Hmmm, I would rather see a coordinated action here, rather than just one or the other organisation "taking over" a function, regardless of their other services. Wouldn't that be a classical scenario for a Call for Tender? Another thought: as the person responsible for the SWITCH CERT, my impression is that one of the foundations of running a CERT/CC is trust (ie.e. a customer has to trust me that I will handle his/her security problem in a knowledgeable AND confidential way, also a CERT provider has to trust his/her customers to a certain degree). Such trust can only be built over time, so an European CERT/CC should in my opinion be based on one or more existing national CERTs, with that particular experience in place (and I'm not only talking about purely technical experience, see above). CHeers --HaL PS: In the original message from DANTE, a corresponding DANTE mailing list was mentioned, and I have asked to be included in that list. So far, I have not received any feedback on this. Is this list active at all? PPS: Looking at the headers of the individual messages sent so far, this discussion is addressed to a lot of lists, and a number of individuals. Could we please keep this discussion within a defined set of lists? -- /==========================================================================\ | Hannes P. Lubich Voice: +41 1 268 15 55 (direct) 15 50 (line) | | SWITCH Head Office Fax : +41 1 268 15 68 | | Limmatquai 138 Mail : lubich@switch.ch | | CH-8001 Zurich Mail : S=lubich; O=switch; P=switch; A=arcom; C=ch; | | Switzerland Phys : 47 23'N, 8 33' E, GMT + 1 | | More : "finger @macHaL.switch.ch" (if switched on) | \==========================================================================/
is that one of the foundations of running a CERT/CC is trust (ie.e. a customer
yes - it is also clear to me that you need an open model: security breaches are infectious - we therefore need open, and subsidized dissemination of alarms, problem reports and fixes, erring o nthe side even of letting the bad guys know we know the problems....or even occasionally leaking newly discovered security holes to new bad guys (albeit as rarely as possible) to this end, any organisation that takes this on should be non-commercial and non-governmental folks like CERN have a good record - ukerna (ex JNT) similalry some of the new providers do NOT exude this feel one iota.... cheers jon
participants (2)
-
Hannes Lubich -
Jon Crowcroft