Uploaded byBrian Honan
Learning from History
The document discusses the establishment and services of Ireland's first CSIRT, iriss-cert, which provides free information security support and coordination. It highlights key achievements in cybersecurity, trends in incidents, and the importance of better security practices to combat rising threats. The emphasis is on learning from past incidents to improve organizational security measures.
More Related Content
Similar to Learning from History
Learning from History
- 1. Helping You PieceIT Together http://www.bhconsulting.ie info@bhconsulting.ie Learning From History
- 2. Who is BrianHonan?
- 3. Who is BrianHonan?
- 4. What is IRISS-CERT? Ireland’s First CSIRT (Computer Security Incident Response Team) Provide Services On Information Security Services Provided Free of Charge Not For Profit Organisation
- 5. Services Offered IrishFocused Alerts and Warnings Vulnerability Awareness Incident Awareness Sanitised Attack Notifications Coordination Service Irish Focused Research Trends and Metrics General Awareness Knowledge Sharing Informal discussion Information Sharing & Dissemination
- 6. 2004 – TheJourney Began
- 7.
- 8. Not a FairFight !
- 9.
- 10. 2008 IRISS IsBorn
- 11.
- 12.
- 13.
- 14. IRISSCERT Achievements Finalist inBest Information Security Team Category
- 15.
- 16.
- 17. Other Key Achievements Verizon Databreach Investigations Report (DBIR) 2012 & 2013 Assisted NHTCU In Bredolab Cleanup Hosted Transits Training for 35 CERT Personnel From Around Europe DNS Changer Cleanup Participated in A CERT Exercises Coordinated Vulnerability Disclosures (CNI, vendors, & websites)
- 18.
- 19.
- 20. Recognised Threat “the cyberthreat to our nation is one of the most serious economic and national security challenges we face.” "industrial-scale processes involving many thousands of people lying behind both state sponsored cyber espionage and organised cyber crime".
- 21.
- 22.
- 23.
- 24.
- 25.
- 26.
- 27.
- 28.
- 29.
- 30.
- 31.
- 32.
- 33. So In RealityIs Like
- 34. Crack the OuterShell
- 35.
- 36. Breach Detection 69% 22% 9% Detected by3rd Party Detected by Org Detected by Customer Source: Verizon DBIR 2013
- 37. Time To DiscoverBreach 34% 4% 62% Less than A month Years or More Months or More Source: Verizon DBIR 2013
- 38. Difficulty 78% 22% Not Difficult Moderate toDifficult Source: Verizon DBIR 2013
- 39.
- 40.
- 41. 2012 - Incidents OrgCrime, 95% Other, 5%
- 42. 2012 - Incidents Increase in Targeted Attacks Increase in DDOS Attacks Increase in Activism Ransomware Attacks
- 43. 2012 - Incidents Root Cause Poor Passwords Missing Patches Vulnerabilities Web Platforms Out of Data Anti-Virus Software Lack of Monitoring
- 44.
- 45.
- 46. Don’t Forget TheBasics
- 47.
- 48.
- 49.
- 50.
- 51.
- 52.
- 53.
- 54.
- 55. Train Staff &Partners
- 56. Use Open SourceData
- 57.
- 58.
- 59.
Editor's Notes
- #7 2004 I identified that Ireland had no CERT. I felt that this was a major weakness in our security infrastructure at both an economic and national security point of view. In 2004 I took the decision to pursue the reasons why we had no CERT and based on the responses determine if we needed one. If it was determined we should have one then outline a way forward for Ireland to have a CERT
- #10 I met with the various stakeholders; Department of Communications responsible for Internet security Subsequent meetings with An Garda Siochana (Irish Police) Chambers Ireland Irish Business and Employers Confederation Enterprise Ireland Irish Small & Medium Enterprises Association Internet Service Provider Association of Ireland Science Foundation Ireland HEAnet CERT Center for Cybercrime Investigation - University College Dublin ISSA Ireland Irish Information Systems Security Forum The SANS Institute Europe ENISA (the European Network and Information Security Agency ) Numerous Organisations of Varying Sizes
- #11 So I set up IRISS. IRISS is a registered not for profit company. Business Day coverage Contactable by email & web. Part Time Volunteer Staff Irish Focused Security Information
- #19 The three certainties with regards to information security Death and Taxes You will have an incident. How you respond to an incident will have a direct influence on the impact that incident may have to your costs, reputation and ability to conduct business.
- #45 Improved Response provides; Positive Security Posture Incidents Dealt with Quickly, Efficiently and Effectively Rapid and Accurate Assessment of Incidents Choosing Most Appropriate Response. Shortened Recovery Times. Minimised Business Disruption. Confidence to Proceed with a Court Case. Regulatory and Legal Compliance. Potential Reduction in Incidents. Accurate Reporting and Metrics
- #51 Impossible to monitor everything – add intelligence and automation
- #55 Behavioural patterns What anonamilies
- #56 RSA Social Engineer
- #59 Veris from Verizon