1. Clara CSIRTs in Latin America and the Caribbean CCIRN 2004 Cairns, Australia July 2004 Michael Stanton CLARA Technical Committee RNP- Brazil (material prepared by Liliana Solha, CAIS-RNP)

2. Brazilian Academic and Research Network CAIS/RNP: The Brazilian Academic and Research Network CSIRT Clara What do we have today? 17 million Internet users Many admins/users/mngt with no awareness of security issues Notorious hacker activity in some countries Difficulties on getting proper response from many whois contacts No regional communication infrastructure that allows coordinated response to security incidents Lack of specific laws for digital crimes in most of the countries. Different laws in different countries Very few CSIRTs (they´re not known or simply do not exist) Current security panorama in Latin America

3. Brazilian Academic and Research Network CAIS/RNP: The Brazilian Academic and Research Network CSIRT Clara Known CSIRTs in Latin America: Brazil CAIS/RNP [academic] NBSO [national networking coordination committee] and many others (http://www.nbso.nic.br/contato-br.html) Mexico UNAM – http://www.unam-cert.mx [academic] Peru TESIRT - http://www.telmex.com/pe/tesirt [a single ISP] Chile CLCERT – http://www.clcert.cl [national] Argentina ArCERT – http://www.arcert.gov.ar [government] Current security panorama in Latin America

4. Brazilian Academic and Research Network CAIS/RNP: The Brazilian Academic and Research Network CSIRT Clara International cooperation among CSIRTs and the importance of a regional initiative Bearing in mind that intruders use continually more sophisticated attack mechanisms, increasingly more automated and often with devatating consequences due to speed of propagation, international cooperation and coordinated response by CSIRTs to security incidents are essential. Cybernetic threats ignore national geographic limits. It is becoming clear there is a need for a regional security initiative and international cooperation between CSIRTs, given the increase in the number of CSIRTs which have been set up in LA&C, the number of incidents of global extent (i.e. involving sites in several countries) and the growing number of attacks on critical national infrastructures which have been perpetrated, of increasing sophistication, frequency and scale.

5. Brazilian Academic and Research Network CAIS/RNP: The Brazilian Academic and Research Network CSIRT Clara TF-CSIRT APSIRT Different Initiatives Why Not ? International cooperation among CSIRTs and the importance of a regional initiative

6. Brazilian Academic and Research Network CAIS/RNP: The Brazilian Academic and Research Network CSIRT Clara North America: Based on big state universities and private sector Europe: Based on research and academic network Asia Pacific: Based on government effort to build teams for the entire country (Japan, Australia, Korea, Singapore, etc). But, what fits better to Latin America? The important thing is… To stimulate all these processes and see which ones are going to start first and better How will the process of development of CSIRTs come?

7. Brazilian Academic and Research Network CAIS/RNP: The Brazilian Academic and Research Network CSIRT Clara CLARA recognises the importance of a regional CSIRT initiative - LACSIRT April 2004, CLARA set up a task force on security. One of the objectives is to promote the establishment of CSIRTs in LA&C and stimulate international cooperation between existing groups. June 2004, CLARA sends some potencial instructors to the Train the Trainers Workshop held in Budapest during the 16th FIRST Annual Conference (FIRST – Forum of Incident Response Security Teams -http://www.first.org). This workshop is the result of a partnership between TRANSITS and FIRST. CLARA and FIRST partnership 1st Training Course on CSIRT issues for Latin America NRENs will be held later this year, during 2004 CLARA assembly.

8. Brazilian Academic and Research Network CAIS/RNP: The Brazilian Academic and Research Network CSIRT Clara CLARA has recognised the importance of a regional CSIRT initiative Objetivos: The objectives of the LACSIRT include: Promote coordinated response to security incidents involving regional CSIRTs Facilitate correlation of data relative to security incidents in the region Provide a systemic of security incidents in AL&C Promote a greater awareness of security Develop best practices in the security area Provide a forum for exchange of knowledge and experience Establish pilot services for the regional community of CSIRTs Promote the development of standards ans response procedures to security incidents Encourage the development of new CSIRTs in the region, and staff training Collaborate with other similar regional initiatives

9. Brazilian Academic and Research Network CAIS/RNP: The Brazilian Academic and Research Network CSIRT Clara CAIS/RNP: http://www.rnp.br/cais CERT/CC: http://www.cert.org FIRST: http://www.first.org TRANSITS is organized by two partners, TERENA and UKERNA, and is supported by the European Commission. Further information at: http://www.ist-transits.org Contact: Liliana Solha, CAIS-RNP References