: +36 (1) 336 4833
: +36 (30) 344 0704
: Incident reporting
: csirt@nki.gov.hu
Types of incidents and level of support
NCSC Hungary is authorized to address all types of computer security incidents which occur, or threaten to occur, in Hungary. The level of support given by NCSC Hungary will vary depending on the type and severity of the incident or issue, the type of constituent, the size of the user community affected, and NCSC Hungary’s resources at the time, though in all cases some response will be made within one working day. Computer security incidents at organizations registered at NCSC Hungary will always receive priority over incidents at unregistered organizations.
Co-operation, Interaction and Disclosure of Information
While there are legal and ethical restrictions on the flow of information from NCSC Hungary, NCSC Hungary acknowledges its indebtedness to, and declares its intention to contribute to, the spirit of cooperation that created the Internet. Therefore, while appropriate measures will be taken to protect the identity of members of our constituency and members of neighbouring sites where necessary, NCSC Hungary will otherwise share information freely when this will assist others in resolving or preventing security incidents.
In the paragraphs below, “affected parties” refers to the legitimate owners, operators, and users of the relevant computing facilities. It does not refer to unauthorized users, including otherwise authorized users making unauthorized use of a facility; such intruders may have no expectation of confidentiality from NCSC Hungary. They may or may not have legal rights to confidentiality; such rights will of course be respected where they exist.
Information being considered for release will be classified as follows:
Private user information is information about particular users, or in some cases, particular applications, which must be considered confidential for legal, contractual, and/or ethical reasons. Private user information will not be released in identifiable form outside NCSC Hungary, except as provided for below. If the identity of the user is disguised, then the information can be released freely (for example to show a sample .cshrc file as modified by an intruder, or to demonstrate a particular social engineering attack).
Intruder information is similar to private user information, but concerns intruders. While intruder information, and in particular identifying information, will not be released to the public (unless it becomes a matter of public record, for example because criminal charges have been laid), it will be exchanged freely with system administrators and CSIRTs tracking an incident.
Private site information is technical information about particular systems or sites. It will not be released without the permission of the site in question, except as provided for below.
Vulnerability information is technical information about vulnerabilities or attacks, including fixes and workarounds if they are available. Vulnerability information will be released freely, though every effort will be made to inform the relevant vendor before the general public is informed.
Embarrassing information includes the statement that an incident has occurred, and information about its extent or severity. Embarrassing information may concern a site or a particular user or group of users. Embarrassing information will not be released without the permission of the site or users in question, except as provided for below.
Statistical information is embarrassing information with the identifying information stripped off. Statistical information will be released and used in publications and other educational papers.
Contact information explains how to reach system administrators and CSIRTs. Contact information will not be released freely, except where the contact person or entity has requested that this not be the case. If NCSC Hungary has reason to believe that the dissemination of this information would not be appreciated, will deny to release any contact information.
Potential recipients of information from NCSC Hungary will be classified as follows:
Registered members of NCSC Hungary are entitled to information which pertains to the security of their own computer systems, even if this means revealing “intruder information”, or “embarrassing information” about another system. For example, if account aaaa is cracked and the intruder attacks account bbbb, user bbbb is entitled to know that aaaa was cracked, and how the attack on the bbbb account was executed. User bbbb is also entitled, if she or he requests it, to information about account aaaa which might enable bbbb to investigate the attack. For example, if bbbb was attacked by someone remotely connected to aaaa, bbbb should be told the provenance of the connections to aaaa, even though this information would ordinarily be considered private to aaaa. Registered members of NCSC Hungary are entitled to be notified if their computer systems are believed to have been compromised.
Unregistered constituents of NCSC Hungary will receive no restricted information, except where the affected parties have given permission for the information to be disseminated.
Statistical information may be made available to the constituents of NCSC Hungary. There is no obligation on the part of NCSC Hungary to report incidents to the community, though it may choose to do so; in particular, it is likely that NCSC Hungary will inform all affected parties of the ways in which they were affected, or will encourage the affected site to do so.
The public at large will receive no restricted information. NCSC Hungary communicates with the public mainly through its website https://nki.gov.hu/. Members of the public may find vulnerability, statistical, and contact information, other public data, and news on NCSC Hungary’s website. Any concerns about, or objections to information published on NCSC Hungary’s website should be addressed to the NCSC Hungary team at sajto@nki.gov.hu.
The computer security community will be treated the same way the general public is treated. While members of NCSC Hungary may participate in discussions within the computer security community, such as newsgroups, mailing lists (including the full-disclosure list “Bugtraq”), and conferences, they will treat such forums as though they were the public at large. While technical issues (including vulnerabilities) may be discussed to any level of detail, any examples taken from NCSC Hungary experience will be disguised to avoid identifying the affected parties.
Other sites and CSIRTs, when they are partners in the investigation of a computer security incident, will in some cases be trusted with confidential information. This will happen only if the foreign site’s bona fide can be verified, and the information transmitted will be limited to that which is likely to be helpful in resolving the incident. Such information sharing is most likely to happen in the case of sites registered at NCSC Hungary, unless they have objected to such information exchange at registration.
For the purposes of resolving a security incident, otherwise semi-private but relatively harmless user information such as the provenance of connections to user accounts will not be considered highly sensitive, and can be transmitted to a foreign site without excessive precautions. “Intruder information” will be transmitted freely to other system administrators and CSIRTs. “Embarrassing information” can be transmitted when there is reasonable assurance that it will remain confidential, and when it is necessary to resolve an incident.
Vendors will be considered as foreign CSIRTs for most intents and purposes. NCSC Hungary wishes to encourage vendors of all kinds of networking and computer equipment, software, and services to improve the security of their products. In aid of this, a vulnerability discovered in such a product will be reported to its vendor, along with all technical details needed to identify and fix the problem. Identifying details will not be given to the vendor without most intents and purposes the permission of the affected parties.
Law enforcement officers will receive full cooperation from NCSC Hungary, including any information they require to pursue an investigation, in accordance with the law.
NCSC Hungary uses the Traffic Light Protocol (TLP) as described in FIRST Standards Definition and Usage Guidance (https://www.first.org/tlp/).
While handling Classified Information (including National, International, EU, NATO or other), NCSC Hungary will act in accordance of the Act CLV of 2009. on the Protection of Classified Information
Communication and Authentication
In view of the types of information that NCSC Hungary will likely be dealing with, telephones will be considered sufficiently secure to be used even unencrypted. Unencrypted e-mail will not be considered particularly secure, but will be sufficient for the transmission of low-sensitivity data. If it is necessary to send highly sensitive data by e-mail, PGP encryption will be used. Network file transfers will be considered to be similar to e-mail for these purposes: sensitive data should be encrypted for transmission or encrypted channels should be used during the transfer.
Where it is necessary to establish trust, for example before relying on information given to NCSC Hungary, or before disclosing confidential information, the identity and bona fide of the other party will be ascertained to a reasonable degree of trust. Referrals from known trusted people will suffice to identify someone. Otherwise, appropriate methods will be used, such as a search of FIRST members, the use of WHOIS and other Internet registration information, etc, along with telephone call-back or e-mail mail-back to ensure that the party is not an impostor. Incoming e-mail whose data must be trusted will be checked with the originator personally, or by means of digital signatures (in particular PGP is supported).
Reaction Time
NCSC Hungary will its best to have all reported incidents managed in a timely manner. During office hours we will start our incident handling process within 6 hours, while during duty period (weekends and holidays) we start our activities within 24 hours. In case of urgent matters, or issues with specific importance, or in case of serious incidents (as described in NIS Directive) NCSC Hungary will start the incident handling process within 2 hours.
Services
Incident Response
NCSC Hungary will assist system administrators in handling the technical and organizational aspects of incidents. In particular, it will provide assistance or advice with respect to the following aspects of incident management:
Incident Triage
Investigating whether indeed an incident occurred.
Determining the extent of the incident.
Incident Coordination
Determining the initial cause of the incident (vulnerability exploited).
Facilitating contact with other sites which may be involved.
Facilitating contact with law enforcement, if necessary.
Making reports.
Composing announcements to users, if applicable.
Incident Resolution
Analyzing and if possible removing the vulnerability.
Securing the system from the effects of the incident.
Collecting evidence where criminal prosecution, or community disciplinary action, is contemplated.
In addition, NCSC Hungary will collect statistics concerning incidents which occur within or involve its constituency, and will notify the community as necessary to assist it in protecting against known attacks.
To make use of NCSC Hungary’s incident response services, please send e-mail.
Proactive Activities
Intrusion Detection Services
NCSC Hungary ‘s intrusion detection service can keep a watchful eye on a client’s system and can give you an early alert about successful virus or hacker attacks, thus security issues can be handled, before they become a serious problem.
Security Audits
NCSC Hungary offers security audits on information technology systems. We will provide valuable information in determining the risk related to any specific IT system or we can actually perform the risk assessment of a supported organization. Such an assessment can find the balance between maximizing security and minimizing costs, resulting in substantial savings. NCSC Hungary will help its clients get ready for the worst by providing business continuity and disaster recover planning solutions, so when a problem disrupts normal business operations, they will be among the first ones to get back on their feet.
Development of Security Applications
NCSC Hungary can also be commissioned to install, configure, maintain or even develop security applications. Our experts can evaluate the security of software applications, hardware, or IT services to help supported organizations choose the best products available.
Malware Analysis
Malicious code can reduce work efficiency and system security, but only an expert can determine the threat of a software or document for an IT system. Any software, document or other suspicious code sent to NCSC Hungary will be analysed by our experts to find malicious code.
Technology Watch
IT security tools are developing at a fast pace, keeping up with upcoming threats. NCSC Hungary can determine the need for a new security tool, and develop effective deployment methods for its clients.
Security Consultancy
NCSC Hungary, with the support of its external experts, can give advice on any security issue to its clients. The 70-30 rule is still effective, which means that most Security threats are coming from inside the organization, NCSC Hungary can provide educational materials and hold training sessions for their constituents, so employees and managers become part of the security, instead of being a security risk.
Notification of Incident
Computer security incidents should be reported to csirt@nki.gov.hu.
Awareness Raising Services
During its awareness raising duty, NCSC Hungary is performing different types of activities. NCSC Hungary issuing a weekly newsletter about security, we are giving lectures, presentations to our constituents as well as performing hidden Social Engineering activates upon request. We are also publishing vulnerability and malware descriptions, alerts and warnings.
Incident Reporting Forms
The Incident reporting form is available on https://nki.gov.hu. Incidents or related information can be reported via email on csirt@nki.gov.hu or via the phone on +36 (1) 336 4833.
Disclaimers
While every precaution will be taken in the preparation of information, notifications and alerts, NCSC Hungary assumes no responsibility for errors or omissions, or for damages resulting from the use of the information contained within.
The RFC2350 document regarding NCSC’s incident management can be downloaded from this link. PGP signed document can be downloaded from here.
