<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-IN" link="blue" vlink="purple" style="word-wrap:break-word"> <div class="WordSection1"> Yes this simply adds to paperwork and extra coding. It should be relatively trivial with an abuse report / IR oriented ticketing system to separate out genuine DDoS from random desktop firewall complaints about port scans from spam reports from all the outright spam that directly reaches such accounts.<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: anti-abuse-wg <anti-abuse-wg-bounces@ripe.net> on behalf of Carlos Friaças via anti-abuse-wg <anti-abuse-wg@ripe.net> Date: Saturday, 11 June 2022 at 12:28 PM To: Ángel González Berdasco <angel.gonzalez@incibe.es> Cc: gert@space.net <gert@space.net>, anti-abuse-wg@ripe.net <anti-abuse-wg@ripe.net> Subject: Re: [anti-abuse-wg] Adding a "Security Information" contact?<o:p></o:p> </div> <div> Hi, (CSIRT hat on) I don't really agree with the vision where the taxonomy needs to be overloaded into object fields. I always perceived the abuse-c field already as the security-c. People interested in processing security/abuse issues will take messages received on the abuse-mailbox: seriously. Moreover, there are also irt objects. Regards, Carlos On Tue, 7 Jun 2022, Ángel González Berdasco via anti-abuse-wg wrote: > El mar, 07-06-2022 a las 13:14 +0200, Gert Doering escribió: >> Hi, >> >> On Tue, Jun 07, 2022 at 11:02:19AM +0000, Ángel González Berdasco via >> anti-abuse-wg wrote: >>> I don't think the problem would be to add a new attribute if >> needed. >>> The problem would be to *define* what should go there (and then get >>> everyone downstream to use that new attribute) >> >> This... so, what would you suggest? >> >> Gert Doering >> -- NetMaster >> -- > > I would use the Reference Security Incident Taxonomy (RSIT) as > the classification source, which is the taxonomy used by (most of) the > CSIRT community. See [1] > > So the PTY-MAXGROBECKER network could have: > > abuse-c: GROBECKER-ABUSE > > and the GROBECKER-ABUSE object: > abuse-mailbox: general@abuse.grobecker.info > abuse-mailbox-vulnerable: vulnerability-reports@abuse.grobecker.info > abuse-mailbox-fraud: fraudabuses@abuse.grobecker.info > > where 'vulnerable', 'fraud', etc. are the machine readable tags defined > in the RSIT for the values in the classification column. > > Thus, when CERT BUND wanted to report an unpatched Confluence, they > would have an incident of type: "Vulnerable ? Vulnerable System", find > that there is a 'abuse-mailbox-vulnerable' attribute and report it > there. > > Whereas if it was a phishing landing page (incident of type Fraud ? > Phishing), that would go to fraudabuses@abuse.grobecker.info (from > 'abuse-mailbox-fraud') > > But if it was a host sending out spam, (incident classification Abusive > Content ? Spam), having no "abuse-mailbox-abusive-content", it would > fall back to abuse-mailbox and direct it to > general@abuse.grobecker.info. > > > > Does something like this seem sensible to others? > > > Best regards > > > > 1- > <a href="https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force/blob/master/working_copy/humanv1.md"> https://github.com/enisaeu/Reference-Security-Incident-Taxonomy-Task-Force/blob/master/working_copy/humanv1.md</a> > > -- > INCIBE-CERT - Spanish National CSIRT > <a href="https://www.incibe-cert.es/">https://www.incibe-cert.es/</a> > > PGP keys: <a href="https://www.incibe-cert.es/en/what-is-incibe-cert/pgp-public-keys"> https://www.incibe-cert.es/en/what-is-incibe-cert/pgp-public-keys</a> > > ==================================================================== > > INCIBE-CERT is the Spanish National CSIRT designated for citizens, > private law entities, other entities not included in the subjective > scope of application of the "Ley 40/2015, de 1 de octubre, de Régimen > Jurídico del Sector Público", as well as digital service providers, > operators of essential services and critical operators under the terms > of the "Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de > las redes y sistemas de información" that transposes the Directive (EU) > 2016/1148 of the European Parliament and of the Council of 6 July 2016 > concerning measures for a high common level of security of network and > information systems across the Union. > > ==================================================================== > > In compliance with the General Data Protection Regulation of the EU > (Regulation EU 2016/679, of 27 April 2016) we inform you that your > personal and corporate data (as well as those included in attached > documents); and e-mail address, may be included in our records > for the purpose derived from legal, contractual or pre-contractual > obligations or in order to respond to your queries. You may exercise > your rights of access, correction, cancellation, portability, > limitationof processing and opposition under the terms established by > current legislation and free of charge by sending an e-mail to > dpd@incibe.es. The Data Controller is S.M.E. Instituto Nacional de > Ciberseguridad de España, M.P., S.A. More information is available > on our website: <a href="https://www.incibe.es/proteccion-datos-personales">https://www.incibe.es/proteccion-datos-personales</a> > and <a href="https://www.incibe.es/registro-actividad">https://www.incibe.es/registro-actividad</a>. > > ==================================================================== > > -- > > To unsubscribe from this mailing list, get a password reminder, or change your subscription options, please visit: <a href="https://mailman.ripe.net/">https://mailman.ripe.net/</a> ><o:p></o:p> </div> </div> </body> </html>