Security Deliverables

Advanced anomaly detection is the process in which network traffic patterns are continuously and if possible near real-time monitored in order to detect deviations from the ordinary. These deviations usually form a strong first indication that traffic flows on a monitored network are not according to what was to be expected in a normal operational context. By developing sophisticated methods for anomaly detection and deploying these methods in pilot environments, an overall improvement of the security levels of a monitored network can be achieved.

This deliverable sets out the “non-cost sharing” policy issues on global connectivity that have been developed in GÉANT2

This deliverable reports about the composition, activities and recommendations of the advisory panel to JRA2. The panel consist of security specialists from several different fields and is intended to comment on the work carried out by JRA2, to give an overview of trends and evolution of network security and incident handling processes and to give recommendations for work in subsequent years of JRA2. This is the third deliverable of this panel, covering the third year of JRA2 activities.

Wirk Item 4 (Relationship with TF-CSIRT) of JRA2 (Security) details the relationship with the TERENA Taskforce TF-CSIRT (Collaboration of Security Incident Response Teams). One item of this collaboration is the creation of ad-hoc teams to deliver security advice to any activity within GN2 that requests it. This deliverable reports on cases of advice requested and how the cases were handled.

This document specifies the elements needed to run the GÉANT2 Security Service, and defines which elements are either optional or mandatory.

Flow-based monitoring using Cisco NetFlow has been identified by GÉANT2 Joint Research Activity 2 (JRA2) as the principal souce of data for security analysis and intrusion detection. In order to make NetFlow data available in all locations of both the trans-European and NREN backbone networks, JRA2 started the development of an autonomous Netflow probe named FlowMon. This second version of the deliverable summarises test results and other experiences from the five GÉANT2 partners who have been testing both the prototype and the final version of the FlowMon probe with Gigabit Ethernet interfaces.