Specifications of Mitigation Tools Sample Clauses

Specifications of Mitigation Tools. 4.1 Automatic Alerting and Opening Incidents Currently, malware and compromises are usually spread automatically. Due to the number of compromised hosts and the speed at which malware spreads, manual methods for incident or alert reporting fail. Instead, methods are required that automate this process and that include the following components: Automatic incident detection: The first step in the chain of automatic alerting are components to record attack or incident data. In GÉANT these are honeypots and components to record and analyse netflow data. Data analysis: To efficiently react to alerts, additional information about their scope and extend are required. In many cases, the attack data allows to reliably identify the vulnerability or the malware the attacking host is infected with. For example, if Dionaea captures the binary of the W32.Conficker worm, the source itself is likely to be compromised by this worm. This can also be applied to SSH password guessing attacks and the majority of known malware. Contact information: It is crucial to know to which contact the alert should be sent. This information is stored in a database, which assigns networks, autonomous systems or IP addresses to contacts. Thus, the database allows identifying the appropriate contacts for a list of systems or networks which produced the alert. Format for incident or alert data exchange: An appropriate format for the exchange of alert or incident data is ARF or the extended X-ARF (see X- ARF Format on page 29). This format contains machine- as well as human-readable parts. Because of its lightweight, though structured, form it is increasingly used by CERTs for data exchange. Infrastructure for the automatic distribution of incident data: An infrastructure is required that interconnects all components. This includes the authentication of the communicating sites as well as the security of the alert data on the transport. Although automated solutions for distributing incident reports exit on the layer of autonomous systems, they will need to be extended to a larger constituency or ideally to the appropriate administrative contact.