Welcome to the CERN School of Computing

• Sebastian Lopienski (CERN)

Self-presentation: 1 minute per person

Opening Session

• Sebastian Lopienski (CERN)

Security in research and scientific computing (Introduction)

• Stefan Lueders (CERN)

* computer security: past, present and future * current risk landscape * most common threats and attack vectors * "why are we here?"

Announcements

Security operations - lecture 1 (Introduction)

• Sven Gabriel (Nikhef)

* security operations: history, CERT vs. CSIRT * CSIRT organisation and provided services * preparations: asset management, security monitoring etc. * incident response readiness * lessons learned from past incidents

Study time and/or daily sports

Security operations - lecture 2 (Introduction)

• Sven Gabriel (Nikhef)

* security operations: history, CERT vs. CSIRT * CSIRT organisation and provided services * preparations: asset management, security monitoring etc. * incident response readiness * lessons learned from past incidents

Identity, authentication, authorisation (Track 1: Protection and prevention)

• Hannah Short (CERN)

* authentication and authorisation for distributed research * federated identities, identity assurance, trust * SSO, OpenID, multifactor authentication, certificates, SAML, OAuth2 authentication tokens etc. * dealing with compromised identities

Security architecture (Track 1: Protection and prevention)

• Barbara Krašovec (ISJ)

* how to design and provide secure computing infrastructure * hardware and OS security, system hardening * configuration management, DevSecOps, monitoring * secure network design, network segmentation, IPv6 security

Network design - exercise (Track 1: Protection and prevention)

• Barbara Krašovec (ISJ)

Risk and vulnerability management (Track 1: Protection and prevention)

• Sven Gabriel (Nikhef)

* risk analysis and risk mitigation * vulnerability lifecycle, monitoring, scanning * CVE, CVSS, CPE, CWE and related standards * special cases: vulnerable hardware, EOL systems etc.

Virtualisation and cloud security (Track 1: Protection and prevention)

• Barbara Krašovec (ISJ)

School photo

Announcements

Logging and traceability (Track 2: Detection)

• David Crooks (UKRI STFC)

* host-based logs (system and application level), network monitoring * the importance of central logging * tools and technologies * data privacy, dealing with personal and sensitive data, log retention * traceability challenges

Study time and/or daily sports

Student lightning talks (Additional talks)

Intrusion detection with SOC: threat intelligence, monitoring, integration and processes (Track 2: Detection)

• David Crooks (UKRI STFC)

* indicators of compromise (IoCs), threat intelligence sharing, TLP protocol * tools and technologies: MISP, Zeek, OpenSearch etc. * deploying a Security Operation Center * security incidents: detecting and alerting

Introduction to web penetration testing (Track 1: Protection and prevention)

• Sebastian Lopienski (CERN)

* web application security, typical web vulnerabilities * ethical hacking * introduction to pentesting

Penetration testing - exercises (Track 1: Protection and prevention)

• Sebastian Lopienski (CERN)

Container security (Track 1: Protection and prevention)

• Daniel Kouřil (CESNET)

* key concepts of containers (namespaces, cgroups etc.) and Docker * container security, threat landscape * vulnerability and patch management

Container security - exercises (Track 1: Protection and prevention)

• Daniel Kouřil (CESNET)

Announcements

Intrusion detection with SOC: deployment and operation (Track 2: Detection)

• David Crooks (UKRI STFC)

* indicators of compromise (IoCs), threat intelligence sharing, TLP protocol * tools and technologies: MISP, Zeek, OpenSearch etc. * deploying a Security Operation Center * security incidents: detecting and alerting

Digital forensics: essentials and data acquisition (Track 3: Response)

• Daniel Kouřil (CESNET)

Incident response: policies and procedures (Track 3: Response)

• Romain Wartel (CERN)

* incident management and coordination * Sirtfi and trust frameworks * communication with local users, external communities, and other stakeholders * working with law enforcement * privacy aspects

Announcements

Digital forensics: data analysis (Track 3: Response)

• Daniel Kouřil (CESNET)

Study time and/or daily sports

Responding to security incidents as a community (Track 3: Response)

• Romain Wartel (CERN)

* incident management and coordination * Sirtfi and trust frameworks * communication with local users, external communities, and other stakeholders * working with law enforcement * privacy aspects

Intrusion detection with SOC - exercises (Track 2: Detection)

• David Crooks (UKRI STFC)

* indicators of compromise, threat intelligence sharing, TLP protocol * tools and technologies * deploying a Security Operation Center * detecting security incidents

Special evening talk: Ransomware - and much more! (Additional talks)

• Romain Wartel (CERN)

This is not about ransomware. It's about (double) extortion!

Digital forensics - exercises (Track 3: Response)

• Daniel Kouřil (CESNET)

Introduction to forensics - exercises (Track 3: Response)

Announcements

Penetration testing - exercise debriefing (Track 1: Protection and prevention)

• Sebastian Lopienski (CERN)

Study time

Exam

Incident response - exercise (Track 3: Response)

• Romain Wartel (CERN)

* incident management and coordination * Sirtfi and trust frameworks * communication with local users, external communities, and other stakeholders * working with law enforcement * privacy aspects

Closing Session

• Sebastian Lopienski (CERN)