Name: GÉANT Security Days 2024
Start: 2024-04-09T08:45:00+02:00
End: 2024-04-11T17:00:00+02:00
Location: Grandior Hotel

GÉANT Security Days 2024

from Tuesday, April 9, 2024 (8:45 AM) to Thursday, April 11, 2024 (5:00 PM)

Monday, April 8, 2024
Tuesday, April 9, 2024
9:00 AM Cyber Threat Intelligence Workshop - Roderick Mooi (GÉANT)
Cyber Threat Intelligence Workshop
- Roderick Mooi (GÉANT)
9:00 AM - 12:30 PM
This workshop will unpack initiatives and ideas emerging from the CTI subtask of WP8 T3. NREN participants will present their use cases for threat intelligence and journeys towards realising them; from collecting, validating, correlating with flow data and acting on indicators. We will also present aspects of our planned R&E Security Intelligence Hub - an ISAC-like virtual organisation facilitating the exchange of threat intel within and beyond the GÉANT community. Come join us and share your thoughts! The following use cases will be presented: - SURF: Modern flow analysis: nfdump2clickhouse experiences - HEAnet: Threat Intel Visualised - CYNET: Secure Collaboration & Intelligence Information Sharing Platform (SCIISP) - DeiC: pDNSSOC: Leveraging MISP indicators via a pDNS-based infrastructure as a poor man’s SOC - SUNET: C2-scanner - PSNC: Malware analysis services for CTI - GÉANT: CTI and the R&E Security Intelligence Hub: Plans for GN5 projects and beyond Note: all presentations are TLP:GREEN (limited disclosure [community only])
Joint SIG-ISM/ WISE Meeting
Joint SIG-ISM/ WISE Meeting
9:00 AM - 5:00 PM
Contributions

9:00 AM Legislation and the impact of new requirements in the Information Security Management System - Alf Moens Floor Jas (SURF) Ivana Jelacic (CARNET)

11:00 AM Implementation: How organizations are preparing to respond to these requirements and new challenges - Ana Alves Andrea Kropacova (CESNET) David Groep (Nikhef and Maastricht University) Helma de Boer (SURF) John Chapman (Jisc) Rolf Sture Normann

1:30 PM Monitoring: What kind of controls are in place to protect our systems, network, and the services provided. It's a slightly more technical approach, mixing perspectives from both information and systems managers - Ana Alves Carlos Friaças David Heed Rolf Sture Normann Ryan Richford (GÉANT) Simona Venuti

3:30 PM Training and Awareness: How NRENs are preparing their staff for all security challenges. - Cornelia Puhze (SWITCH) Davina Luyten Rolf Sture Normann Zoe Fischer
10:30 AM Coffee Break
Coffee Break
10:30 AM - 11:00 AM

12:30 PM LUNCH
LUNCH
12:30 PM - 1:30 PM
1:30 PM Security Products and Services - Charlie van Genuchten (SURF) Jennifer Ross (GÉANT)
Security Products and Services
- Charlie van Genuchten (SURF)
- Jennifer Ross (GÉANT)
1:30 PM - 5:00 PM
This interactive session will be a chance to gain insight into which (kinds of) security products and services we as NRENs are running and creating for our members. Attendees will be invited to exchange ideas and experiences to see if there are things we can learn from each other, see if a more consistent experience exchange would be valuable and discuss the services GÉANT is running centrally. More information about this side meeting is available on the <a href="https://wiki.geant.org/display/GWP8/Side+Meeting+Products+and+Services+at+SD24">GÉANT wiki</a>.
3:00 PM Coffee Break
Coffee Break
3:00 PM - 3:30 PM
Wednesday, April 10, 2024
9:00 AM Plenary
Plenary
9:00 AM - 10:30 AM
Contributions

9:00 AM Welcome to GÉANT Security Days - Klaas Wierenga

9:10 AM Welcome from CESNET - Andrea Kropacova

9:20 AM Changing Landscape of Security for NRENs

9:40 AM Moving the Goal to Post Quantum - Roland van Rijswijk-Deij (University of Twente)
10:30 AM Coffee Break
Coffee Break
10:30 AM - 11:00 AM
11:00 AM Session 1
Session 1
11:00 AM - 12:30 PM
Contributions

11:00 AM Human Factors in Security – Research vs. Current Practices - Cornelia Puhze (SWITCH)

11:30 AM Delivering cyber security training and education campaigns to the education and research sector - Mark Tysom

12:00 PM Beyond awareness: Challenges and triumphs in Cybersecurity Awareness - Rosanne Pouw (SURF)
Session 2
Session 2
11:00 AM - 12:30 PM
Contributions

11:00 AM Using an analytical database to augment nfdump/nfsen - Remco Poortinga (SURF)

11:30 AM Harnessing AI and Open-Source Tools for Enhanced IT Security Vulnerability Assessment - Joost Grunwald

12:00 PM Extending UEBA for emerging threat, detection, characterisation and intelligence generation - Sonu Preetam (i2CAT) Xavier Marrugat (i2cat)
12:30 PM Lunch
Lunch
12:30 PM - 1:30 PM
1:30 PM Session 3
Session 3
1:30 PM - 3:00 PM
Contributions

1:30 PM Hijacks -- why should we care? - Carlos Friaças (RCTS CERT (FCCN))

2:00 PM Modular transport layer solution for semi/automated protection of infrastructure, communities and users in CESNET3 network - Tomáš Košňar (CESNET, association of legal entities)

2:30 PM Real world DDOS attack examples and tips how to survive - Vladislav Bidikov (MARNET / UKIM)
Session 4
Session 4
1:30 PM - 3:00 PM
Contributions

1:30 PM Resilience in Action: Lessons from SURF's Red Team Testing Initiatives - Joost Gadellaa

2:00 PM eduVPN Operation at the Leibniz-Supercomputing Centre - Markus Meschederu

2:30 PM Phishingator – The way how to automated training - Martin Šebela (CESNET)
3:00 PM Coffee Break
Coffee Break
3:00 PM - 3:30 PM
3:30 PM Lightning Talks
Lightning Talks
3:30 PM - 5:00 PM
Contributions

3:35 PM Exploring machine learning for DDoS mitigation - Jakub Man

3:40 PM Why cybercrime is an evolution rather than a revolution - Nicole van der Meulen

3:45 PM SOCCER project: Supporting establishment of university SOCs and collaboration in academic sector - Václav Bartoš (CESNET)

3:50 PM Crisis communication in the event of a cyber attack: why “no comment” is not an option - Davina Luyten

3:55 PM CLAWHAMMER – One Tool To Rule Them All - Renato Furter

4:00 PM Granny Smith, an unusual cyber criminal - Rosanna Norman

4:05 PM Crossing the Baseline - Elevating Security Maturity through the Security Bootcamps - Ana Alves

4:10 PM NETSEC-SIG @FIRST - Carlos Friaças (RCTS CERT (FCCN))

4:15 PM Why you can't trust your e-mail client - Jeroen Wijenbergh

4:20 PM Community for Integrating and Opening Cyber Range Infrastructures - Panayiota Smyrli

4:25 PM Next Generation Security Operation Centres - Stephanos Andreou

4:30 PM Responding to a cyberattack - Birgit Ploetzeneder (ELI Beamlines)

4:35 PM Fighting NeMo - Ryan Richford (GÉANT)

4:40 PM Let Me Hack You - Sigita Jurkynaite (TF-CSIRT)
7:00 PM

7:00 PM - 11:00 PM
Thursday, April 11, 2024
9:00 AM Session 5
Session 5
9:00 AM - 10:30 AM
Contributions

9:00 AM The Research and Education Security Intelligence Hub - Roderick Mooi (GÉANT)

9:30 AM Why collaboration tastes like more. - Floor Jas (SURF) Wim Biemolt

10:00 AM How We Knitted Our SOC (or HEAnet's SOC & SIEM Project) - Brian Nisbet (HEAnet)
Session 6
Session 6
9:00 AM - 10:30 AM
Contributions

9:00 AM Security of bespoke solutions vs academic curricula - Maciej Miłostan (PSNC)

9:30 AM Enhancing Security and Member Satisfaction with certified security and suitability classification of services - Helma de Boer (SURF)

10:00 AM Are Croatian universities ready for next level of cyber security? - Ivana Jelacic (CARNET) Marina Dimic Vugec (CARNET)
10:30 AM Coffee Break
Coffee Break
10:30 AM - 11:00 AM
11:00 AM
11:00 AM - 12:30 PM
Contributions

11:00 AM CISO Wanna be - Ana Alves

11:20 AM New Security Challenges for NRENS - Jan Kolouch (CESNET)

11:40 AM Lies are (not!) everywhere - Daniel Stach
12:30 PM LUNCH
LUNCH
12:30 PM - 1:30 PM
1:30 PM DDoS and Network Monitoring Workshop - Jochen Schoenfelder
DDoS and Network Monitoring Workshop
- Jochen Schoenfelder
1:30 PM - 5:00 PM
The session will be split in two parts, with the second part most possibly starting after a short break. Part 1: Threat sharing for proactive (D)DoS defence (co-host: Roderick Mooi) We will discuss ideas emerging from collaborative discussions between the CTI and DDoS subtask teams in WP8 Task 3. How can NRENs share actionable intel around (D)DoS attacks (with an emphasis on those targeting R&E) and better prepare our defences accordingly? Part 2: General DDoS tooling and attack discussions We will discuss the general DDoS situation, and current tooling & experiences from within the GÉANT project and the NREN community. While we won't be able to do a deep dive into recent events - as we won't go more retrictive than TLP:GREEN in this session, feel free to share your lessons learnd as well as tooling experiences.
1:30 PM - 5:00 PM
Contributions

1:30 PM Welcome - Davina Luyten

1:40 PM What is the Human Factor: what the research says/ what we do - Cornelia Puhze (SWITCH)

2:00 PM GÉANT Security Training and Awareness - Nicole Harris (GÉANT)

2:10 PM SURF Security Awareness Programme - Helma de Boer (SURF)

2:20 PM CESNET Security Awareness Programme - Andrea Kropacova

2:30 PM Jisc Security Awareness Programme - John Chapman (Jisc)

2:40 PM SWITCH Security Awareness Programme - Fabio Greiner (Switch)

3:30 PM Needs and Challenges of our Community - Davina Luyten

3:50 PM Informal discussion - Cornelia Puhze (SWITCH) Mark Tysom
3:00 PM Coffee Break
Coffee Break
3:00 PM - 3:30 PM