Martin Husak

Sharing the alerts from intrusion detection systems among multiple computer networks and organizations allows for seeing the “big picture” of the network security situation and improves the capabilities of cyber incident response. However, such a task requires a number of technical and non-technical issues to be resolved, from data collection and distribution to proper categorization, data quality management, and issues of trust and privacy. In this field note, we illustrate the concepts and provide lessons learned on the example of SABU, an alert sharing and analysis platform used by academia and partner organizations in the Czech Republic. We discuss the initial willingness to share the data that was later weakened by the uncertainties around personal data protection, the issues of high volume and low quality of the data that prevented their straightforward use, and that the management of the community is a more severe issue than the technical implementation of alert sharing.

The Russian invasion of Ukraine in 2022 raised an enormous wave of Internet activism and distributed denial-of-service (DDoS) attacks launched with the help of common users across the world. In this article, we describe the events of the first days after the invasion from the perspective of the cybersecurity incident response team of Masaryk University in the Czech Republic. We observed hundreds of users intentionally participating in DDoS attacks against Russia from the university’s network. The campus network faced only minor issues in terms of service unavailability, but alerts flooded the cybersecurity team. Two dimensions of the events are highlighted. First, the large-scale attacks in an unexpected direction were highly unusual and brought technical challenges in network monitoring and intrusion detection. Second, hacktivism still violates the campus network’s terms of use and requires the cybersecurity team to communicate the issues very carefully with the community.