2014.pptx

Lessons Learned from Failures Dec 2014 - MTS Houston · 212 on board, 123 perished, 89 survivors ... Lessons Learned Lessons Learned. ... Lessons Learned from Failures Dec 2014.pptx

Lessons Learned Globally - Campaign for Tobacco-Free Kids...Process lessons learned 2. Content lessons learned See next page for lists of these lessons learned. 7 | Lessons Learned

Lessons Learned Globally - Campaign for Tobacco-Free Kids...Process lessons learned 2. Content lessons learned See next page for lists of these lessons learned. 7 | Lessons Learned

Lessons learneD

Lessons learneD

Lessons learned & not learned at MSU

Lessons learned & not learned at MSU

Successes, Challenges, & Lessons Learned...Successes, Challenges, & Lessons Learned Overview Introduction Successes Challenges Lessons Learned New Approaches Highway 70 To Phoenix

Successes, Challenges, & Lessons Learned...Successes, Challenges, & Lessons Learned Overview Introduction Successes Challenges Lessons Learned New Approaches Highway 70 To Phoenix

Lessons Learned Events at SLAC · 2012-09-14 · Lessons Learned Events: Summary Comments . Important to identify and communicate lessons learned! Lessons learned and near misses

Lessons Learned Events at SLAC · 2012-09-14 · Lessons Learned Events: Summary Comments . Important to identify and communicate lessons learned! Lessons learned and near misses

ASSESSMENT & LESSONS LEARNED FROM AFRICAN DIASPORA MARKETPLACEpdf.usaid.gov/pdf_docs/PDACT256.pdf · ASSESSMENT & LESSONS LEARNED FROM AFRICAN ... ASSESSMENT & LESSONS LEARNED FROM

ASSESSMENT & LESSONS LEARNED FROM AFRICAN DIASPORA MARKETPLACEpdf.usaid.gov/pdf_docs/PDACT256.pdf · ASSESSMENT & LESSONS LEARNED FROM AFRICAN ... ASSESSMENT & LESSONS LEARNED FROM

Lessons&Learned&in&Deploying&Akka& Persistencedownloads.typesafe.com/website/presentations/lessons-learned-akk… · Lessons&Learned&in&Deploying&Akka& Persistence Duncan&K.&DeVore

Lessons&Learned&in&Deploying&Akka& Persistencedownloads.typesafe.com/website/presentations/lessons-learned-akk… · Lessons&Learned&in&Deploying&Akka& Persistence Duncan&K.&DeVore