4th SIG-ISM Workshop - Agenda, Slides & Notes

Welcome and round of Introduction (Alf Moens - SURFnet)
Alf opened the meeting, outlined the agenda and invited all participants to introduce themselves. He then gave an update on the activities of WISE and Global CEO Forum Security working group and introduced the idea of regional collaboration of members of the SIG-ISM (members discussed this idea further at the end of the meeting - see notes below).

For more information on WISE, please check their website: https://wise-community.org/ and wiki pages: WISE Home. The next WISE meeting will take place on 27-29 March in Amsterdam, hosted by Nikhef. If you would like to participate, please register here: https://eventr.geant.org/events/2544

Update of SIG-ISM charter (revised) (Sigita)

Finalising the SIG-ISM mission statement (Urpo)

H2020 project PROTECTIVE (Brian Lee, Athlone Institute of Technology, Ireland)

For questions and comments, please contact Brian directly: blee@AIT.IE

H2020 project PROTECTIVE - Proactive Risk Management through Improved Situational Awareness. This project aims to develop an information sharing framework and advanced analytics to improve risk monitoring and information sharing for NREN and other CSIRTS.

OZON Cyber security Exercise (Sandy)

Link to the video (english subtitles available):

IKT16 Norwegian National, Intersectoral Exercise (Per Arne)

Working groups

The participants of the meeting split into two working groups, focusing on (1) creating an inventory for security officers and (2) minimal security measures for an NREN.

Working groups continued

Wrap-up from the working groups

WG 1: INVENTORY FOR SECURITY OFFICERS

The first working group identified what information to share with whom, how public the lists should be, set the primary and future goals for the WG. It was decided that the most immediate action is to design a structure for an online platform with clearly identified levels of publicity. Linda Cornwall (Linda.Cornwall@stfc.ac.uk) will be leading this. Sigita Jurkynaite will help with the set up of the wiki pages (level 1 & level 2 to start with) and privacy settings. The main page would have a table with a list of NRENs that leads to each individual institution's page. Those individual pages would contain information provided (and regularly edited) by the NREN staff.

To improve the communication within this and other groups, it was suggested that a chat room is created using Slack, Skype (or other) where members could discuss and share TLP White & Green information. This action is not urgent, but added to the planned achievements list for 2017.

Slides with the discussion points and conclusions from the WG session: Directory/Inventory - info sharing for security people

WG 2: MINIMAL SET OF SECURITY MEASURES

After discussing some basic points and requirements, identified in the previous meetings, this working group has set itself a goal to provide guidance on how to set up and run ISMS for NRENs. They are aiming on having the first documents published by the end of this year and complete the set of guidelines some time in 2018. Robert Tofte (rtofte@nordu.net) will coordinate this group. Sigita Jurkynaite will create a mailing list and inform the SIG-ISM members. The date and time for the first virtual meeting: 5 April at 13:00 CET. (contact Robert or Sigita if would would like to participate)

Regional collaboration: Which regions want to start?

Alf Moens, supported by the SIG-SIM Steering Committee members, presented the idea of collaboration in smaller (regional) groups, where more sensitive information can be shared and members could advise each other on day-to-day questions that are not discussed in the bigger group. The regional groups would be supported by the SIG-ISM. In some cases they would also be instrumental in getting new NRENs engaged in the international collaboration in this area of work. A few groups were identified:

NORDIC (+ BALTIC?) - Urpo Kaila suggested to take a lead and host a meeting in Finland this summer

BENELUX - Alf Moens will lead this

ENGLISH SPEAKING REGION (UK, Ireland) - James Davis tentatively agreed to lead this group

GERMAN SPEAKING REGION (Germany - Switzerland - Austria) - Christian Fotinger requested to get the contact details of the participants from this region to initiate potential regional collaboration

SOUTH (Spain - Italy - Portugal) - future

SOUTH-EAST EUROPE (Poland - Czech - Croatia - others?) - future

AFRICA (SANREN - UBUNTUNET - WACREN) - perhaps something that could be considered in the future.

Revised SIG-ISM Charter

Sigita Jurkynaite presented a revised version of the achievements/KPIs part of the charter, including the changes made during the workshop discussions. The group agreed on the proposal and set the deadlines for each KPI. The charter will be presented and considered at the GCC meeting on 24 Feb 2017.

AoB

Roderick Mooi (SANREN) and Renier Van Heerden (SANREN) will be in Europe for the TF-CSIRT & One Conference in the Hague and TNC17 in Linz, Austria. During the few weeks in between those events, they would like to visit some European NRENs and talk to security officers/CERTs.

If you would like to invite them to visit your institution, please contact Roderick: roderick@sanren.ac.za