Presented by Klee Aiken at the Commonwealth Broadband Pacific Forum 2017 held in Apia, Samo from 25 to 27 July.

1. Fostering National Incident
Response Capacity
Commonwealth Broadband Pacific Forum – Apia, Samoa
27 July 2017

2. Users
Public
Safety
Regulators
Operators Vendors
Software
CERTs
Internet Security Ecosystem

3. Asia-Pacific
CERTs

4. Morris Worm – 1988
Source: https://myindigolives.wordpress.com/2016/11/25/growth-of-the-early-internet-by-node/
Source: http://touque.ca/EC/students/KrishnaKumarNairG/mosaic/mosaic.html
Source: https://www.flickr.com/people/intelfreepress/

5. Establishment of CERT/CC
… CERT’s three main functions are to provide
• mechanisms for coordinating community response in
emergencies, such as virus attacks or rumors of attacks:
• a coordination point for dealing with information about
vulnerabilities and fixes; and
• a focal point for discussion of proactive security measures,
coordination, and security awareness among Internet users.
…CERT officials recognize the need to establish credibility and
support within the Internet community so that its recommendations
will be acted on...
-- GAO (1998) Computer Security: Virus Highlights Need for Improved Internet Management.

6. Core CERT functions
… CERT’s three main functions are to provide
• mechanisms for coordinating community response in
emergencies, such as virus attacks or rumors of attacks:
• a coordination point for dealing with information about
vulnerabilities and fixes; and
• a focal point for discussion of proactive security measures,
coordination, and security awareness among Internet users.
…CERT officials recognize the need to establish credibility and
support within the Internet community so that its recommendations
will be acted on...
Incident response
Coordination
Information Sharing
…TRUST...

7. 1. Preparation
– Preparing to handle
Incidents
– Preventing Incidents
2. Detection and Analysis
Incident Response
3. Containment, Eradication
& Recovery
4. Post Incident Activities
- Lessons Learned &
Improvement
Source: NIST Computer Security Incident Handling Guide

8. Coordination
Source: NIST Computer Security Incident Handling Guide

9. Information Sharing
• Trusted Group
• Sharing of threat intelligence
• Co-ordinated Response
• Reach out to the community

10. Asia-Pacific
CERTs

11. • Defined Structure
• Mandate & Terms of Reference
CERT Establishment
…is a team that performs, coordinates, and supports the response to
security incidents that involve sites within a defined constituency
• Operational Capacity
• Establishing Relationships
-- RFC 2350

12. • Defined Structure
• Mandate & Terms of Reference
CERT Establishment
…is a team that performs, coordinates, and supports the response to
security incidents that involve sites within a defined constituency
• Operational Capacity
• Establishing Relationships
-- RFC 2350

13. • Defined Structure
• Mandate & Terms of Reference
CERT Establishment
…is a team that performs, coordinates, and supports the response to
security incidents that involve sites within a defined constituency
• Operational Capacity
• Establishing Relationships
-- RFC 2350

14. • Defined Structure
• Mandate & Terms of Reference
CERT Establishment
…is a team that performs, coordinates, and supports the response to
security incidents that involve sites within a defined constituency
• Operational Capacity
• Establishing Relationships
-- RFC 2350

15. • Defined Structure
• Mandate & Terms of Reference
CERT Establishment
…is a team that performs, coordinates, and supports the response to
security incidents that involve sites within a defined constituency
• Operational Capacity
• Establishing Relationships
-- RFC 2350

16. In brief…
• Incident response is a multistakeholder effort
• CERTs are a part of a wider ecosystem
• Trust is central
• Tailor approach to meet local needs
• Start small with quick wins
• Commit long term, grow with demand/capability
16

17. Fa'afetai!
Thank You!
Klée Aiken
klee@apnic.net