[59379] in North American Network Operators' Group
Re: Country of Origin for Malicious Attacks
daemon@ATHENA.MIT.EDU (Jamie Reid)
Thu Jun 26 21:51:07 2003
Date: Thu, 26 Jun 2003 21:50:21 -0400
From: "Jamie Reid" <Jamie.Reid@mbs.gov.on.ca>
To: nanog@merit.edu
Errors-To: owner-nanog-outgoing@merit.edu
This is a MIME message. If you are reading this text, you may want to
consider changing to a mail reader or gateway that understands how to
properly handle MIME multipart messages.
--=_FEA136F1.AECF7742
Content-Type: text/plain;
charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
I've found that country of origin is less relevant than route/subnet and =
ASN, as there
is a link between the address and the people in a position to actually =
respond to the problem.=20
I'd be interested in knowing how linking aggregated attack information to =
country of=20
origin is actually valuable relative to our ability to respond to it.=20
Cheers,=20
-j
--
Jamie.Reid, CISSP, jamie.reid@mbs.gov.on.ca
Senior Security Specialist, Information Protection Centre=20
Corporate Security, MBS =20
416 327 2324=20
--=_FEA136F1.AECF7742
Content-Type: text/plain
Content-Disposition: attachment;
filename=TEXT.htm
Content-Transfer-Encoding: 7bit
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1106" name=GENERATOR></HEAD>
<BODY style="MARGIN-TOP: 2px; FONT: 8pt Tahoma; MARGIN-LEFT: 2px">
<DIV><FONT size=1></FONT> </DIV>
<DIV><FONT size=1>I've found that country of origin is less relevant than
route/subnet and ASN, as there</FONT></DIV>
<DIV><FONT size=1>is a link between the address and the people in a position to
actually respond to the problem. </FONT></DIV>
<DIV><FONT size=1></FONT> </DIV>
<DIV><FONT size=1>I'd be interested in knowing how linking aggregated attack
information to country of </FONT></DIV>
<DIV><FONT size=1>origin is actually valuable relative to our ability to respond
to it. </FONT></DIV>
<DIV><FONT size=1></FONT> </DIV>
<DIV><FONT size=1>Cheers, </FONT></DIV>
<DIV><FONT size=1></FONT> </DIV>
<DIV><FONT size=1>-j</FONT></DIV>
<DIV><FONT size=1></FONT> </DIV>
<DIV><FONT size=1></FONT> </DIV>
<DIV> </DIV>
<DIV><FONT size=1>--<BR>Jamie.Reid, CISSP, <A
href="mailto:jamie.reid@mbs.gov.on.ca">jamie.reid@mbs.gov.on.ca</A><BR>Senior
Security Specialist, Information Protection Centre <BR>Corporate Security,
MBS <BR>416 327 2324 </FONT></DIV></BODY></HTML>
--=_FEA136F1.AECF7742--
