86 There were some major attacks on critical information systems in Sri Lanka
during 2008. As a proactive measure SLCERT has been assigned the task of carrying out vulnerability assessments and penetration tests for some major
information systems. SLCERT started this service during the fourth quarter of 2008.
3 Events organized co-organized
3.1 Training Education
SLCERT organizes training programs and education sessions targeting various audiences including CIOs, Engineers, System Administrators,
Banking and telecom sector staff, Students, and general public. During the year 2009 SLCERT conducted the following training, education
programs successfully: 1. Lecture on “Information Security” for MBA students
2. Conference on Information Security for CIO’s of Government Departments 3. Participated in a number of IT exhibitions by taking stalls with a view to
educating the general public on IT Security
3.2 Consultancy
SLCERT provides consultancy services for requests, especially for government departments.
During the year 2009, the following consultancy services were provided: 1. Network reviews for 6 government departments
2. Forensics investigation support for Law enforcement 3. Setting up a CA server for a government department
4. Initiated the implementation of a new computer forensics laboratory for Police Department
3.3 Seminars Workshops
Cyber Security Week 2009 Cyber Security Week 2009 is an annual event being organized by SLCERT
since the year 2008, held in the month of August, which featured a series of events:
Two Workshops for professionals, namely:
87
Web Application Security two day workshop
Malware Analysis two day workshop
Two-day Conference
4 Achievements
4.1 Presentations
1. Conducted 3 lectures related to IS for Chief Information Officers CIO
of government organizations following MBA in e-Governance. 2.
Conducted Presentations on following topics during the Cyber Security Week 2009 CSW_2009 Conference in August 2009:
• Malware analysis-Case study • DDoS attack developments
• Digital Forensics practices • Managed security services
3. Economy update for Sri Lanka at the SAARC Cyber Security Workshop
New Delhi, India.
4.2 Publications Other media
1. Web site
Through the SLCERT website published security related awareness details for the public via News, Alerts and Knowledge Base. Glossaries,
case studies, FAQs are among some of the published items. 2.
E-mails Disseminating security related information via e-mail alerts to SLCERT
Website susbscribers. 3.
Newspapers media Educated the general public about SLCERTs role in combating cyber
crimes through the electronic media.
4.3 Certification Membership 4.3.1 Security Certifications obtained by staff members within the period:
CEH Certified Ethical Hacker from EC Council was obtained by four staff members of SLCERT
4.3.2 Memberships obtained in professional security organizations in the period
2008:
88 APCERT Full Membership
5 International Collaboration
5.1 MOU
MoU between SLCERT JPCERTCC Japan on 1st July 2009 to serve as a partner in the Tsubame Network Monitoring System for the Asian Region.
5.2 Mentors
JPCERTCC
5.3 Event participation
1. March 4th -5th APCERT AGM
Taiwan In view of its active participation, SLCERT has been encouraged to join the
Steering Committee of the APCERT and also to join two working groups. 2. May 11th - 15th
APISC Training Seoul, South Korea
Presented a paper on economy status, CSIRT establishment and incident handling procedures.
3. June 28th – July 2nd 21st Annual FIRST Conference
Kyoto, Japan Voted at AGM, attended APCERT Steering Committee meeting, new
contacts made. 4. December 15th
ISACA Annual Conference Colombo, Sri Lanka
Gained practical knowledge on Audit methodologies, made new local contacts, did a presentation on Practical Digital Forensics.
5. December 22nd - 23rd Attended a SAARC Workshop on “Cyber Security”
In New Delhi, India
89 Able to get an understanding on the issues of Cyber security in the SAARC
region and had good networking opportunities with member countries.
5.4 International incident coordination
