Re: Membership in REN-ISAC?

[Doug Pearson <dodpears () REN-ISAC NET>]

Matthew,

Matthew Wollenweber wrote:
> How restricted/reasonable is REN-ISAC  in terms of information sharing?
> Obviously you can't publish their restricted data, but I imagine they
> have a large collection of events that likely overlap with other data
> sets. If I were to publish results from my own data would and if I were
> a member of REN-ISAC would I have to check their database before
> publication?

REN-ISAC doesn't have say over information that you discover locally or
obtain through other channels, even if that information was discovered
locally using information shared within REN-ISAC. If you experience an
incident, that incident information is yours. That said, we encourage
everyone to be judicious about how and where sensitive information is
shared. Best not to tip our hands to the miscreants or to give them
reason to evolve their attacks. We do require that members don't poke
and prod evil sites identified in our shared information, because
take-down efforts are likely already underway.

That, + what Wes said about peer trust, and his pointer to our
Information Sharing Policy.

Regards,

Doug Pearson
Technical Director, REN-ISAC
http://www.ren-isac.net
24x7 Watch Desk +1(317)278-6630




> On Mon, Jan 4, 2010 at 9:31 AM, Vik Solem <vik.solem () tufts edu
> <mailto:vik.solem () tufts edu>> wrote:
>
>     I recommend wording your job descriptions very carefully with an eye
>     on the requirements for ren-isac.  I've seen ren-isac refuse
>     membership for some because they didn't agree that the person should
>     have access, based on their job description.   ymmv
>
>     -Vik
>
>
>
>     On Dec 29, 2009, at 14:02 , Bob Bayn wrote:
>
>         Thanks, Joel (and everybody else).  I guess we'll sign up.
>          Happy new year to all.
>
>         Sounds like they honor the Chatham House Rule like at the
>         NetFocus conference.
>
>         Bob Bayn        (435)797-2396      Security Team coordinator
>          Don't let hackers use your computer when you aren't.
>          Turn off your computer at the end of your work day.
>         Office of Information Technology   at  Utah State University
>         ________________________________________
>         From: Joel Rosenblatt [joel () columbia edu <mailto:joel () columbia edu>]
>         Sent: Tuesday, December 29, 2009 11:28 AM
>         To: The EDUCAUSE Security Constituent Group Listserv
>         Cc: Bob Bayn
>         Subject: Re: [SECURITY] Membership in REN-ISAC?
>
>         Hi Bob,
>
>         I would highly recommend that you join if you can - there is
>         information and resources that will enhance your ability to
>         secure your University.  The only
>         caution is also a benefit in that the information is shared in a
>         closed community and you need to be aware of where you are when
>         you answer questions :-)
>
>         IHTH
>
>         Joel Rosenblatt
>
>         Joel Rosenblatt, Manager Network & Computer Security
>         Columbia Information Security Office (CISO)
>         Columbia University, 612 W 115th Street, NY, NY 10025 / 212 854 3033
>         http://www.columbia.edu/~joel <http://www.columbia.edu/%7Ejoel>
>
>
>         --On Tuesday, December 29, 2009 11:18 AM -0700 Bob Bayn
>         <bob.bayn () USU EDU <mailto:bob.bayn () USU EDU>> wrote:
>
>             Any recommendations or cautions about joining REN-ISAC?
>
>             http://www.ren-isac.net/
>
>
>     -Vik
>
>     Vik Solem
>     Sr. Applications Risk Consultant
>     Information Security
>     Tufts University UIT / 617-627-4326
>
>     Check Out the UIT Information Security Team blog
>     http://blogs.uit.tufts.edu/infosecteamblog/
>
>
>
>
> --
> Matthew Wollenweber
> mjw () cyberwart com <mailto:mjw () cyberwart com>
> 240-753-0281