Red Sky Aliance Weekly update

Another terrific week for the members of the Red Sky Alliance. Lots of activity, hopefully wrapping up sometime this weekend with our next fusion report. This week we added three new Associate Member analysts and a new Founding Member to the Red Sky ranks.

• Our first Associate Member provides the membership large scale open source translations from multiple languages and fuses the information with technical analysis to create reports to nicely compliment the Red Sky technical Fusion Reports. While Red Sky isn't as much interested in attribution as information assurance, understanding how attackers work, think, communicate, etc., is critical to being able to be proactive in protecting member networks, and allows Red Sky analysts and members to more accurately depict real threats to their companies and environments. 

• Through a second Associate dedicating analytic support, Red Sky added the ability to perform data mining through multiple open and premium sources. This new capability resulted in notification and cleanup of over 200 previously unknown compromised computers!

• Our newest member actually signed on late last week, but jumped in with both feed this week. We'd like to welcome this global 100 financial to the membership! 

Red Sky continues to receive queries for membership. We're preparing to wrap up our "Founding" Membership offering in the Financial and Defense Sectors (I believe we have one Founding Member seat available in each).  Founding memberships are still available in other areas of industry including energy, high tech, IT/Networking, Aerospace, Oil/Gas.

If you're interested, please drop me a note. 

Have a great weekend!
Jeff

Weekly status: Fusion Report five: "Subian" identified, named by Red Sky

Red Sky analysts posted Fusion Report 12-005 to the portal this week. FR12-005 details analysis of a previously unknown (by AV vendors) variant of Poison Ivy. Red Sky analysts have dubbed this version “Suibian”. The malware and TTPs associated with its use have been completely analyzed and posted to the membership for their inclusion in their own defense in depth. This is a great find!

Beyond that, here's a status for the end of the week:

• Yesterday we added a new member to the mix. This company is a Global 200 (a $45 billion global financial). Their team is going to bring great value to the rest of the membership.
• This week we assisted an external information sharing and analysis center understand a targeted attack by providing triage reporting and analysis. 
• We held our first Threat Day. I won't rehash the day, as I blogged it previously, but it was a small, very smart group. It was a GREAT day... and happy hour at the Ritz prior to was fun too!
• We've partnered with a new data source company, giving Red Sky two of the three pillar analytic capabilities that I've wished to integrate. I'm meeting with two companies next week for the third.

I keep getting questions about "Whats the difference between Red Sky and an ISAC?" One of them is bullet four. I believe that it's better to have smart people feeding us the right information rather than a feed of a lot of information. Think of Red Sky as a crowd sourced CIRT (without fly-away incident response teams), with both organic analysts and peer reviewed, trusted crowd sourcing inside the membership. Soon I hope to have automated 'tipping and queuing' offering warning services when a company shows up with unexpected peering, turns up in a blog entry somewhere, or data mining shows patterns of impending trouble. It's paying off. This week I was asked to present to DHS and one other analytic/sharing organization to help them with their own information sharing capabilities. I've been doing that a lot lately. I'm glad to help. I hope it does.

More next week.
Cheers!
Jeff

First Red Sky Threat Day

We just concluded our first Red Sky Threat Day. What an amazing day. We started with the least interesting presentation of the day (mine!) followed by a discussion on gaining "layered attribution" through malware analysis, and wrapped formal presentations with a discussion on automation-assisted open source intelligence collection and analysis.

The group was small (10 I think?) but it was great. A quick "cyber real estate" inventory of companies participating revealed that the four companies represented by attendees manage approximately a million computers in over 140 countries in the world. Through the Alliance, these members get new information to help them protect their respective enterprises, and those enterprises reach almost every corner of the world!

Last, ever wish you could translate a web page to know what was being said (about you) in a foreign language blog? What if you had the capability to read hundreds of blogs in multiple locations with multiple languages and had the capability to turn that information into actionable, fused reporting that could help protect your network.

Our small group witnessed this new capability yesterday... It's coming to the Red Sky Alliance.

Standby. More to follow.
Jeff

Weekly status: Red Sky Collaboration identifies entire malicious Class C

This week was another great week for the members of the Red Sky Alliance. It's funny. In my meetings with prospective members, they always ask about ROI and what they get for their membership fee. I talk of 'one stopped attack' and the cost of lost data with relative clarity.  I can say with relative surety that after this week, none of the current members are wondering what they get for their membership fee.

• Red Sky released Fusion Report 12-004 this week. Red Sky analysts reported an entire European Class C as malicious and the addresses used for a shell game. We found it during analysis of a Banking/Finance submission. The report offered full malware analysis and details of the Class C Subnet being used in the attacks. The submitter stated the Red Sky analysis was some of the best they'd seen. The analysis was performed using multiple sources, starting with the attack data as the trigger followed by fusing open source intelligence information with corroboration from a product called ScoutVision. Multiple sources make for higher confidence assessments. The company blocked the Class C and requested permission to share the analysis with the the FS-ISAC's Threat Intelligence Center.  Since the incident affected only this company we agreed.

• On April 3rd about 9PM UTC a Fortune 100 defense industry member reported spearphishing with "UPS C2". We know this TTP. While the company responded to the incident, Red Sky members performed analysis of malware, began victim notification/coordination with C2 and exfil machine owners, and coordinated identification of contact points from those companies where we had none. The submitter stated "nobody else offers this kind of service!". Red Sky knows the value of standing up command and control during incident response, but in this case the simple act of offering another set of eyeballs and external coordination went a long way. We called another well known company to tell them they'd had three machines being used in the attack. When the Director of Incident Response answered the phone, I stated my name and that I was with the Red Sky Alliance. She immediately said "I've heard of you. I think think this is something we should be involved in."

• Associate members Kyrus-Tech, Norman ANA, LookingGlass now have dedicated analysts participating in Red Sky. All proved their value week, and two have a new customer as a result. Vendors are welcome to join as Associate Members. Associate members pay a fee, participate in analysis, and are peer reviewed by readers just like any other member. Selling inside the portal is never allowed but if vendors really can do what they say, this is where they get to prove it. These companies are proving it; the Red Sky membership is benefiting from the great analysis; and the vendors are earning new customers. It's a win-win-win.

• This week Red Sky hired two new student interns and we're expecting a decision from a third by early this week. Two of the interns are Masters Degree students with the third a PhD. One will perform fusion report analysis, but the others are political science and criminal justice students (MS and PhD) who will begin authoring non-technical reports on targeting and trends. They'll be bringing experiences from studying violent criminal gang activities to the cyber realm!

That's it for now. As a reminder, Red Sky is hosting an invitation-only happy hour at the Ritz Carlton (DC/VA area) on Tuesday night and our first quarterly 'Threat Day' on Wednesday. If you'd like an invitation, please drop me a note.

Jeff

That's the way collaboration is SUPPOSED to work!

One of our members called "Wildfire!" today, meaning they were submitting information to the portal as they worked an incident. The member submitted log snippets showing exfiltration and C2 destinations as well as inbound sourcing, the malware, and a full copy of an email with the header intact.

Within minutes after the report, Red Sky began victim notification while the company worked the intrusion from the inside. When we needed a contact at an external company one of the other members chimed into the portal with a contact and then made an introduction. Victims responded to offending servers. The C2 and exfil paths were blocked by the member, and all external entities (except one, where we had to leave a VM) knew about the incident and were responding.

When the dust settled, one of the companies has asked for membership information and felt they too should be a member of the alliance. I'll have that meeting next week!

That's the way collaboration is SUPPOSED to work!

Jeff is happy today.

Saturday night, and I'm VERY happy!

Why? I received a call yesterday from one of our members. We chatted about scale, automation, etc., but then I asked him how he liked our last Fusion Report? I was looking for feedback. There were some farming issues that we'll fix for the next one, but most importantly he told me "My team hates you!" (we're making them work!). When I asked if he was seeing anything from it, he told me "we're dropping all kinds of new stuff at our perimeter"

So why would such a simple sentence make me so happy?

• The APT set went cross sector into a new target type
• The guy who gave me the comment analyzes a LOT of indicators from a LOT of sources
• The company has over 100 independent business and probably 150,000 computers. They have a VERY large perimeter

It makes me VERY happy that on our third report a director in a company of this size and stature in the Infosec community says about Red Sky "I'm sold on Red Sky!"

Red Sky contributed directly to identifying a new issue that he was able to push to his team and experience new results!

It makes me VERY happy!

Have a great weekend!
Jeff

Red Sky Alliance: End of week status- Been a great week!

Good morning!

It's been a pretty great week for the Red Sky Alliance and I'm driving back to NH tomorrow, so I thought I'd post a snapshot of the week this morning.

• Two new members committed (one finance and one LARGE healthcare organization), and a third (Fortune 10) gave us the thumbs up on legal review!
• We posted Fusion Report 003 showing a longtime APT group that had previously targeted defense industrial base companies now modifying their tactics slightly and going after the government policy shop in a bank. This was HUGE. It validates our model of collaboration in a smart way across industries offering months (in this case years) of early warning. 
• We've got two new folks working on the backend of Red Sky as analysts, and the malware engine is coming along nicely.
• One of our Associate members (Kyrus Tech) was involved in the Zeus Botnet takedown! You guys should reach out and talk to these guys. Great skunkworks handling hard problems!
• We're now tracking on over 60 threads with companies from four industry sectors, and we've just opened discussion boards on HP/Arcsight and RSA/enVision.

It's been a great week!!
Jeff

Interesting developments

Two nights ago we posted a product inside the Red Sky portal based on an input from one of our more active members. At the time we thought it might be an early development, not associated with any groups, but authored the analysis anyway. When we were posting, we compared some of the IP space to other sources and found there might actually be a link. Yesterday we confirmed what we were looking at was not only an active APT set, but that they'd been active in the Defense Industrial Base companies for almost three years with little other activity, and now jumped to a completely new sector!

This is Red Sky's first real validation of what we've been talking about! Early warning comes from smart people talking to smart people in other sectors. When smart people share technical information, they tend to share better information than those receiving anonymized data or data in the aggregate.

Don't be a wall flower! It's about people talking to smart people!

Jeff
www.redskyalliance.org

New Red Sky Fusion Report: FR12-003.pdf : AS4808 Malicious Infrastructure and Malware

FR12-003.pdf: "AS4808 Malicious Infrastructure and Malware" was just posted to the Red Sky Alliance portal. This is our third fusion report. It came about from a seemingly innocuous report from a member reporting the incident. Upon further investigation by members, it appeared that the incident was more widespread than previously thought, and took advantage of individualized emails with different source addresses for each. One member reported approximately 700 emails in an environment of approximately 300,000 users.

"On 18 March 2012, a Red Sky member posted malware from a recent spear phishing incident to the Cyber Intelligence and Analysis Center portal. The malware called backed to malicious domain. Analysis of the domain revealed related infrastructure and open source malware samples. A total of three malware samples were analyzed: one provided by the partner, and two obtained from an open source malware dump. All three samples were linked to Autonomous System 4808 which is described in the report. Correlations between the various samples will be provided in the Malware Data section of this report. While no specific attribution was identified (we don't necessarily look for attribution, Red Sky focuses on IA), several of the IP addresses and domains used were tagged as APT address space by one of our sources."

At least two different sectors reported similar cases, but with individualized targeting characteristics.


If you're not receiving these reports, please contact us (jstutzman@redskyalliance.org) or sign up for our mailing list at launch.redskyalliance.org.

Collaboration is working!
Jeff

Status - Red Sky Alliance

Good morning all! It's Saturday morning and I've had an incredible week at the Honeynet Project Annual Workshop. This years event was held at Facebook out in Menlo Park. Nice. Even during travel, startups don't stop. It's been busy!

So here are this weeks updates to Red Sky Alliance:

• We've added new member! We're up to eight now, we more requesting our presentation and demo every week. This is great news!
• Hacked! This week our external facing website was hit with an iFrame redirect attack. We knew it would happen, and it did. The website was back online quickly, although the original sits on a machine in MD. We posted a one page marker until I get back tomorrow and upload the original. 
• Success! New malware was posted to the site by one of the members. Within an hour, two others posted analysis. One of them was Norman, using their new G2 Malware Analyzer. In both pieces of analysis, the submitting member was immediately given four new pieces of information which allowed them to block C2, and then do incident response. 
• Upcoming "Threat Day": Preparing to host a "Threat Day" on April 11th at Defense Group's Vienna facility. No vendors allowed; only members and presenters. This should be a great day. Doing happy hour at the Army Navy Club the night before.
• Our Norman G2 suite has shipped! We'll be online soon. Einar is hiring 15 new analysts/engineers and they're gearing up to support Red Sky Alliance. This is going to be a great partnership!

We've also posted a 'launch' site. We've only been online since mid-February (if you can believe it!). We've received a number of emails asking for more information, and I'm finding it easy to lose track and make sure everyone gets answered. To make sure I'm not dropping anyone through the cracks, I've added  launch.redskyalliance.org to allow folks to sign on if they've got interest. I'm hoping it'll help with my organizational skills!

That's it for now.
Have a great week!
Jeff

Last day for me...

Thursday morning. Blogging before packing while I prepare for my last half day with the Honeynet Project. I haven't (nor will I) post about some of the ongoings, but I'm here to tell you.. things really have changed since I started as a member in (ahem) '97? '98? Hell. I'm to old to remember I guess.

Regardless, we've gone from WU_FTP hacks to botnets. From 'step away from your keyboard' to botnet profiling, big data, SSH honeypots, Android exploitation/forensics, HPFeeds, and a dozen other topics I've kept in my notes but can't recall at 6:22AM. There were project members from 26 countries represented, and I've made it my mission to have a conversation with every one of them. I believe I've succeeded.

Anyway, this is going to be a short note. It's been terrific seeing everyone again. It's been five years since my last annual workshop (at Lance's house.. when things were much smaller). I hope to hear from you guys again, and see you next year.

Ciao (or should I say Cheers!, Kampi!, Proz!)
Jeff

Honeynet Annual Meeting (the day before)

I arrived about 2PM PST yesterday in San Jose. Even on a 'cold day', northern California is really nice this time of year.

I feel like I'm giving confession.. Forgive me Father,  it's been five years since I've attended a Honeynet Annual Meeting. My last was five years ago at Lance's house. I expected to walk into the hotel and see a bunch of aging guys, grey, bald, overweight (all of which happened to ME in the last few years!) but what I found was actually a nice surprise. Yeah, the old crowd was here, but we were WAY outnumbered by the younger crew. In the end I spent probably 30 minutes with Max Kilger -one of my favorite conversationalists. Max is a PhD behavioral psychologist. He and I were the two 'non-geeks' when the project kicked off years ago. We authored a paper called "Know Your Enemy: Statistics" outlining and demonstrating very simple early warning techniques for inbound attacks. Max specialized in behavioral trends. I focused on non-technical intelligence.

Last night we had the opportunity to compare notes five years later. I'm sure we'll have more, but last night was fun. Max is writing models to code data to predict cyber activity in today's world. Wow. I've always taken the 'keep it simple stupid' approach -measuring defects, looking for anomalies. Max on the other hand has a world of data at his fingertips to mine, twist, and see what comes out. Wow.

Anyway, it's 5:41AM. I'm still on EST, so I've been up for a while. It's time to hit the showers and get ready for the day. I'm excited to see what these new young Honeynet thinkers have in store for me!

J

Did you experience "large scale phishing" last night?

Good morning!

At approximately 8PM (UTC) last night a member of the Red Sky Alliance posted a note and initial snippets of a 'large scale phish'. It turned out the phish affected multiple companies across the membership. Three of them and two analysts from Red Sky Alliance team came together to quickly diagnose the event as a team.

This phish is still under monitor in the membership and we'll wait to see what happens over the weekend, but we had four participants from three industry sectors looking at 'large scale phishing'. At least two different mails went were received. Both showing different senders for each of thousands of emails received.

Threat analysts and incident responders in real time communications with threat analysts and incident responders in other companies, in other sectors, comparing notes and quickly diagnosing issues they're seeing on their networks.

Great job to all involved! This is exactly what the Red Sky Alliance is all about!

Jeff

Posting our second Fusion Report!

Red Sky just posted our second Fusion Report. The report offers an analysis of a set of APT actors, how they operate, and indicators to both identify, and protect from their current MO. 

What is the Red Sky Alliance? Red Sky Alliance is a real time private cyber neighborhood watch (42 second video) and when needed, an out of band ‘war room’.  Inside the portal members share information about current advanced threats and assist each other with analysis, best practice, and preventing future attacks. On the back end, Red Sky analysts use the information to author Fusion Reports that detail, in a clear and cohesive way, all information known about the subject. The Fusion Report includes an executive summary, detailed analysis, mitigation recommendations, and a list of indicators in an easy to use Kill Chain format. 

It's a small start, but this is our second fusion report in as many weeks. You asked for value beyond simple collaboration..  we're delivering... and we're going to keep delivering.

Jeff 

Great day! Great week!

This has been a long week for me. I'm back in the DC area talking to just about anyone who will listen about Red Sky Alliance and the need to be able to talk CISO-to-CISO, Analyst-to-Analyst, Incident Responder-to-Incident Responder in a private forum. The phones have been ringing. Beside the sheer amount of interest, we've had a few really good things happen this week:

• One new company requested membership. The company handles (get this) one million one millions of dollars in transactions every day! This is a great company with a great infosec team. They're going to make a super addition to the growing list of high quality infosec teams now participating.
• I spent this morning at Senate. I've been asked to provide inputs to pending cyber (IA) legislation --how (or if) government should have a role, what it might look like (from a real world perspective), and what the biggest issues are in sharing this kind of information. 
• We kicked off a new discussion in the group this week under the heading "Tips, Tools, and Taxonomy". One of the best guys in the space has a pilot running to aggregate and describe (in incredible detail) how cyber indicators can be shared in a machine to machine format. The best part? It's not about the amount of data, it's about extracting the RIGHT data to allow good decision making. Evidently this gent talked Red Sky Alliance in another information sharing partnership, and we've started receiving calls from them! 
• We posted our first analysis (we call it a Red Sky Alliance Fusion Report) based on a member submission. The analysis detailed what happened, how it can be stopped in the future (with a snort signature), and aggregated a simple list of indicators in a format that allows a reader to simply copy and paste them into a sensor. You asked for analysis and we delivered. And we're going to keep delivering! 

It's been a great week --and it's not even over yet!

Jeff

Red Sky Alliance status report

Good evening all!

This is my second week as a full time employee with the Red Sky Alliance, so I thought I’d offer a status report. So I’ll start from the top:

• The site went live on February 1st. It looks great. There are still some features that we’re working through - better authentication, encrypted instant messaging, and automated means for collecting information from the site, correlating it, and parsing it into a kill chain format. All three are well underway. 

• Since going live, we’ve had a group of hand picked expert analysts from several great companies participating in the site, providing feedback, and sharing current indicators about the newest APT activities.

• On the 10th, as you may know, I wrapped up as the Director of the DoD/DIB Collaborative Information Sharing Environment and became Red Sky’s COO/VP for Collaborative Research and Analysis. On my first day, I flew to Tokyo with the folks from Delta Risk, World Bank, Lockheed Martin, and US-CERT to speak with the JPCERT and several of its members about the importance of sharing attack information.

• Last, in response to member requests, we’re adding features to the portal, and adding strategic alliances as “Associate Members”.  

• A malware analysis capability is being added to the backend of the Red Sky portal. I’m happy to announce that we’ve inked a deal with Norman to purchase the Norman G2 Malware Analyzer suite of tools. Norman has also agreed to support the Red Sky Alliance membership with analysis provided by the Director of their Malware analysis shop –an old friend and long time Honeynet member, Einar Oftedal. Once fully online, we’ll be able to process up to 40,000 pieces of malware per day.
• Kyrus-Tech has been added as an Associate Member in the “Vendors and Consultants” space. Kyrus-Tech created Carbon Black — a slick way of doing desktop forensics remotely. Again, I’ve known Mike Tanji for a long time. He’s a smart guy with a smart team.
• Detla-Risk has been added as an Associate Member. Delta-Risk performs Anti-APT strategies. Adam Lange came from AFCERT and is a great source of ‘APT best practice’ information. Adam can be found in the “Vendors and Consultants” space. (NOTE: Associate Members are restricted to non-analytic spaces in the portal, but are available for questions. Please feel free to peer review their information as you would with anyone else in the portal!) 
• I’m sitting a panel at Georgetown where we’ll be discussing cyber, public-private partnerships, and APT in the financial services community. 

My calendar is quite busy. It's a good thing. I’m back in NH with membership conversations with two companies by phone and one in-person along the way. I’ll be in and out of Boston and Hartford over the next week or so, responding to membership presentation requests.

Kampi!
Jeff

Turning the page to the next chapter!

I write this with both great anticipation and great sadness. Most, when leaving work, author an email telling everyone how much they've enjoyed working with them, leaving behind one parting message to their teammates as they head out into the sunset. I didn't do that. In fact, for the last month or so, I've prepared my team as best I can, with written turnover guidance and a RACI chart for the next Director. If he/she is new, I want them to at least know the battle rythm and who to talk to during the course of normal business, and if they find themselves in crisis mode. I think it's a holdover from my Navy days when officers created turnover guides for their successor. I like the practice, and left a binder with the 5Ws for the next guy on my desk.

That said, while I am extremely happy about moving on, I'm also saddened about leaving my current job. You see, for the last three years I've run a group of analysts at one of DoD's hidden jewels -- the DoD Cyber Crime Center (DC3 for short). DC3 is about as large as the lunch staff in one of the larger organizations, but cranks out some of the most amazing digital/multimedia forensic, cyber analysis, cyber training, R&D and outreach work that I've seen. This is by far, one of the best jobs I've ever had, and for all of you geeks, one of the best places to work if you want to bury yourself in data and want to have the flexibility to run with your own ideas. It's an amazing place! My piece was as the Director of the DoD/DIB Collaborative Information Sharing Environment (DCISE --an acronym only DoD could come up with.. say 'dice' for short). DCISE is comprised of the Defense Industrial Base-Computer Emergency Response Team (DIB-CERT), two other deep analysis technical teams,  and an intrusion analysis section in the lab of about 20 malware analysts and forensic examiners. Since 2008, DCISE analyzed and published findings on over 1000 APT-focused incident reports and produced over 21,000 early warning, or indicators of compromise to 36 of the largest defense contractors, a dozen or so of the largest banks and DoE labs.... over 7 million computers are managed by the partnership we served! Wow! I had the opportunity to build this.. my way. What a ride! It's now operating smoothly, and a few months ago, went through the appraisal for CMMI. It's going, stable, funded, and well positioned for the future!

So, what's next for me? I like fixing broken things and building new.

Tomorrow I'm traveling to Japan to talk to the JPCERT about the benefits of sharing cyber information, and about the Red Sky Alliance. The Red Sky Alliance is a closely woven group of trusted incident responders and security pros sharing and comparing notes on intrusions they're seeing.. all in real time in the privacy of their own portal. It's still early, and the portal has some growing to do, but we've got several companies participating today, and have about a dozen more in the pipeline heading toward the membership process. While that gets off the ground, I'll be working part time for a company called Delta-Risk where I'll be authoring anti-APT strategies, working with Infosec teams, and whatever else comes along. Regardless, next week is JPCERT. The following week is a speaking engagement at Georgetown and then, Mad River Glen for some 'Ski it if you can!" time with the kids!

So, by the time this posts later today, I'll no longer be Jeff Stutzman, DCISE Director, DAFC. I'll be Jeff Stutzman, CIO and VP Collaborative Research and Analysis at Red Sky Alliance. I look forward to talking with many of you about joining over the coming days, weeks and months.

Jeff

Red Sky Alliance Portal is live!

It took us a couple of months, and there are still a couple of features I'd like to see added, but the Red Sky Alliance collaboration site is finally a reality! The site went live today and has representation from four companies with great infosec teams. What a concept, give great teams a place to let them talk in private, give them tools, and share infosec data from the people who fight the fires every day!

There is an endless supply of news, research by marketing firms, vendor hype and (ahem) expert analysis. I'd rather have a talk with a smart incident responder than a market analyst any day!

Jeff

Banking/Finance well represented in Red Sky Alliance!

We're preparing to go live with the Red Sky Alliance portal. We've been working hard to invite the right companies to participate --they must participate, contribute, and be interested in building a smart, interactive community to share data on hard problems they face -espionage, fraud, theft.

I'm happy to say that we've received commitments for three large financial institutions to kick off the membership as Founders. I'm most happy that these institutions are  known to have great infosec shops who already know each other, and offer the highest possible probability of sharing high quality threat and incident data. Our Founding memberships will be rounded out soon for Banking/Finance, but we still have a couple of openings in other areas.. We currently have membership invitations out to members of the Defense, Energy, and Retail sectors both in the US and abroad. We're not chasing critical infrastructure, and encourage international participation. So if your company is experiencing APT, denials of service, theft of data, or other hard problems, don't go it alone! Join the Red Sky Alliance and get some help!

Interested? Request an invitation.  jstutzman@redskyalliance.org or jmckee@redskyalliance.org

Happy New Year all!
Jeff

EXCELLENT report by ENISA

The European Network and Information Security Agency released publicly today

Proactive detection of network security incidents, report

This report describes available external sources of information and internal monitoring tools which can be used by CERTs to improve their capabilities to detect network security incidents.

This is one of the best reports I've read in a while. Bravo Zulu (that's Navy for great job!) to the authors!

This report is co-authored by a number of folks that I recognized immediately.. many are FIRST (maybe all?) but one of the best things in the report is how CERTs share information, detailing the pros and cons. In the end however, the document calls out data sharing as the most effective way to proactively stop attacks before they're allowed to occur. Powerful stuff. Easier said than done however. 

Data formats must be lite and low in false positives;
Legal constraints are ALWAYS an issue;
Trust between participants is critical... tech feeds without knowing who's on the other end don't work;
The right information must be share in the right way... protected;
Information sharing organizations are less effective when the memberships don't know each other.


It's a long read, but a must read. 
Great job to the authors.


Jeff