1. Tom Barton (WG Chair) University of Chicago and Internet2
SIRTFI WG Update
Tom Barton (WG Chair)
University of Chicago and Internet2

2. SIRTFI - security incident response trust framework for federated identity
Be willing to collaborate in responding to a federated security incident.
Apply basic operational security protections to your federated entities
in line with your organization’s priorities.
Self-assert SIRTFI “tag” so that others will know to trust this about you.

3. Overall arc of work1 Sirtfi v1.0 and related Done
Establish means to indicate compliance and how to contact
Define roles and responsibilities of the various parties in managing federated security incidents, information sharing guidelines, tools, procedures, and templates
In process
Establish means for proactive notification of an account compromise when it can be expected to produce a substantial impact to an at-risk SP organisation
Queued
[1]

4. Current deliverables Incident Response in R&E Federations
Handbook intended to
minimise time to mount an effective response to an incident
increase sharing of useful non-confidential info
Per-role documents
Provide people with the details they need when they need it, material from the handbook by role
Template IR policies for fed operators
Give federations (& other orgs?) a starting point if they need it
SIRTFI website
Where to go for everything IR in R&E Feds

5. Incident Response for R&E Federations: Outline
Intro
What Triggers an Incident Response?
Stages of Federated Incident Response
On-Going Preparatory Activities
Handling the “Something’s Odd” Report and Opening an Incident
Adding New Members to the IR Team
Identify, Contain, and Eradicate
Recovery
Incident Wrap-Up
Table of All Roles and All Responsibilities
Appendices (sharing guidelines, templates, preparation guides)

6. Incident Response Team Support Organisation
An actual organisation is needed to anchor Fed IR processes, pay license costs, provide support staffing:
Maintain readiness of IR Team collaboration tools
Secure chat
Secure file drop
On-board persons to an IR Team
Coordination of “Something’s Odd” report and opening an incident
Incident coordinator, or identify each incident’s coordinator
Maintain SIRTFI website
Queued: possible role in implementing proactive notification

7. Related activities Sirtfi+ Registry incubation
GÉANT-developed security contact checking tool
InCommon POC for keeping security contacts fresh
eduGAIN security team
Security Communications Challenge Coordination Joint Working Group
WISE, SIG-ISM, IGTF, REFEDS, anyone who wants to pitch in
Any others, besides SIRTFI?
Established sharing and response centers: REN-ISAC, CSIRTs, ...