FedCIRC simplifies incident reports
Connecting state and local government leaders
The Federal Computer Incident Response Center has simplified its online reporting system for computer security breaches.
The Federal Computer Incident Response Center has simplified its online reporting system for computer security breaches.Civilian agencies are required to report such incidents to FedCIRC, hosted by the General Services Administration's Federal Technology Service.A new Web interface, developed by the CERT Coordination Center at Carnegie Mellon University in Pittsburgh, 'lets us collect events in a database and begin analysis and notification about events as they are being reported,' said Sallie McDonald, assistant commissioner in FTS' Office of Information Assurance and Critical Infrastructure Protection.Agency users can report on a short or long form. 'When you're in the middle of an incident, taking time to fill a long report can be bothersome,' McDonald said.'Most of the reports we get are on the short form,' said FedCIRC watch manager Jim Jones, who works for Science Applications International Corp. of San Diego. The short form gives FedCIRC analysts the minimum information they need to respond. After things calm down, the long form supplies more information.SAIC, which operates the FedCIRC watch center under contract to GSA, built the back-end tracking and analysis system. A lead analyst is on duty around the clock, backed up by other analysts during business hours.FedCIRC's response depends on the nature of the incident and the agency's own resources, Jones said. For minor incidents or agencies that have strong internal resources, FedCIRC notifies other agencies about the breach if necessary. For severe incidents or agencies that lack response capability, FedCIRC can step in.Creating the new reporting system presented little technical challenge. 'A Web front end to a Structured Query Language database is not rocket science,' Jones said.The forms, which went live late last year at , follow evolving industry standards and were developed with the PHP scripting language, similar to Perl. They reside on a server running Apache Web freeware.'By the time the information gets to an analyst, it's pretty well standardized,' Jones said. 'We know we're collecting the right stuff now.'The short form has drop-down menus for filling in fields. The previous version had no drop-down selections, which meant the reports were less than standardized.'We learned a heavy lesson from that,' Jones said. Now only about 20 percent of the fields on the short form are required for submission. 'We erred on the side of user friendliness,' he said.The long form asks for more data and is interactive'subsequent questions depend on previous answers.Both forms have Secure Sockets Layer encryption. At FedCIRC, they automatically populate the incident database and are encrypted with technology from PGP Corp. of Palo Alto, Calif. They also go automatically to the CERT Coordination Center.Analysts get e-mail notification of each incident. They search reports by the day, week and month, looking for trends or anomalies.In one weekly report, analysts saw a spike in Port 80 probes. No incident was significant alone, but taken together they revealed the first propagation of a new Internet worm, Jones said. Agencies got an early warning.McDonald said feedback about the reporting system is favorable, but she said she doesn't know whether it has drawn more incident reports. Discounting anomalous spikes, the old system reported 250 and 310 incidents in November and December 2001, respectively. Under the new system, November and December 2002 saw 348 and 331 incidents, respectively.'We're getting better management reports out of FedCIRC,' McDonald said. 'It's a lot easier to see what is coming in and when. When I tell my staff I need some information, they are getting back to me a lot more quickly.'
Web interface speeds processing when agencies report systems breaches
Constant surveillance
www.fedcirc.gov
It adds up
'When you're in the middle of an incident, taking time to fill a long report can be bothersome.'
'FTS' Sallie McDonald
Henrik G. DeGyor
Constant surveillance
www.fedcirc.gov
It adds up
NEXT STORY: Security, bandwidth occupy network managers