Security Deliverables

This document describes the vision of the core collaborating NRENs in JRA2/Work Item 2 on how the eventual structure and architecture of the set of tools (hereafter to be called ‘the Toolset’) should look like.

This document is an update to the 2nd Security Recommendation and Policy deliverable, DJ2.1.1,2

Work Item 4 (Relationship with TF-CSIRT) of JRA2 (Security) details the relationship with the TERENA Taskforce TF-CSIRT (Collaboration of Security Incident Response Teams). One item of this collaboration is the creation of ad-hoc teams to deliver security advice to any entity within GN2. This deliverable reports on cases of advice requested and how the cases were handled.

To increase Security of the GÉANT2 backbone we must ensure that appropriate actions are taken both to detect and to remove threats wherever thye appear, including not only the GÉANT2 backbone, but also the networks connected to it (NRENs) as well as the networks of the local institutions connected to the NRENs at campus/site level. Hence a global coordination is needed among all parties: at international, GN2, national, and local level. A pilot coordination service has been set up and experience has been gained to define best common practices in incident handling; atrusted environment among the JRA2/WI13 pilot project teams has been set up as well, and a set of requirements on how to include new teams into the trusted club has been produced. The initial ideas on the requirements and incident handling tools have been verified against daily operations, thus refining priorities and the actual needs of the security teams. Also, an environment to introduce the new tools created by WI2 has been prepared

This document is an update to the Initial Security Recommendation and Policy deliverable. Revised security policies for GÉANT2 services are presented. The policies are based on a technical analaysis and best practices which are included as an Annex.

Flow-based monitoring using Cisco Netflow has been identified by GN2 Joint Research Activity 2 as the principal source of data for security analysis and intrusion detection. This deliverable reports on first user experiences and tests perofrmed with the hardware-accelerated Netflow probe that is being developed as part of the JRA2 toolset. The deliverable is also intended as an aid for future users and testers of the probe.

Work Item 4 (Relationship with TF-CSIRT) of JRA2 (Security) details the relationship with the TERENA Taskforce TF-CSIRT (Collaboration of Security Incident Response Teams). One item of this collaboration is the creation of ad-hoc teams to deliver security advice to any entity within GN2. This deliverable resports on cases of advice requested and how the cases were handled.