CSIRT

20 December 2018 at 1:46pm

Incident Response Triage - Eradication, Recovery and Lessons Learned This is part two of a two-part blog set covering an overview of the Incident Response life-cycle. In response to an incident, the next life-cycle steps that follow the containment stage are the remediation steps; eradication of the threat, recovery of systems and lessons learned. This second article focuses on each of these stages, highlighting the important areas to consider within the remaining life-cycle steps.

12 November 2018 at 10:41am

Incident Response Triage

Incident Response Triage – identifying, scoping and containing an incident

9 July 2018 at 9:24am

The advantages of network segmentation

Running traditional flat networks is now an ageing model and it is an outdated assumption that everything on the inside of an organization’s network should be trusted.[1] By segmenting a network and applying appropriate controls, we can break a network into a multi-layer structure that hinders threat agents or actions from reaching hardened systems and restricts their movement across the network.

Jisc's security services at Digifest

John Chapman

3 March 2016 at 4:34pm

CSIRT

prevent duty

In case you weren’t able to get to Digifest, 2 security related talks that are worth a look at are:

15 July 2014 at 3:49pm

Survey on automated reporting from Janet CSIRT

The environment that Janet CSIRT works in is changing. Almost a decade ago, most of the incidents we dealt with would start with a complaint emailed to us by a human; this would result in a team member having five or ten open incidents, maybe even twenty on a busy day. Nowadays the majority of information we receive is sent to us from automated systems run by third parties; this means that much of our current work is relaying this information and chasing acknowledgements to and from customers.

9 July 2014 at 12:30pm

FIRST Conference 22/06/2014 - 27/06/2014

Janet CSIRT are a member of a global non-profit organisation called the Forum of Incident Response and Security Teams, or FIRST. There are a number of FIRST member events throughout the year including an annual conference.

14 October 2014 at 1:33pm

Incident statistics for June 2014

These statistics only relate to information collated by Janet CSIRT and do not provide an accurate sample of security activity across the research and education sectors. The figures are frequently more closely correlated to the activity of CSIRT and our detection of events rather than their actual rates of incidence. For example: a successful investigation by researchers into a botnet will cause that month's malware figures to rise even though the malware may have been active in previous months.

17 June 2014 at 4:00pm

CSIRTs and the distribution of sensitive data

Andrew's recent post on the legal issues of cleaning up after botnet infections has prompted me to write something about how the way that Janet CSIRT operates helps with these issues in our community.

16 June 2014 at 11:07am