Incident Response Service (IRS) [was: Unneeded RIPE tasks]
To: ncc-services-wg@ripe.net From: Hank Nussbacher <hank@att.net.il> Subject: Re: [ncc-services-wg] Unneeded RIPE tasks Date: Fri, 22 Aug 2003 11:37:57 +0200
http://www.ripe.net/ripe/draft-documents/ap2004.html
Section 5: "Incident Response Service (IRS) Procedures will be set up to quickly provide RIPE NCC members, the Internet community and the general public with authoritative data about unusual events on the Internet, such as DDoS on the RIPE NCC."
Well, according to this text artefact, tihs can be many different things. From - putting a headline to an activity which every responsible organisation should undertake (to have a security role and to reasonably interact with other instances of such roles), to - trying to do things which others are doing already. Questions: 1) can we have a more elaborate description from the NCC of what activities are expected to be performed under this headline? 2) is there any WG which could be polled or which has "adopted" this activity for definition and development (or is expected to do so)? Answers to these Qs would make it much easier for me to be in favor or against :-) Wilfried.
On 22.08 19:39, Wilfried Woeber, UniVie/ACOnet wrote:
Questions: 1) can we have a more elaborate description from the NCC of what activities are expected to be performed under this headline?
ripe-271 says: "We will respond to Internet incidents and events that generate a lot of public interest, such as the Sapphire worm of 25.01.03, by providing objective and comprehensive data for use by the membership and the general public. http://www.ripe.net/ttm/worm/index.html" In other words: When something that generates interest happens we will expeditiously look at our measurement data, check what we see there, and publish a first analysis. We will keep doing this until the event is over and publish a final analysis. First examples of such reports are on the NCC web site. The most recent one being http://www.ripe.net/ttm/worm/nyc.html which is really a statement of "We saw nothing". This activity is triggered by numerous blatantly false guesses, often on the nanog list, which get wide press coverage and start to lead their own life. The one that pushed me to propose this was the one that made at least the NYT, Washington Post and "Der Spiegel" which said: "All root name servers were unreachable due to Sapphire"; this was based on a NANOG posting by someone doing pings to the roots from one location that was, lets say, neither well hardened nor well connected. I think it is in the Interest of the RIPE community to publish objective and verifyable data on such events and to develop confidence in it by journalists and public policy people in this data. I hope the RIPE community and the NCC membership agree.
2) is there any WG which could be polled or which has "adopted" this activity for definition and development (or is expected to do so)?
Not yet. This needs to be hashed out between ncc-services, ttm and tech-sec.
Answers to these Qs would make it much easier for me to be in favor or against :-)
Let me know if there are further questions. Daniel
participants (2)
-
Daniel Karrenberg -
Wilfried Woeber, UniVie/ACOnet