The SIRTFI group is looking at processes for expressing security incident handling requirements as an assurance profile for federations and other requirements needed to effectively deploy and enhance incident response processes for FIM. This wiki page details information relating to that work.
The work of this group has been divided into three main phases:
Phase | Description | Work Items | Status |
---|---|---|---|
Phase 1 | Develop the SIRTFI Trust Framework specification, which defines basic security incident response capabilities to which member organizations can self-assert compliance. This initial draft is intended to be a simplified framework that lays the groundwork for how such an approach should be defined. Significant effort will be needed to understand how this might be deployed in the existing R&E FIM environment. |
| SIRTFI Consultation: Framework Sirtfi v1.0 approved by the REFEDS steering committee and published. Metadata extensions confirmed Guide for Federation Participants Sirtfi added to IANA assurance profiles registry. https://www.iana.org/assignments/loa-profiles/loa-profiles.xhtml |
Phase 2 | Establish the means by which member organisations in all R&E federations can indicate their compliance with the SIRTFI Trust Framework, how they can be contacted to participate in a coordinated response to a federated security incident. Define the roles and responsibilities of the various parties in managing federated security incidents, information sharing guidelines, tools, procedures, and templates. |
| Homepage https://refeds.org/sirtfi Metadata Guide for Federation Participants Moodle training course for Sirtfi developed under AARC Two annual table top exercises GN4-2 will support tools for maintaining security contacts and monitoring adherence. Survey and analysis of tool usage are in IR Communication Tools folder within the Sirtfi WG folder. The WG concluded that it is unrealistic to expect IR teams already using such tools within their domains to switch or use additional tools. The Sirtfi+ Registry concept was developed and pilot implementation occurred through the Geant incubator task. Interest in this work by its sponsors waned. The eduGAIN Security Incident Response Handbook was developed in partnership with the eduGAIN Security Team. Several incident response templates were developed. These have been suggested as starting points for use by the eduGAIN Security Team. Table top testing has been taken up by the Security Communications Challenge Coordination Joint Working Group. |
Phase 3 | Establish the means for proactive notification of an account compromise when it can be expected to produce a substantial impact to an at-risk SP organisation. |
| Sirtfi version 2. Responsiveness testing. IETF security events work was reviewed. Comparison to MISP became apparent. There is slow movement in several countries to broaden MISP deployment for conveying IoCs between organizations, driven by their security communities. Interim conclusion is that if the WG should undertake some action, it should be to reinforce the MISP uptake. Sirtfi adoption survey was used to gather data to take into account in developing version 2. Results are under consideration as of this update. Struck "Develop tools to help IdPs identify accounts that have been used to access specified SPs." as being unrealistic and of low value. |
Mailing list archive: https://www.terena.org/mail-archives/sirtfi/threads.html. has been migrated to https://lists.refeds.org/sympa/info/sirtfi. Join the SIRTFI list at: https://lists.refeds.org/sympa/info/sirtfi.
Technical Training Wiki: SIRTFI Home
Security Contact Metadata Extension: Security Contact Metadata Extension Schema
Sirtfi Home Page (Public Facing): https://refeds.org/sirtfi
Google WG folder: https://drive.google.com/drive/folders/1_4zo_qJdqz1ugZD9MfPUKt_OID6elHVr?usp=sharing
SIRTFI has been presented at the following events:
Material | Audience | Format | Link |
Benefits of Sirtfi | All | https://refeds.org/wp-content/uploads/2016/02/Why_Sirtfi.pdf | |
Technical changes | Fed Ops | Wiki | |
Outreach Package | Fed Ops | Wiki | Guide for Federation Operators#SampleOutreachLetterforFederationParticipants |
Steps to follow | Entities | Web Page | |
FAQs | Entities | Web Page | General: https://refeds.org/sirtfi/sirtfi-faqs |
Logo (to act as a trust mark on compliant sites) | Entities | Image | |
Sirtfi Framework Doc | All | PDF on Web Page | https://refeds.org/wp-content/uploads/2016/01/Sirtfi-1.0.pdf |
Summary poster | All | Poster | |
Sirtfi emailer helper | End users | Web page | http://sirtfi.cern.ch |
Sirtfi Moodle Course | Entities | Moodle | https://e-academy.geant.org/moodle/course/view.php?id=2 |