The purposes of GARR-CERT are:
To assist the users of the GARR Network implementing proactive measures to reduce the risk of computer security incidents;
To assist the users of the GARR network in responding to such incidents when they occur.
The GARR-CERT constituency is the community of the users of the GARR Network, the Italian Academic and Research Network.
GARR-CERT is an operative service of the GARR Consortium.
GARR-CERT operates under the auspices of the GARR members and the supervision of the GARR Consortium management.
In case of missing support from the local APM, it has authority to obtain from GARR NOC the filtering of the involved node(s) on the GARR network border routers.
Types of Incidents and Level of Support
GARR-CERT is authorized to address all types of computer security incidents that occur at nodes connected to the GARR network. The level of support given by GARR-CERT will vary according to the severity of the incident and the GARR-CERT's resources at the time.
Every effort will be done to give some response within one working day. No direct support will be given to end-users, as they are expected to contact their system administrators.
GARR-CERT expects that the APM of the sites involved in security incidents will cooperate in the resolution of the problem. The incident handling procedure, which, in extreme cases, will lead to filtering the compromised node(s) on the GARR network border routers can be found at (in Italian):
GARR-CERT is committed to keeping its constituency informed of potential vulnerabilities, possibly before they are actively exploited.
Co-operation, Interaction and Disclosure of Information
GARR-CERT, unless explicitly authorized, will not divulge the identity of nodes victims of computer security incidents.
Communication and Authentication
Telephone and unencrypted e-mail are considered sufficient for the transmission of low-sensitivity data. If it is necessary to send high sensitivity data by e-mail, PGP will be used. Network file transfers will be considered similar to e-mail for these purposes.
GARR-CERT will help system administrators of nodes connected to the GARR network in handling computer security incidents.
- Investigating the nature and extent of the incident;
- determining the initial cause (e.g. vulnerability exploited);
- keeping contacts with other sites involved;
- reporting to other CSIRTs;
- helping in removing the vulnerability.
To make use of GARR-CERT's incident response services, please use the methods listed in Section 2.11 (RFC 2350 ).
GARR-CERT coordinates and maintains the following services to the extent possible depending on its resources:
- mailing lists.
- auditing services;
- dissemination of information about vulnerabilities and recommended security measures;
- testing and developing security tools.
Incident Reporting Forms
If possible, use the following form to report a security incident:
While every precaution will be taken in the preparation of information, notification and alerts, GARR-CERT assumes no responsibility for errors or omissions, or for damages resulting fron the use of the information contained within.
- read all GARR CERT - RFC 2350 description