Short Introduction ofTelecom-ISAC Japan--- Overview, Current Activities ---25 MAR , 2008
Telecom-ISAC Japan

Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Philosophy• The Internet and other telecommunication networks form
the base of a social economic structure on a world scale.
Ensuring the information security becomes the urgent issue
in social economic life.
• "Telecom-ISAC Japan aims at the mutual cooperation
between wide variety of members, such as those who are in
the information and telecommunications industry of ourcountry, presses the information sharing to correspond tothese, and the improvement of the information security ispressed by doing the activity to contribute to the start
information security measures. And, it acts aiming tocontribute to the formation of the advanced
telecommunication network society. “• Healthy COMPETITION from lofty COLLABORATION.
1
Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

History
Established by 7 ISP
as a private organization.

Joined 5 ISP/SIer,transferred to NIC

2002

2004

2003.
2005

19 ISP/SIer.

2006

2007

2008

DDoS analysis & prevention
Network worm

Anti-Abuse corroborateBotnet

BOT analysis
Serious threat
toan ISPBGP routing monitoring

Coordination
for theinformation
sharing

Large scale
threat tomultiple ISPs

Information
sharing forcoordination

TINY monitoring
Trace Back

SoNAR

2Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Structure(as of Mar 2008)(Telecom-ISAC Division, Nippon Information Communication Association)

Steering Committee
Approve

Planning and Coordination
DivisionManageWorking groups
ExecuteKDDI CORPORATION
19 members
NEC Corporation
NTT Communications Corporation
NIFTY corp.
SOFTBANK TELECOM Corp.
SOFTBANK BB Corp.
Internet Initiative Japan Inc.
Hitachi, Ltd.
Matsushita Electric Industrial Co., LTD.
Oki Electric Industry Co., Ltd.
Yokogawa Electric Corp.
Matsushita Electric Works, LTD.
NTT Navispace Corp.
NIPPON TELEGRAPH AND TELEPHONE EAST CORPORATIONNIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION
Nippon Telegraph and Telephone Corporation
NTT Visual Communication Corporation
KDDI R&D Laboratories
NEC BIGLOBE, Ltd.

CCC-WG
BGP-WGTB-WG
SoNAR-WG

3Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Activities (1) Cyber Clean Center work flow
Recommend to install④ the CCC cleaner③ Detect infected
PCs and users･･ ･･

Information on attack sources

ISP② Dynamic & statistic
analysis

PCs infectedby Bot programs

①!!
DDoS➄

Access to ourportal site

Bot program
Spam e-mail･･

SuperHoneyPots②’Create Bot removal tool

as known “CCC cleaner”

CCC.GO.JP

Download
the CCC cleaner➄
Download for free!!

4Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Activities (2) BGP monitoring・

BGP prefix hijacking is a real threat.

- ISPs need a solution based on today’s technology.

Route Hijacking

AS-X
ISP-A

ISP-B

ISP-C

ISP-D

BGP Full-RouteAlert Mail

Configuration

AS-X Hijacks yourroutes！

CheckDB

Keiro-Bugyo detector

5Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Activities (3) Trace Back Project (R&D)
Outline of Trace Back system under

Real attack path(AS map)

development.

0. Store HASH data temporary.
TB-Operator
TB-DB

Each probe convert PKT to HASH,and store own cache automatically.

1. Store suspicious information.
TB-Manager IDS

Probe

Whenever IDS notify suspicious attacks,
TB manager calculate the attack PKT’s
HASH, and automatically recursive
analyze it’s AS map with neighbor AS’s
TB manager, and store it to TB-DB.

2. Detect the real attack path
ISP(a)

ISP(b)

Real attack

ISP(c)
Incident
Attack fromspoofed IP addresses

After an incident be recognized,
TB-Operator analyze TB-DB by attack
PKT’s HASH, and detect the realattack path.

Role of T-ISAC-J
A: Propose a legitimate operation model.
B: Propose an operational contract among ISP.
C: Establish the Trace Back platform in the participating ISP. (FY2008～FY2009)

6Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.

Activities (4) SoNAR-WG
Society of Network Abuse Response•••

ネットワークを利用した不正・不法行為対応（ABUSE対応）に関する情報を共有し、利用者に与える被害の拡大を抑止するフレームワークを策定することを第一の活動目的とする。
インシデント対応を分析することによって得られた知見を社会に展開することも視野に入れた活動を展開する。
また、通信サービスにおける危機管理業務のひとつとして存在するABUSE対応プロセスを定着させるため、業態・業界を超えた交流から有意義な手法を吸収する活動も実施する。

SoNAR-WG①ABUSE憲章の策定➁事例共有と分析

ABUSE対応に関する原則を明文化し共有する試み。ABUSE対応の輪郭を浮彫りにし、範囲を再定義する目的。

各社にて対応中の案件を事例として紹介し、他社での事例との比較や対応方針を共有することで対応効率化を狙う。

③勉強会④ツール類の検討

他業種・業態の事業者との交流により、新しい事案に関する情報の入手と対応手法の洗練を目指す。

事例集積データベースや連携・連絡のためのツールの仕様等について検討する。

7
Copyright©2004-2008 Telecom-ISAC Japan. All Rights Reserved.