Benchmarking Your Constituency: A Practical Framework for CERTs with Results from Academic Sector
summary
Methodology uses official registries (NCES, ETER), certificate‑transparency and IP→org databases, Shodan scans and CT‑based subdomain discovery, plus AI matching and month‑by‑month normalization to freeze assets. Dataset covers Dec–May for ~3,400 US and 5,548 European institutions (≈8,000 total); measured 34M static IPs (US), 54M (EU), CT‑resolved ~400k and ~320k subdomains, estimated active IPs ~2.7M (US) and 2.2M (EU). Key findings: 5% of institutions hold 80% of events, size multiplies issues (colleges ~5×, research unis ~30×), remote access and file/print exposures top categories; framework requires authoritative registers, conservative attribution, stable schema and low false positives.
AI-written summary · about
chapters (14)
- 0:00Benchmarking constituency challenges
- 3:53Benchmarking difficulty in practice
- 8:02Academics as benchmarking subjects
- 10:50Foundation for benchmarking academia
- 13:18Benchmarking framework design
- 17:39Normalizing benchmarking data
- 19:27Academic sector results
- 24:49Size/type vs security issues
- 26:13Averages vs distributions
- 29:02US vs EU academic networks
- 32:18National security differences
- 35:04Framework beyond education
- 36:52Benchmarking implementation checklist
- 37:34Q&A
related talks
58mFIRSTCON21 - June 8 | Stream 3 Part 2 (14:30-15:30 UTC)
39mCommSec D1 - Behaviors and Patterns of Rogue Hosting Providers
01h 05mCritical Information Infrastructure (CII) Protection: Challenges & Opportunities
46mExploring the ecosystem of malicious domain registrations in the .eu TLD
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
43mDetecting and Preventing Malicious Domain Registrations in the .eu TLD
40mYou have a security problem - your users
27mA Longitudinal, End-to-End View of the DNSSEC Ecosystem