Anyone else familiar with US-Cert Traffic Light Protocol?
-
I received a builtin today because I support an agency that works with New York State. It was an advisory about some IP addresses to watch out for. They recommended keeping my system patched up to date and said I should consider blocking the suspicious IP addresses from third world countries they have identified. The real joke was that this information was coded "TLP:Amber" meaning these IPs shouldn't be shared with the public. Maybe someone from the public should tell them about geo-blocking. This is the first alert they have sent me. Has anyone else received these "alerts" before? Are they all like this?
-
BTW, I didn't check them all, but the IPs I did check are already registered in the https://www.abuseipdb.com so it's not like this is secret information.
-
@Mike-Davis said in Anyone else familiar with US-Cert Traffic Light Protocol?:
BTW, I didn't check them all, but the IPs I did check are already registered in the https://www.abuseipdb.com so it's not like this is secret information.
The knowledge of how security works is probably secret and kept from NYS employees, though.
-
I have gotten them form US CERT (computer Emergency Readiness Team) for the exact same reason, and yes they are ALL like that.
-
I get their emails everyday and have to act on them as part of my job. All their emails are classified at a different level.
-
@IRJ said in Anyone else familiar with US-Cert Traffic Light Protocol?:
I get their emails everyday and have to act on them as part of my job. All their emails are classified at a different level.
I have never received one. Interesting.
-
@IRJ said in Anyone else familiar with US-Cert Traffic Light Protocol?:
I get their emails everyday and have to act on them as part of my job. All their emails are classified at a different level.
What kind of stuff have they sent that was actionable?
-
@Mike-Davis said in Anyone else familiar with US-Cert Traffic Light Protocol?:
@IRJ said in Anyone else familiar with US-Cert Traffic Light Protocol?:
I get their emails everyday and have to act on them as part of my job. All their emails are classified at a different level.
What kind of stuff have they sent that was actionable?
Zero days and other CVEs
