🚀 go-pugleaf

Sorry for the late notice - I had forgotten that I had not posted 
this when I sent the announcement out to the mailing list.

This month's meeting:

  Pascal Meunier of the CERIAS lab at Purdue will present "CERIAS
  Tools for Vulnerability Management and Incident Response".  For
  those who don't know, CERIAS is Gene Spafford's security lab.  See
  http://www.cerias.purdue.edu. 

  The meeting will be this Wednesday, October 25, from 3-5 PM in Baker
  Systems 120.
    
  Abstract:

    Risk minimization is a race between crackers and IT professionals.
    It is the role of IT professionals to minimize the window of
    exposure.  However, reading Bugtraq, related newsgroups and
    polling other sources of information is time-consuming.  The
    expense of verifying the up-to-date status of systems is
    significant and may involve audits.  One approach is to use
    automated vulnerability scanning tools.  Another is to deduce the
    applicable vulnerabilities from the list of applications and
    services present on a host (a profile), without possibly
    objectionable active scanning.  We present a profiling tool
    (currently with manual entry) that automates vulnerability
    database searches and currently works with NIST's ICAT.  This tool
    also reports by email the appearance of new vulnerabilities that
    match profiles, thus trading the delay necessary for the
    vulnerability to appear in the database for convenience, reduced
    manpower and manageability.

    The second tool that we are developing is a web-based cooperative
    vulnerability database, designed for the sharing of sensitive
    vulnerability information.  The database sports an enhanced
    scientific classification system that also helps research.

    Information about the incidence of security breaches is difficult
    to obtain.  Emergency situations are not favorable to the
    maintenance of records, the security breaches are embarrassing and
    possibly damaging, and disclosing information about the incidents
    may reveal some sensitive information.  Moreover, the nature of
    the incident and its cause are not always fully known.  Because of
    this, the frequency and cost is difficult to assess by type of
    incident.

    The CIRDB (CERIAS Incident Response DataBase) project attempts to
    provide a framework to record incident information and duration.
    Domains provide confidentiality to match areas of responsibility,
    with multi-level access.  Information about the incident can be
    shared on a case-by case basis with outsiders (e.g., CERT).  Email
    support provides a time-stamped log of the incident.  A
    classification system used with profiles will attempt to provide
    lists of vulnerabilities relevant to specific incidents by doing
    queries of the ICAT database.  With this system, we hope that 1)
    organizations using the same type classification can directly
    share data; 2) organizations not using the same type
    classification can translate data based on the properties of the
    types formalized in the CIRDB; 3) statistical data from many
    different organizations can be assembled to present a coherent
    picture of incident costs and frequencies on a national scale.

  Bio

    Pascal obtained a bachelors degree in Physics from Laval
    University, and a Ph.D. in Biophysics from l'Universit<E9> du
    Qu<E9>bec.  He came to Purdue University to learn molecular
    biology in 1993, but ended up taking classes in computer science
    and got hooked trying to make a computer sing passwords.  He
    "blames" both Mike Atallah and Spaf for getting him interested in
    information security.

    Pascal began managing the Vulnerabilities Database and Incident
    Response Database projects as a graduate student. He joined
    CERIAS in a research scientist capacity in May of this
    year. Pascal provides research direction, management, and support
    for several of the projects within the Center.

About these meetings:

  The Network Security Group meetings are usually held on the fourth
  Wednesday of each month from 3-5 PM on the Ohio State University
  main campus in Columbus (usually in Baker Systems 120).  The goal of
  our meetings is to share information about computer security tools,
  practices and problems.  Anyone and everyone are invited to attend.

  We also have mailing lists for people who are interested in
  discussing network security issues, or who just want announcements
  about meetings and security bulletins.  Send mail to
  romig@net.ohio-state.edu for more information.

  Note that this is *not* the same as the bi-weekly security lunch at
  Battelle (the AEGIS group), though you are welcome to attend
  either.  For more information about AEGIS, please contact me.

  See http://www.net.ohio-state.edu/security for information about the
  services that we provide, future meetings, resources, contact
  information, directions, mailing lists, free money (just kidding!)
  and so on...

--- Steve