pDNSSOC workshop

Jun 1, 2023, 9:00 AM → Jun 2, 2023, 4:00 PM Europe/Zurich

28/S-029 (CERN)

Romain Wartel (CERN)

This workshop focuses on the different means DNS logging information can be used to help protect the Research & Education (R&E) sector as a whole.

It covers architecture aspects (DNS, pDNS, logs vs aggregation, etc.), tooling (dnstap, pDNSSOC, MISP, etc.) and deployment strategies. It also explores cooperation avenues with initiatives like SIE Europe.

The overall intent of the workshop is to improve daily security operations and cooperation between R&E organisations, ranging from mature security teams to smaller, understaffed organisations.

pDNSSOC: "Correlating DNS logs with threat intel from MISP as a poor man’s SOC."

https://github.com/CERN-CERT/pDNSSOC

Thu, June 1

1 Introductions & round table

2 Discussion: Problem definition & communities involved

e-infrastructure problem space, pDNS data collections in Europe, key stakeholders.
In short, what are we trying to achieve with DNS/pDNS?

10:30 AM Coffee break

3 QUIC Transport Protocol

https://indico.cern.ch/event/1289144/

Speaker: Paul Vixie

12:00 PM Lunch

4 Trials and tribulations of getting pDNS from Higher Ed

Speaker: Chris O'Donnell

5 pDNSSOC

• pDNSSOC overview, design, functionalities, limitation, deployment model, and future.
• Integration options with SIE Europe

https://github.com/CERN-CERT/pDNSSOC

Speakers: Pau Cutrina Vilalta (CERN), Romain Wartel (CERN)

6 CERN Tour

A VIP guided tour of CERN facilities
16h CERN Antimatter factory (https://home.cern/science/accelerators/antiproton-decelerator)
17h CERN Data Center (https://home.cern/science/computing/data-centre)
18h CERN Control Centre (CCC), where LHC operations are conducted (https://op-webtools.web.cern.ch/Vistar/vistars.php)

Speaker: Stefan Lueders (CERN)

7 Dinner

Location and logistics will be confirmed.
Cheese likely.

Fri, June 2

8 Technical session: pDNSSOC, dnstap, pDNS

Continued technical discussions, demo and hands-on technical work

Speakers: Dr David Crooks (UKRI STFC), Pau Cutrina Vilalta (CERN), Romain Wartel (CERN)

10:30 AM Coffee break

And possibly French pastries

9 Technical session: pDNSSOC, dnstap, pDNS

Continued technical discussions, demo and hands-on technical work

Speakers: Dr David Crooks (UKRI STFC), Pau Cutrina Vilalta (CERN), Romain Wartel (CERN)

12:00 PM Lunch

10 Technical session: pDNSSOC, dnstap, pDNS

Continued technical discussions, demo and hands-on technical work

Speakers: Dr David Crooks (UKRI STFC), Pau Cutrina Vilalta (CERN), Romain Wartel (CERN)

11 Wrap up and next steps