Trainees will be assumed to be competent system administrators and users, with an awareness of the security issues involved in connecting computers to the Internet. They must be committed to using their skills to improve the security of computers and networks. To protect the interests of other delegates, reference may be made to employing organisations before places on the course are confirmed.
For the technical sections of the course, familiarity with the normal operation of TCP/IP networks, addresses and protocols will be assumed.
Describes how CSIRTs fit into their organisations: planning the CSIRT, defining the constituency of the team and gaining management authority for it, deciding the services the team will offer, working with others in the organisation, working with those outside the organisation, staffing the CSIRT, funding. Students will be invited to discuss their own organisation and how their team fits into it.
Understanding how intruders attack systems: intruders and their motivations, network protocols and how they can be abused, operating systems and services, types of vulnerability, information gathering, breaking in, hiding traces, denial of service attacks. A number of exercises are used to show how these appear in practice.
Describes the facilities, systems and tools needed by CSIRTs to operate successfully: housing the CSIRT, equipment, e-mail, remote access, information and contacts, servers and networks, incident response plans and procedures, tracking systems. During the workshop exercise students will be invited to discuss and develop incident response plans for their own teams.
Looks at the areas of legislation that are likely to affect CSIRTs in their work and which team members need to be aware of: origins of computer legislation, problems, data protection, computer misuse, working with law enforcement, monitoring, evidence, European developments.
Discusses the roles that CSIRTs may decide to play in distributing and producing information about vulnerabilities: why do vulnerabilities exist, what should CSIRTs aim to do, sources of information and how to use them, advisories - distribution, interpretation, investigation and coordination.
