42nd TF-CSIRT Meeting

The 42nd TF-CSIRT meeting was be held on 29th & 30th May 2014 in Heraklion, Greece. The meeting was sponsored by FORTH.

The meeting was co-located with the ENISA 9th annual workshop, 'CERTS in Europe' on 27th and 28th May 2014.

Logistical information for the meeting is available.

Registration for the event is now closed. A list of attendees can be found here.


Thursday, 29th May 2014
Time Event
09:00 - 13:00 TF-CSIRT Closed Meeting - by invitation only
Amfitheatron Room
13:00 - 14:00 LUNCH
14:00 - 14:15 Welcome from Chair, Minutes of the last meeting
Lionel Ferette
14:15 - 14:30 Trusted Introducer Update
Klaus Peter Kossakowski
14:30 - 14:45 TRANSITS Update
Don Stikvoort
14:45 - 15:00 Report from RIPE68
Wilfried Woeber
15:00 - 15:30 COFFEE
15:30 - 16:00 ICS Cert
Matthew McWhirt
16:00 - 16:15 AlliaCERT
Helmi Rais
16:15 - 16:30 Report from the Steering Committee
Lionel Ferette
16:30 - 18:00 TF-CSIRT Steering Committee - by invitation only
Amfitheatron Room
21:00 Gala Dinner, Ladokolla Restaurant, Ioanni Merineli 13, Heraklion 712 02

Friday, 30th May 2014
Time Event
09:00 - 09:30 SCUDO
Wilfried Woeber
09:30 - 10:00 RIPE NCC Tools and Measurements
Mirjam Kühne and Christian Teuschel
10:00 - 10:30 CERT.LV Cooperation with Latvian Cyber Defense Unit
Baiba Kaskina
10:30 - 11:00 NCSC-FI Update
Erka Koivunen
11:00 - 11:30 COFFEE
11:30 - 12:30 Network Security Monitoring Working Group
2. Heartbleed disclosure by NCSC-FI, Erka Koivunen, NCSC-FI
5. Heartbleed scanning – legal aspects, L. Aaron Kaplan, CERT.at
12:30 - 13:00 Team Cymru Update
Dave Monnier
13:00 - 14:00 LUNCH
14:00 - 16:00 RTIR meeting
Amfitheatron Room
14:00 - 16:00 RIPE NCC Data and Tools Workshop
Amfitheatron Room

RIPE NCC Data and Tools Workshop Details

This workshop aims to raise awareness about the data sets and tools the RIPE NCC provides. Some of these tools could be of great interest to the CSIRT community.

RIPE Database

The RIPE NCC maintains the RIPE Database which contains registration details of IP addresses and AS numbers originally allocated by the RIPE NCC. It shows the organisations that hold the resources, where the allocations were made, and contact details for the networks. The Database can be searched by using the web interface, or by directing your whois client to whois.ripe.net. We will also show how reverse look-ups can provide additional information about holders of IP resources.


RIPEstat is a toolbox that makes it easier to access the various datasets maintained by the RIPE NCC and other parties. The RIPE NCC collects comprehensive and long-running datasets from a variety of sources including data from third parties. This data includes IPv4 and IPv6 addresses, Autonomous System Numbers, routing registry and routing (BGP) information, DNS performance information and connectivity data. RIPEstat is combining all these different datasets and makes them accessible through one graphical, modular and extendable interface. The presentation will highlight the usage and the benefits of this tool. We will show examples on how RIPEstat can be used to find background information about IP resources. We would encourage participants to bring use cases to the workshop.

All the tools, measurements and statistics are regularly published and updated on RIPE Labs.