APCERT 2017 AGM and Conference: A Window into the CERT community

APCERT 2017 AGM and Conference: A Window into the CERT community

Introduction

This year’s APCERT Annual General Meeting and conference has just concluded, being hosted by CERT-In in New Delhi, India. Each year AusCERT sends a representative to the APCERT conference to collaborate and cooperate with the rest of the APCERT community. This year, I was lucky enough to be selected to attend.

APCERT is a community of CERT and CSIRT organisations located in the Asia-Pacific area. Originally formed in 2003, its membership has now grown to 30 organisations representing 21 economies, as well as a number of supporting partner organisations. APCERT’s goals include information sharing and cooperation between its members and the public.

Arriving in New Delhi

This was my first visit to India, and although I had some knowledge of Indian culture and life, I was amazed to experience it first-hand. I arrived one day before the conference began, and spent the day shopping and taking in the local sights. The bustling streets, chaotic traffic, and the sheer scale of the country are a sight to see, and offer a sharp contrast to the quiet suburban life I am used to back in Brisbane. Delhi itself is a massive city, with a population that rivals that of all of Australia.

The conference itself was hosted at the Ashok hotel, in Chanakyapuri, New Delhi. This five-star hotel is located in the heart of a diplomatic and government district, close to many foreign embassies, and as a result is very accommodating to foreign guests.

The APCERT Community

When the conference registration opened on Sunday morning, I began meeting delegates from other APCERT members. I noticed immediately that everyone was friendly, relaxed, and very welcoming. The APCERT community is small and close-knit, and for some long-time members, the conferences are just as much of a catch-up session as they are a business trip. Apparently some of AusCERT’s staff are quite famous in the APCERT community, as I received quite a few queries regarding some of my colleagues!

All of the APCERT members are working towards the same goal – to protect their economies or industry sectors from new and existing cyber threats. As we are largely government-funded or non-profit organisations, there is no pressure to create profits or sell products, and the focus is entirely on providing the best possible service to our jurisdictions. Some of the teams that participate in APCERT are quite small and do not have the resources to analyse all new threats, so collaboration amongst teams is extremely beneficial.

In addition to the welcoming atmosphere among APCERT members, the hospitality and kindness shown by CERT-In was second-to-none. This year was the first time they had hosted the APCERT conference, but the experience was extremely smooth and well-thought out. During the afternoon of the first day, we were taken on a guided tour of local sights by the CERT-In staff, before being presented with a welcome dinner. Having helped run the AusCERT conference in the past, I know how difficult and stressful it can be to run such an event, and I commend CERT-In on their performance.

Conference Proceedings and Talks

The conference began with updates from the various working groups within APCERT. This is a great way to share progress with other members, and some of the work presented by teams this year was extremely impressive.

One such example is the TSUBAME project, which collects network traffic data from passive “sensors” situated in many networks across the Asia-Pacific region, and compiles that data into statistics that can be used to observe trends in network scans across the internet.

Other talks focused on issues such as automated malware analysis, in particular the need for non-commercial options that can be used with potentially sensitive information. A talk given by Wen-Ling Lo from TWCERT/CC brought up an excellent point: many people use services such as VirusTotal or VirScan to check suspicious email attachments, but if the attachment is legitimate and contains confidential information, uploading it to a commercial company’s services could result in an information leak. TWCERT/CC are currently developing a tool that can be used by businesses and governments in Taiwan to examine files without fear that samples will be sent to external or commercial companies. AusCERT is very impressed with their efforts and will be tracking their progress closely.

Not all talks were technical, though, and an unexpectedly impactful presentation by Nurul Husna of MyCERT, the national CERT for Malaysia, described the governance and management workflows required to operate a CERT efficiently. As a technical person, it was refreshing to see a presentation on governance that made sense and showed real value. There is a real need for efficient management of resources at CERTs, due to the quick turnaround time required in order to serve our jurisdictions effectively.

Additionally, some external speakers were invited to give talks at the conference. Some highlights included a talk by Akamai representative Amol Mathur on attacks that target API services directly, bypassing many of the protections that are built into front-end applications, and an overview on using machine learning to analyse malware samples by Rajesh Nikam of Quick Heal. As malware campaigns grow in both size and number, we need to move away from manual analysis in order to process as many samples as possible, making use of technologies such as machine learning to automate the process.

On the final day of the conference, attendance was opened to external members of the IT industry, and the National Minister for IT & Electronics gave an address to the audience. During the conference I began to see just how large and important the IT industry in India is. With a population of over 1 billion people, internet-based solutions are essential to interacting with the government and businesses, and ensuring these interactions are protected and non-fraudulent is a problem at the forefront of the industry. The conference also served as a focus point for the local government to draw attention to emerging threats, especially as they begin to move towards more digital payment solutions.

The full schedule for the APCERT Annual General Meeting and Conference may be found here: https://apcert2017.in/schedule.html

The APCERT AGM

Another important part of the conference is the Annual General Meeting, or AGM. At the AGM, proposals for changes and amendments to APCERT frameworks and guidelines are put forward and voted upon by members. Proposals for new working groups are also heard, and lastly, the membership of the steering committee and leadership positions are voted upon.

This year, CERT-In was accepted as a new member of the steering committee, and after recognising the hard work of JPCERT/CC, MyCERT, and CERT Australia in their positions as Secretariat, Deputy Chair, and Chair respectively, the members of APCERT voted to re-appoint them to their previous positions.

AusCERT would like to thank the steering committee and leadership positions for their hard work in the past year, and congratulate them on their continued appointments. We also welcome CERT-In to the steering committee and look forward to their input in the future!

Closing Remarks

Attending the APCERT conference and AGM was an eye-opening experience. In the fast-moving world of Information Security, we are facing attacks in greater numbers and greater complexity. It can be difficult to sift through the vast amounts of information distributed throughout the internet, trying to find advice that is truthful, accurate, and relevant to your organisation. CERT and CSIRT organisations offer an increasingly important role in these times, distributing threat intelligence efficiently and with the goal of national/sectorial security in mind. As well, the challenges faced by each CERT are often similar, and there is great value in being able to speak freely with other organisations that share your goals.

I would like to thank all of the members, partners, and guests at the conference, for welcoming me to the APCERT community. I’ve made many new friends over the last week, and hearing other analysts describe their experiences, challenges and achievements has re-invigorated my love for information security. I hope AusCERT can continue to provide value to other APCERT members and look forward to some new collaborations in the future.
I would also like to offer a special thank-you to the staff of CERT-In, for being such hospitable hosts. My first stay in India was a great experience, and I hope to return in the future.

Anthony Vaccaro
anthony@auscert.org.au