Articles

EDU-CERT Description document according to RFC 2350

1. About this document

This document provides a description of EDU-CERT according to RFC 2350.it provides information about the CERT, how to contact the team, and describes its responsibilities and the services offered to its constituency.

 

1.1 Date of Last Update

This is version 1.00, published 16/01/2012.

 

1.2 Distribution List for Notifications

Notifications of updates are submitted to our mailing list < This email address is being protected from spambots. You need JavaScript enabled to view it. This email address is being protected from spambots. You need JavaScript enabled to view it. >. Subscription requests for this list should be sent to the Sympa list server at < This email address is being protected from spambots. You need JavaScript enabled to view it. This email address is being protected from spambots. You need JavaScript enabled to view it. >; the body of the message should consist of the word "subscribe".  Send the word "help" instead if you don't know how to use a sympa list manager.


This mailing list is moderated.

 

1.3 Locations where this Document May Be Found

the current version of this cert description document is available from the EDU-CERT website ; its URL is : http://www.educert.ma/en/CSIRT-descr.txt
يمكن الاضطلاع على النسخة العربية  على :
http://www.educert.ma/ar/CERT-descr.txt


Please make sure you are using the latest version.

 

1.4 Authenticating this document

Both the English and Arabic versions of this document have been signed with the MA-CERT's PGP key.  The signatures are also on our Web site, under:

  • http://www.educert.ma/en/CERT-descr.asc
  • http://www.educert.ma/ar/CERT-descr.asc

 

2. Contact Information

this section describes how to contact MA-CERT.

 

2.1 Name of the Team

"EDU-CERT": the Moroccan Academic Computer Emergency Response Team.

 

2.2 Address

EDU-CERT
CNRST, MARWAN
Angle avenue Allal El Fassi, avenue des FAR, Quartier Hay Ryad,
BP. 8027 Nations Unies, 10102 Rabat, MAROC
2.3 Time Zone
Casablanca (GMT-0:00, and GMT+1:00 from April 2 to July 31)

 

2.4 Telephone Number

+212 537 569 898

 

2.5 Facsimile Number

+212 537 569 899  (this is *not* a secure fax)

 

2.6 Other Telecommunication

None available.

 

2.7 Electronic Mail Address

< This email address is being protected from spambots. You need JavaScript enabled to view it. This email address is being protected from spambots. You need JavaScript enabled to view it. > This is a mail alias that relays mail to the humans on duty for the EDU-CERT.

 

2.8 Public Keys and Other Encryption Information

The EDU-CERT has a PGP key, whose KeyID is aaaaaaaaaa  and whose fingerprint is 686D 781C 4CBF 034A 6D03 B105 F9BD 33F6 F621 AE1D.
The key and its signatures can be found at the usual large public keyservers.
Because MA-CERT is still in it’s first year of existance , this key still has relatively few signatures; efforts are underway to increase the number of links to this key in the PGP "web of trust".

 

2.9 Team Members

Team Lead is Karim OUSTOUH. A complete list of team members can be found at :
http://www.educert.ma/teamlist.html
Management, liaison and supervision are provided by Redouane Merrouch, ICT Director of CNRST and head of MARWAN network.

 

2.10 Other Information

General information about the EDU-CERT, as well as links to various recommended security resources, can be found at : http://www.educert.ma/

 

2.11 Points of Customer Contact

The preferred method for contacting the EDU-CERT is via e-mail at < This email address is being protected from spambots. You need JavaScript enabled to view it. This email address is being protected from spambots. You need JavaScript enabled to view it. >; e-mail sent to this address will be delivered appropriate team members, or be automatically forwarded to the appropriate backup person, immediately.  If you require urgent assistance, put "urgent" in your subject line.
If it is not possible (or not advisable for security reasons)to use e-mail, the team can be reached by telephone during regular office hours.
The MA-CERT's hours of operation are generally restricted to regular business hours (09:00-17:00 Monday to Friday except holidays).
If possible, when submitting your report, use the form mentioned in section 6.

 

3. Charter

This section describres EDU-CERT charter.

 

3.1 Mission Statement

EDU-CERT's mission is to coordinate and investigate security incidents regarding the Moroccan Academic Reasearch Wide Area Network (MARWAN), ans assist  its constituents in implementing proactive measure  to reduce the risk of such incidents to occur.

 

3.2 Constituency

Our constituency is defined to be institutions that are connected to MARWAN (Moroccan Academic and Research Area Network).
MA-CERT is responsible for this autonomous system: 30983.

 

3.3 Sponsorship and/or Affiliation

EDU-CERT is the Computer Security Incident Response Team (CSIRT) for the Moroccan academic and Research Network (MARWAN).
Funding is provided by the CNRST (National Center for Scientific and Technical Research ).

 

3.4 Authority

EDU-CERT operates under the auspices of, and with authority delegated by, the director of CNRST . we expect to work cooperatively with system and network administrators  of MARWAN connected institutions.

 


 4.Policies

This section describes EDU-CERT policies


4.1 Types of incidents and level of Support

The EDU-CERT is authorized to address all types of computer security incidents which occur, or  threaten to occur within its constituency.
The level of support given by MA-CERT will vary depending on the type and severity of the incident or issue, the type of constituent, the size of the user community affected, and the MA-CERT's resources at the time, though in all cases some response will be made within one working day.
We expect end users to contact their local systems or network administrators at the level of the connected institution.

 

4.2 Co-operation, Interaction and Disclosure of Information

MA-CERT will exchange all necessary information with other CSIRTs as well as with other affected parties if they are involved in the incident or incident response process. furthermore, unless explicitly authorized, appropriate measures will be taken to protect the identity of members of our constituency.

 

4.3 Communication and Authentication

For sensitive information exchanges we prefer encrypted and signed e-mail using PGP . For other communication phone, facsimile, postal service, or unencrypted e-mail may be used.

 

5.Services

This section describes services offred by EDU-CERT.

 

5.1 Incident Response

EDU-CERT will assist system administrators in handling the  technical and organizational aspects of incidents.  In particular, it will provide assistance or advice with respect to the following aspects of incident management:

5.1.1 Incident Triage

  • Investigating whether indeed an incident occured.
  • Determining the extent of the incident.

5.1.2 Incident Coordination

  •  Determining the initial cause of the incident  (vulnerability exploited).
  •  Facilitating contact with other sites which may be involved.
  •  Making reports to other CSIRTs.
  •  Composing announcements to users, if applicable.

5.1.3 Incident Resolution

  • Assure that security incidents are handled properly by the affected organisations.
  • Ask for feedback.
  • propose appropriate procedures.

 

5.2 Proactive Activities

  • Advisory service
  • Maintain a database of networks, sites and security contacts.
  • Mailing lists for security information.
  • Regular tutorials on security topics.
  • Network scans

 

6 Incident Reporting Forms

To report an incident, a web form is availaible at : http://www.educert.ma/reportincident.php
Incident reports should contain the following information

  • Incident date and time (including time zone)
  • Source IPs, ports, and protocols
  • Destination IPs, ports, and protocols


Preferable the report includes a log file in a common format.   


7 disclaimers

While every precaution will be taken in the preparation of information, notifications and alerts, EDU-CERT assumes no responsibility for errors or omissions,  or for damages resulting from the use of the information contained within.

 

 

Security News

Copyright © 2012 EDU-CERT : the Moroccan Academic Computer Emergency Response Team. All Rights Reserved.