1

2007-03-14

PublicDistributed security incident
response organization”A.K.A. TeliaSonera subCERT organization”

TeliaSoneraCERT CC•

80-s Occasional computer crime investigations•

1993 Central Investigation Unit•

1996 Team Data•

1998 TeliaCERT•

1999 TF-CSIRT (former EuroCERT)•

2000 FIRST membership•2001 TF-CSIRT Level 2 (accredited)•2002 Initiator of Swedish CERT-Forum•2003 Changed name to TeliaSoneraCERT CC

3

2007-03-14

PublicRole and Purpose

4•The main mission of TS-CERT is to manage threats and attacks against
computers and computer networks that support TeliaSonera’s business
operations and information assets. The purpose is to minimize damage anddisruptions caused by IT security incidents.

•TS-CERT is a Coordination Centre for handling IT security incidents at
corporate level. TS-CERT coordinates the handling together with appointed
security incident handling teams within the business units. TS-CERT takes anactive role in security incident investigation and analysis.

•TS-CERT is the main recipient of IT security incident reports within TeliaSonera.

•The responsibility also includes following up IT security within theTeliaSonera Group by conducting vulnerability assessments, penetration tests
and enforcing applicable policies. This is done in close co-operation with CIO.

•TS-CERT represents TeliaSonera in the international Forum of Incident Response
and Security Teams (FIRST) and the European TF-CSIRT (Task Force Computer
Security Incident Response Teams).
TSS-Abuse represents TeliaSonera in E-Coat.

2007-03-14

PublicAreas of operations• Incident Handling and coordination− Emergency response− Lead and coordinate subCERT organization− Provide assistance to subCERTs− Computer forensics− Artifact analysis• Follow-up− Coordinate and conduct penetration tests− Conduct security analysis of critical systems• Information coverage and distribution• Advice and guidance− Training− Participation in projects− ”Consultants”
5

2007-03-14

PublicIdentified issues• Company present in many countries− Large distances− Different legislation and regulation− Different types of business• Lack of presence− Security on a strategic level vs operations− Corporate culture− “Talk around the coffee table”• Rapid changes− Organizational− Technical• Other problems− Internal requirements− Financing

6

2007-03-14

PublicPre-requisites for SubCERT in TeliaSonera• Roles−−−

Team owner
Team leader
Team member• SubCERT statement
−−−−
−
−

Purpose and goal (formally signed by management)
Constituency and Demarcations
Roles and responsibility
ReportingStaffing and financing
Co-operation• Code of Ethics and Code of Practice• Acceptance of common procedures−−−−

TriageEscalation Procedures
Incident Tracking System
E-mail templates, Report templates, Incident Flows• Training• Tools

7

2007-03-14

PublicTraining•

Basic Education (by TS-CERT)− TSG Incident Organisation (2 days)− Walk-by-hand Incident Training (5 days)− Establishment of own SubCERT (10-15 days)•Technical Training (by SANS Institute)− Hacker Techniques, Exploits and Incident Handling System
Forensics, Investigation and Response•

Manager’s Education (by TF-CSIRT and CERT/CC)− TRANSIT Course− CERT/CC•

Optional Training (by SANS Institute and CERT/CC)− Auditing Networks, Perimeters & Systems (SANS T7)− Intrusion Detection In-Depth (SANS T3)− Computer Security Incident Handling for Technical Staff(CERT/CC)

82007-03-14

PublicAvailable policies, processes and instructions

92007-03-14

PublicTS subCERT organization (based on constituency)
Internal systems & Networks• CSIRT-TSS
TSIN/TSF /TS CERT CCInternet

Broadband Customer Networks
IES Infra• TSF CSIRT / Abuse• TSS Abuse• TSS IRT
• NetCom Abuse• TSDK Abuse/TS-CERT CC

DatanetDatacenters
Service Platforms
Mgmt Networks

Telianet

BB Infra

ADSL

Datanet Backbone
IES Customer Networks• CSIRT-MaS• CSIRT-Cygate/TS CERT CC

Managed WP

2007-03-14

R&D Networks• CSIRT-TSS/TS CERT CC

EurAsia• CSIRT-Omni• TSS IRT/TS CERT CC
10• TSS IRT/TS CERT CC
Network Mgmt NetworkNetwork Mgmt Systems
MS Infra

Managed Srv

R&D NetworksPublic

Production Infrastructure• TSS CSIRT-TSS/TS CERT CC/TS CERT CC

MIPnetDDN

Secure Srv.

Secure Products Infra
Secure CERTThe role of TSCERT CC
•••
••••

11Define incident response policies, procedures and related
documentation
Coordination both internally and externallyAssistance to subCERTs
Quality assurance
Special cases− Requiring specialized knowledge− Handed off to Law Enforcement− Other cases within our constituency
Analysis− Of security incidents− Of new technology
Training of− subCERTs− other units

2007-03-14

PublicPro’s and con’s“Pros”• Close to operations anddevelopment• Local knowledge (language,differences in work & socialculture)• Clearly defined constituencies• Easier to adopt to organizationalchanges• The cost for the incidents willaffect the correct business unit

12

2007-03-14

Public”Cons”• Central CSIRT can become
unknown within the organization• Central CSIRT don’t get enoughcases• subCERTs don’t get the support
needed for its operation• Reporting is hard to makeperfect• Daily communication• Common workspace

Questions, comments …

13

2007-03-14

Public14

2007-03-14

PublicAdditional resources/information• CERT/CC− Organizational Models for Computer Security Incident
Response Teams− Handbook for Computer Security Incident Response Teams(CSIRTs)

15•

TF-CSIRT Starter kit•

TSCERT CC− ts-cert@teliasonera.com

2007-03-14

Public