🚀 go-pugleaf

This month's meeting:

  Mowgli Assor of the OSU Incident Response Team will talk about and
  demonstrate SITAR and IDB.  SITAR is an incident tracking system,
  which we use in the OSU team for day to day work.  IDB is the
  intrusion detect database, which records events recorded for each
  day.

  As Mowgli describes them:

    When looking at incident tracking systems early on, we found that
    the current set either weren't specific to security incident
    tracking, or were somewhat cumbersome to use. We decided to
    develop our own, so that they would be platform-independant, and
    yet as cheap (economically) as possible. To this end, we are using
    free (at least for educational institutions) software.

    We came up with two separate projects, called IDB and SITAR. IDB
    is a fairly generic incident database, which simply contains the
    fact that an incident occurred, and what source we received it
    from. This database is designed to be shared with other entities
    (including some external to the university). It contains data we
    don't consider secret.

    SITAR is a much deeper incident tracking system, designed to
    handle the various issues we deal with in tracking an incident -
    E-mail, files/tarballs, notes, etc. As such, this data is secret,
    and is designed to only allow access to members of the incident
    response team.

    Both systems work together to allow us to track an incident, and
    to see general trends in attacks or perceived attacks at the Ohio
    State University.

  You can view Mowgli's bio at
  http://www.net.ohio-state.edu/security/bios/mowgli-assor.html.  

  The meeting will be Wednesday March 22 from 4-6 PM in Baker Systems
  120. 

About these meetings:

  The Network Security Group meetings are usually held on the fourth
  Wednesday of each month from 4-6 PM on the Ohio State University
  main campus in Columbus (usually in Baker Systems 120).  The goal of
  our meetings is to share information about computer security tools,
  practices and problems.  Anyone and everyone are invited to attend.

  We also have mailing lists for people who are interested in
  discussing network security issues, or who just want announcements
  about meetings and security bulletins.  Send mail to
  romig@net.ohio-state.edu for more information.

  Note that this is *not* the same as the bi-weekly security lunch at
  Battelle (the AEGIS group), though you are welcome to attend
  either.  For more information about AEGIS, please contact me.

  See http://www.net.ohio-state.edu/security for information about the
  services that we provide, future meetings, resources, contact
  information, directions, mailing lists, free money (just kidding!)
  and so on...

--- Steve