SIRIOS the Framework for CERTs Thomas Klingmller Federal Office - PowerPoint PPT Presentation

SIRIOS the Framework for CERTs Thomas Klingmüller Federal Office for Information Security (BSI) Germany 17th FIRST Conference 2005 - Singapore June 26 – July 1, 2005

Abstract SIRIOS – Framework for CERTs BSI and CERT-Bund J SIRIOS – What it is J SIRIOS – Features J SIRIOS – Modules J Incident tracking J Vulnerabilities J Further modules J Download and installation – Where to get it J SIRIOS at CERT-Bund J Questions J Thomas Klingmüller 29.06.2005 Slide 2

Framework for CERTs SIRIOS – S ystem for I ncident R esponse i n O perational S ecurity SIRIOS � Internal ticket handling and tracking for CERTs � Role based workflows for ticket handling � Processing of vulnerability and incident information � Incident tracking � Authoring and publishing system for advisories � Databases for vulnerability information and artifacts � Cryptographic support Thomas Klingmüller 29.06.2005 Slide 3

SIRIOS - Ticket � Ticket-ID � (Un-)Lock � From / To � Status � Subject � Contact Information � Owner � Notes � History � Print-Preview � Queue � Krypto-Info � Age � Links � Content � Escalation status Thomas Klingmüller 29.06.2005 Slide 4

Role based workflows user role group queue Rollen User Advisory Incident Hotliner Coordination Administrator Overview Handler Handler Friday Robinson Crocodile Thomas Klingmüller 29.06.2005 Slide 5

SIRIOS - Features � Multilanguage support via preconfigured templates � Platform independent � Free Open Source Software – GPL* � Designed with security in mind � External enhancement: SIRIOS Networks � Internal enhancement: modular design *GNU General Public License ( GPL ) Thomas Klingmüller 29.06.2005 Slide 6

SIRIOS - Modules � Incident tracking � Authoring Advisories � Import and export of information using well known standards � Checking signatures, encryption, decryption � Vulnerability database � Artifact database � Contact database � Monitoring of web sites � Administration GUI � Multilanguage template based � Paket manager Thomas Klingmüller 29.06.2005 Slide 7

Incidents: Incoming day-to-day CERT Business SIRIOS - Features � mail handling � Filtered inboxes with automated triage � telephone hotline � Telephone to database – � Incident reporting with templates � automated alerts and � Role based incident tracking statistics � IODEF interface � IDMEF interface Thomas Klingmüller 29.06.2005 Slide 8

Incidents: processing day-to-day CERT Business with SIRIOS � Several tools � central incident – module � text-editor � Incident tracking � command line � artifact – database � Multiple data sources � Sourcecode / binaries � online information � Logs � databases � Any files � email � central vulnerability – database � paper � Manual input � OSVDB objects � CVE objects � contact - database Thomas Klingmüller 29.06.2005 Slide 9

Incidents: Outgoing day-to-day CERT Business with SIRIOS � Text-editor � Incident – module � Anonymising dataobjects � Mail � Pseudonymising dataobjects � exchange with IODEF � IODEF -> xml-file � IDMEF -> xml-file � IODEF+IDMEF -> xml-file Thomas Klingmüller 29.06.2005 Slide 10

Vulnerabilities: Incoming day-to-day CERT Business with SIRIOS � Maillinglists � Role based advisory handling � Browser � Workflow-management � Mail � Archivierung aller � Telephone Maillinglisten � Multilanguage - templates Thomas Klingmüller 29.06.2005 Slide 11

Vulnerabilities: Processing day-to-day CERT Business with SIRIOS � Text – editor � Self – developed databases � Advisory – module � Internet � Template - GUI for Advisories � � Virus – alarm/warning � Admin – information � Quality - check � Artifact – database � Source code � files � Central vulnerability database � Vulner. –numbers � Risk-level � OSVDB / CVE Thomas Klingmüller 29.06.2005 Slide 12

Vulnerabilities: Outgoing day-to-day CERT Business with SIRIOS � PGP – tools � Different advisory formats � Long – advisories � S/MIME – tools � Short – advisories � Mail-server � Virus – alarm/warning � Admin – information � Signing and/or encryption of outgoing information � Export in EISPP/DAF Thomas Klingmüller 29.06.2005 Slide 13

in action Thomas Klingmüller 29.06.2005 Slide 14

SIRIOS at CERT-Bund � Platform – NetBSD 1.6.2 � MySQL � Apache 2.0 � Perl � Two Systems in Master-Slave mode � Load-balancing � Systemmonitoring with mon � Full – Backup � Wrapper – interface for maillinglist-server, webserver (cms) Thomas Klingmüller 29.06.2005 Slide 15

SIRIOS at CERT-Bund II ipf load balancing ipf load balancing SIRIOS SIRIOS Wrapper Webserver Webserver Backup Database Database Mail - Archive Thomas Klingmüller 29.06.2005 Slide 16

Installations – Where to get it � Source: � www.sirios.org ( and maillinglists) � www.cert-verbund.de/sirios/ � Projectteam � CERT-Bund � Thomas Klingmüller, � Tillmann Werner � Helping hand � Siemens CERT, Germany � DFN-CERT, Germany � PRE-CERT, Germany � OTRS GMBH, Germany Thomas Klingmüller 29.06.2005 Slide 17

Kontakt Federal Office for Information Security (BSI) Germany Thomas Klingmüller Section I 2.1 – CERT-Bund Godesberger Allee 185-189 53175 Bonn Tel: +49 (0)1888 9582-561 Fax: +49 (0)1888 9582-90-561 thomas.klingmueller@bsi.bund.de http://www.bsi.bund.de http://www.cert-bund.de Thomas Klingmüller 29.06.2005 Slide 18