Open TF-CSIRT Session
Open FIRST Session
MISP Training
Network Monitoring Training
Trainer Training
Open TF-CSIRT Session | |
---|---|
13:00 – 13:15 | Open Remarks Baiba Kaskina, TF-CSIRT Chair |
13:15 – 13:30 | TI Update Antonio Liu, Trusted Introducer Team |
13:30 – 13:45 | Good Practices for national CSIRTs Don Stikvoort, on behalf of NCSC-NL |
13:45 – 14:15 | CSIRT-CV Team Update and Plan for 2017-2020 Jose Vila, CSIRT-CV |
14:15 – 14:45 | Coffee Break |
14:45 – 15:15 | Firmware over the air, case study of ADUPS Fota Janis Dzerins, CERT.LV |
15:15 – 15:45 | OPSEC. Against APT's reconnaissance phase Antonio Villalon Huerta, S2 GRUPO CERT |
15:45 – 17:30 | Group discussion on the future of TI listed teams Baiba Kaskina, TF-CSIRT Chair |
19:00 – 21:30 | Social Event |
20:30 – 23:00 | Social Event |
Open FIRST Session | |
---|---|
09:00 – 09:15 | Open Remarks Margrete Raaum, FIRST Chair |
09:15 – 09:35 | Opening Keynote |
09:35 – 10:00 | How RIPE NCC Tools and Data Sets Can Help with Online Investigations Mirjam Kühne & Ivo Dijkhuis, RIPE NCC |
10:00 – 10:20 | Updates on FIRST: Site Selection Damir Rajnovic, FIRST CFO and Thomas Schreck, FIRST Board of Directors |
10:20 – 10:50 | Coffee Break and Exhibits |
10:50 – 11:35 | APWG and the eCrime Exchange: A Member Network Providing Collaborative Threat Data Sharing Foy Shiver, APWG |
11:35 – 12:20 | Sharifah Roziah, MyCERT |
12:20 – 13:15 | Lunch Break |
13:20 – 14:20 | TheHive: a Scalable, Open Source and Free Incident Platform Saad Kadhi, CERT-BDF |
14:20 – 14:50 | Mirai: Chicken, Honey, and Videotapes Francisco Sucunza, InnoTec System - Entelgy Group |
14:50 – 15:35 | Lightning Talks |
15:35 – 16:05 | Coffee Break and Exhibits |
16:05 – 16:35 | Incident Response Dealing with the Whole Country Javier Berciano, CERTSI |
16:35 – 17:05 | AIL – Framework for Analysis of Information Leaks – An Update Michael Hamm, CIRCL |
17:05 – 17:30 | Closing Remarks |
MISP Training | Network Monitoring Training | Trainer Training | |
---|---|---|---|
09:30 – 10:30 | Introduction to MISP and information sharing Andras Iklody, CIRCL.LU | Part I CESNET | Part I Don Stikvoort, on behalf of FIRST |
10:30 – 11:00 | Coffee Break | Coffee Break | Coffee Break |
11:00 – 13:00 | Introduction to MISP and information sharing Andras Iklody, CIRCL.LU | Part I CESNET | Part I Don Stikvoort, on behalf of FIRST |
13:00 – 14:00 | Lunch Break | Lunch Break | Lunch Break |
14:00 – 15:00 | Contributing to MISP taxonomies, warning lists, galaxy and modules Andras Iklody, CIRCL.LU | Part II CESNET | Part II Don Stikvoort, on behalf of FIRST |
15:00 – 15:30 | Coffee Break | Coffee Break | Coffee Break |
15:30 – 16:30 | Contributing to MISP taxonomies, warning lists, galaxy and modules Andras Iklody, CIRCL.LU | Part II CESNET 15:30 – 17:30 | Part II Don Stikvoort, on behalf of FIRST |
Michael Hamm, CIRCL
January 24, 2017 16:35-17:05
MD5: dafa6a7880ddd0b5a3443fdc3024675f
Format: application/pdf
Last Update: June 7th, 2024
Size: 1.44 Mb
Foy Shiver, APWG
January 24, 2017 10:50-11:35
MD5: ec7588ef8812824dd0539cd93d090984
Format: application/pdf
Last Update: June 7th, 2024
Size: 2.76 Mb
Sharifah Roziah, MyCERT
Sharifah Roziah currently works as a Specialist for Malaysia Computer Emergency and Response Team (MyCERT) under the umbrella of CyberSecurity Malaysia. Besides being a Specialist, she is also tasked as a Manager of the Security Operation Centre in MyCERT, to ensure computer security incidents reported to MyCERT are responded in a timely and efficient manner. Prior to that, she worked as an Senior Analyst at MyCERT department. Roziah has been involved in the computer security field for over 15 years, mainly in Computer Security Incident Handling. Her area of focus and interest is on Computer Security Incident Handling, Incident Data Analysis and Network Security. Roziah had been a key person in handling and resolving many computer security incidents reported to MyCERT from the Malaysia constituency. Roziah had also conducted many talks, presentations, trainings at local and also at international in the field of computer security particularly in Computer Security Incident Handling. Apart from that, Roziah has also produced Incident Handling Standard Operating Procedure, Security Alerts & Advisories on latest vulnerabilities and threats, Articles and Proceeding Papers related to computer security.
January 24, 2017 11:35-12:20
Jose Vila, CSIRT-CV
A new contract has been awarded to provide CSIRT-CV services for the next 4 years. In the presentation we will make a brief introduction in relation to the administrative and economical aspects of the new contract and the differences with the initial situation, continuing with a description of the main technical aspects that will be grown and carried out in the 2017 to 2020 time scale within the centre, including detection, advanced correlation, intelligence, information sharing and training/education, amongst other things. (TLP:GREEN)
January 23, 2017 13:45-14:15
Janis Dzerins, CERT.LV
After the announcement of Kryptowire about the several models of Android mobile devices that contained firmware which collects sensitive personal data about users and transmits the data to third-party servers without users' consent, CERT.LV and CERT-EE conducted a joint research on the Android mobile phones used in the government networks. In this talk we share our experience and discoveries. (TLP:GREEN)
J?nis Džeri?š has been interested in computers since early school years. Since then he has been learning all things computer-related, and working professionally as a programmer. The endless pressure to deliver features at the cost of quality and security has lead him to reevaluate his priorities and join the CERT.LV team at the end of summer of 2016. He assures everybody this has nothing to do with midlife crisis.
January 23, 2017 14:45-15:15
MD5: 0e8229e75b2e7aa11b491ded66d8c389
Format: application/pdf
Last Update: June 7th, 2024
Size: 1.12 Mb
Mirjam Kühne & Ivo Dijkhuis, RIPE NCC
RIPEStat is a tool that provides information about any given IP address space, Autonomous System Numbers (ASNs), and related information. It presents registration and routing data, DNS data, geographical information, abuse contacts, blacklists and more from the RIPE NCC's internal datasets as well as from external sources. RIPE Atlas is the largest active Internet measurement network with almost 10,000 probes connected worldwide. The data produced by this infrastructure can be used to understanding of the state of the Internet in real time. We will present the latest developments of these tools and show how they can be used for online investigations.
Mirjam Kühne is the Senior Community Builder at the RIPE NCC, a role she’s held since 2009. She collaborates with various technical, security and academic peers within her extensive professional network to strengthen the Internet community within the RIPE NCC’s service region.
Mirjam also maintains and curates RIPE Labs, a collaborative platform that supports innovative ideas and tools for the Internet.
Prior to her current role with the RIPE NCC, Mirjam worked at the Internet Society as a Senior Program Manager. She was involved in issues related to technology and public policy, bridging the gap between the technical community and a non-technical audience like government representatives. Mirjam also developed and organised technical workshops primarily in developing countries. One of her tasks was to establish and maintain relationships with partner organisations (ICANN, the RIRs, the IETF, NSRC and others) and regional and local operator communities.
The start of Mirjam’s career in the Internet industry actually began with the RIPE NCC. She worked there for nine years, the latter half as part of the senior management team, contributing to the organisation’s strategic and financial planning. She was responsible for external relations and represented the organisation on an international level. Before that, Mirjam was responsible for developing and managing membership as well as public services.
Mirjam obtained a Masters of Computer Science at the Technical University Berlin, Germany.
Ivo Dijkhuis, RIPE NCC
January 24, 2017 09:35-10:00
dijkhuis-ivo_kuhne-mirjam_slides.pdf
MD5: 4bceab2e7339e06c76c7e13d81b6b211
Format: application/pdf
Last Update: June 7th, 2024
Size: 3.85 Mb
Javier Berciano, CERTSI
January 24, 2017 16:05-16:35
MD5: e25e27bce8495208e3289765e05da38a
Format: application/pdf
Last Update: June 7th, 2024
Size: 2.8 Mb
Francisco Sucunza, InnoTec System - Entelgy Group
January 24, 2017 14:20-14:50
MD5: 75292845c72c3b7ac415bc2b9cebf121
Format: application/pdf
Last Update: June 7th, 2024
Size: 5.89 Mb
Antonio Villalon Huerta, S2 GRUPO CERT
While talking about APT attack mitigation techniques, we usually focus on technological aspects associated with intrusion and persistence phases, but ignoring some critical aspects, those on the reconnaissance phase, that could block (or at least, interfere) the attacker activities. In this sense, we must consider OPSEC as the process that allows us to identify our potentially useful information for the attacker, to know the threats and vulnerabilities it introduces and to define and implement appropiate countermeasures. (TLP:WHITE)
Antonio Villalon is S2 Grupo Chief Security Officer. Computer Engineer (Technical University of Valencia), Security Director (University of Valencia) and CISA (ISACA), he holds more than 20 years of experience in cybersecurity. He has executed and managed many analysis, attack, defence and exploitation projects, including the definition, start up and running of some SOC and CERT. He teaches and speaks about security in different universities and conferences on a regular basis, and has written some books and articles on the subject; his last book (in Spanish) is "Advanced Persistent Threats", published on December, 2016.
January 23, 2017 15:15-15:45
villalon-huerta-antonio_slides.pdf
MD5: 7d6bfb47857134c4e62e823c31aaa6ad
Format: application/pdf
Last Update: June 7th, 2024
Size: 10.42 Mb
Saad Kadhi, CERT-BDF
TheHive is a scalable 3-in-1 open source and free solution designed to make life easier for SOCs, CSIRTs, CERTs and any information security practitioner dealing with security incidents that need to be investigated and acted upon swiftly. It allows analysts to:
Further information can be found on the project’s website at: https://thehive-project.org
January 24, 2017 13:20-14:20
MD5: a93a999e06895456681049b06b8e3ea1
Format: application/pdf
Last Update: June 7th, 2024
Size: 2.14 Mb