RESTENA

Accès VPN renouvelé avec eduVPN

cglaser — Mon, 06 May 2024 08:24:02 +0000

cglaser Mon 06/05/2024 - 10:45

A flagship service among the thirty or so offered by the Restena Foundation, VPN is evolving. In particular, it is essential for accessing to the Intranet services of the Restena Foundation and/or the Ministry of Education/CGIE when the user is not connected to the National Research and Education Network (RESTENA network), on business trips, for example.

Integration into a proven European network

While the question of renewing the technical equipment configured to guarantee a secure high-performant VPN access to its network users, Restena opted for a European solution, proven and tailor-made to the needs of the research and education known as eduVPN. This tool, originally developed as part of the European GÉANT's projects, has since been offered as a federated service by the European GÉANT Association, which manages the pan-European research network of which Restena is a member. Its ambition is clear: provide to the research and education a secure remote access that respects privacy. Since it was launched, eduVPN attracted some twenty National Research and Education Networks (NRENs) across globe, Restena included as a participating NREN provider.

To meet eduVPN requirements, and so guarantee the research and education community in Luxembourg access to their institutes’ network or the Internet using an encrypted connection, Restena has adapted its technical infrastructure. In particular, it has deployed the eduVPN software on the servers dedicated to the research and education community, then integrated and configured the software at the heart of its infrastructure.

Thanks to these changes, users of Restena's VPN solution will benefit from additional features:

simplified access to the VPN thanks to a new technical solution based on a client application called eduVPN;
ability to configure the VPN on Android and Linux devices, in addition to Apple Mac/iOS and Windows.

VPN reconfiguration required

The current VPN remains accessible till 1 September 2024. However, the current VPN users are already invited to download, install and use the eduVPN client via the link eduvpn.restena.lu. As it is now the case, connect to eduVPN is made using their RESTENA credentials provided at the time of their RESTENA account creation.

Shared identification with other services

Beyond additional features, the service is open to new users. Until now only benefitting anyone owning a RESTENA user account, mainly Luxembourg teachers with an @education.lu mailbox, VPN access is extended to employees and students of the institutions affiliated to the authentication and access authorization service: eduID Luxembourg. This permits employees and students from research and education to authenticate for thousands of services available worldwide with only a single password.

In Luxembourg, Restena's ‘FileSender’ and ‘URL shortener’ services; respectively enabling the sharing of large files and the secure redirection of long URLs to short URLs while respecting its privacy and that of its visitors; already benefits from eduID Luxembourg authentication.

Users with an account at Restena and all researchers, teachers, employees and students of Luxembourg institutions using eduID Luxembourg can now use eduVPN. The following organisations are concerned:

beneficiaries of the Identity and Access Management (IAM) system of the Centre de gestion informatique de l'éducation (CGIE),
employees and students at the University of Luxembourg,
employees and students at the Luxembourg School of Business (LSB),
employees of the University of Luxembourg Competence Centre (ULCC),
employees of the Luxembourg Institute of Socio-Economic Research (LISER).

Institutions connected to the RESTENA network - research institutes, educational and cultural institutions in Luxembourg - willing to have their employees benefit from the eduVPN and the eduID Luxembourg service can notify their interest to admin@restena.lu

Further information

'eduVPN' service webpage

Documentation 'Configure your access to VPN 'eduVPN''

eduVPN tool website

Pour des opérateurs-rices SOC alertes face aux alertes réseaux

cglaser — Tue, 02 Apr 2024 07:47:45 +0000

cglaser Tue 02/04/2024 - 10:17

Kind of organisation guardian angels when facing cyber threats, Security Operation Centers (SOC) operators play a strategic role. Just like the technical and IT elements, the human elements of a SOC must be at the cutting edge of knowledge and recommendations when discussing cybersecurity.

Professional training is still the best asset to meet such a high requirement level. Even if many tools are already available on the market, the European NGSOTI - Next Generation Security Operator Training Infrastructure project that started in January 2024; co-funded by the European Union’s Digital Europe programme (DIGITAL) and supported by the European Cybersecurity Competence Centre; intends to go even further.

A training platform based on real-data

Alongside the Computer Incident Response Center Luxembourg (CIRCL) of the Luxembourg House of Cybersecurity, NGSOTI project coordinator, and the other members of the consortium of partners (University of Luxembourg and Tenzir GmbH), Restena is embarking for three years in setting up an open-source training platform dedicated to training future SOC operators regarding network-related alerts and based on real data. Incident response, log management and analysis, security operations centre management, cyber threat intelligence, and communication and documents are the focus of the future platform.

Real data on which the platform will be based are from the national research and education network (RESTENA network) backscatter traffic jointly collected over the past 10 years by Restena and CIRCL. Thanks to attack indicators and information about incorrect technical configurations they contain, its data make a valuable contribution to getting a concrete overview of cyber-attacks

Considering extending the edu.lu service

Beyond the training platform, NGSOTI will allow Restena to extend the scope of its URL shortener service – now available at 'edu.lu’ – offered since January 2023 to securely redirect long URLs to short URLs while respecting its privacy and that of its visitors. Additional security measures will be integrated, mainly the checking of URLs to ensure URLs shortened via 'edu.lu' are not being used for cyber-attacks.

In parallel, a new ‘rech.lu' shortener will be developed to better serve the research community, for whom safety criteria differ from those of 'edu.lu' designed above all for the needs of education.

A further step towards equipping the research and education

Although the scope of NGSOTI extends beyond the research and education sectors, the project will help Restena go one step further in its commitment to equip research and education towards cyber threats. First, NGSOTI enables it to step up its involvement in training future IT professionals, especially with Lycée Guillaume Kroll BTS cybersecurity students. Second, it is added to the portfolio of large-scale European projects in which Restena is involved.

With its flagship project since September 2023, LuCySe4RE - Enhancing Cybersecurity Services for the Luxembourgish Research and Education community project, Restena intends to improve protection against the cybersecurity risks faced by the Luxembourg research and education community, such as a security event management platform with dedicated tools, lifelong learning training and events.

Further information

NGSOTI project webpage

Cynthia Wagner

cynthia.wagner@restena.lu

CIRCL

info@circl.lu

Next Generation Security Operator Training Infrastructure (NGSOTI)

cglaser — Mon, 25 Mar 2024 09:10:16 +0000

cglaser Mon 25/03/2024 - 10:25

Projects

Next Generation Security Operator Training Infrastructure (NGSOTI)

Set up an open-source training infrastructure based on real data for the practical training of SOC operators in network-related alerts.

START: 1 JANUARY 2024 - END: 31 DECEMBER 2026

Challenges

An increasing number of Security Operation Centers (SOCs) are springing up all around the world. An asset for monitoring, analysing and protecting one organisation, its users and/or customers against cyber threats, SOC operators are, just like the technical and IT environment, strategic elements of its smooth operation.

To stay on top of their missions, people operating in a SOC must be trained, particularly on current and future attacks, and the warning signs accompanying them. Learning tools already existing are not proving sufficient to meet this growing challenge. An operational infrastructure, based on real data, and specifically dedicated to training future SOC operators is essential.

Ambition

With NGSOTI, the consortium of partners intends to set up an open-source training platform dedicated to training future SOC operators regarding network-related alerts. The platform will focus on, among other things, incident response, log management and analysis, security operations centre management, cyber threat intelligence, and communication and documents.

To set up the platform, the partners will not only draw on their experience, but also on a wide range of open-source tools developed and/or used as part of their respective missions.

Throughout the project, training and conferences on the issue will complete the platform, particularly for future SOC operators. In parallel, data produced through the project could be openly reused by interested researchers for future research projects.

Implication

traffic for analytical purpose. This set of data consists of several terabytes jointly collected for more than 10 years by the Computer Incident Response Center Luxembourg (CIRCL) – operated by the Luxembourg House of Cybersecurity (LHC) – and the Restena Foundation’s Computer Security Incident Response Team (CSIRT). It gives an overview of recent attack indicators, among other things.

As a second step, Restena will extend the scope of its edu.lu tool, developed within its ‘URL shortener’ service allowing to securely redirect long URLs to short URLs while respecting its privacy and that of its visitors. Additional security measures, mainly the checking of URLs to ensure they are not being used for cyber-attacks, will be integrated. Furthermore, a new ‘rech.lu’ shortener should be developed to better serve the research community, for whom safety criteria differ from those of edu.lu designed above all for the needs of education.

Lastly, Restena intends to step up its involvement in training the next generation of professionals. Already involved in several higher education courses at the Lycée Guillaume Kroll, Restena will make a greater commitment to the BTS cybersecurity students, thus training the cybersecurity specialists of tomorrow.

Funded by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Cybersecurity Competence Centre. Neither the European Union nor the European Cybersecurity Competence Centre can be held responsible for them.”

More details on the project

Some useful Information

NGSOTI has received funding from the European Union’s Digital Europe programme (DIGITAL) - Project: 101127921 with agreement: DIGITAL-ECCC-2022-CYBER-03. It is supported by the European Cybersecurity Competence Centre.

The project gathers a consortium of partners led by the Computer Incident Response Center Luxembourg (CIRCL) from the Luxembourg House of Cybersecurity and including Restena, the University of Luxembourg and Tenzir GmbH.

Who is impacted?

NGSOTI project will impact anyone who is interested ranging from companies, non-governmental organizations (NGOs), Computer Security Incident Response Teams (CSIRTs), students, etc.

Specifically, on Restena side, this mainly impacts: Connected Establishments, Higher-Education Establishments, Research Institutes, Cultural Institutions, Primary and Secondary Schools, Hospital.

What is backscatter traffic?

The backscatter traffic, unwanted traffic, can be considered as worthless traffic. However, this is far from being the case. That traffic includes attack indicators and information about incorrect technical configurations. The national research and education network (RESTENA network) backscatter traffic’s IP addressing being close to the HOME addressing (192.168.X.X), the collected data provide some interesting information to analyse.

To go further, discover an example of the backscatter traffic as used within the NGSOTI project described in the publication ‘AN EXTENDED ANALYSIS OF AN IOT MALWARE FROM A BLACKHOLE NETWORK’ published in 2017 and jointly written by Restena, CIRCL and Université Catholique de Louvain.

eduVPN

cglaser — Tue, 19 Mar 2024 15:47:52 +0000

cglaser Thu 21/03/2024 - 10:12

Services

eduVPN

Securely access internal/Intranet resources and services outside of the RESTENA network.

Configure your access to eduVPN

Challenges

To access certain RESTENA services (Intranet services such as the e-mail directory) and/or certain pedagogical and administrative resources provided by the Centre de gestion informatique de l'éducation (Education IT Management Centre or GGIE) for the purposes of national education (Intranet services such as the SCOLARIA application and others), you need to have access to the national network dedicated to stakeholders in research and education in Luxembourg managed by the Restena Foundation. This access is automatic from any computer connected to the network of an institution that is eligible for RESTENA services (connected establishments).

To connect to these services outside of the RESTENA network, a virtual private network (VPN) is one option provided by the Restena Foundation in addition to DSL/Fibre access. The VPN must be individually installed on each IT device (computer, tablet, or smartphone) that the user wants to be connected to the RESTENA network.

Features

The Restena Foundation offers VPN access to eligible users wanting to access internal/Intranet resources and services without being connected to their institution's computing network (i.e. from another institution for which the Foundation serves as an Internet service provider). The VPN's main function is to allow users not physically present at their workplace and connected outside of the RESTENA network, to securely take advantage of all Restena and national education services.

Once a secure connection has been established between the VPN server and a user’s workstations, the user is considered connected to the RESTENA network, allowing access to Intranet resources. The virtual presence on the RESTENA network permits direct access to Intranet resources and services of the Restena Foundation, such as accessing the email directory or resources from the Ministry of Education / CGIE such as SCOLARIA.

Benefits

Secure connection to the RESTENA network to access to the internal/Intranet ressources provided by the Restena Foundation and/or the Ministry of Education/CGIE

Worldwide access from any Internet Service Provider

Service accessible through applications available for Windows, macOS, iOS, Android and Linux

Installation and use

The installation and use of a VPN client/software are only required in the following circumstances:

1

if you need a secure connection to the Intranet services of the Restena Foundation or the Ministry of Education, Children, and Youth, such as accessing student file applications or SCOLARIA.

2

if you are connected to the Internet by a service provider other than the Restena Foundation (you can determine your Internet Service provider thanks to the diagnostic tool provided on our Helpdesk page).

3

if you are connected to the Internet via an untrustworthy access provider (Non encrypted WIFI, hotel room Internet access, etc.)

4

If you are a user of an eduID Luxembourg participating institution.

A VPN configuration has a 10-day validity period. During this time the VPN connection can be established at will. Once expired, the client will request user authentication and download a new configuration.

To know if you require eduVPN access you can test your connection!

More details on the service

Who can benefit?

Connected institutions, higher education institutions, research institutes, cultural institutions, health sector institutions, communal administrations, primary and secondary schools, teachers, students, researchers, admin staff and corporate staff.

How to benefit?

Access to eduVPN is restricted to RESTENA users and users of eduID Luxembourg participating institutions. Installation and configuration of a VPN client/software on the user’s desktop is required.

Some useful information on eduVPN

eduVPN is a tool to enable actors of the research and education sectors from across Europe to access their institution networks as well as the Internet thanks to an encrypted connection (https://www.eduvpn.org): more than 20 countries and 100 participating institutions across the world are using eduVPN.
The Restena Foundation is the national coordinator of the eduVPN service in Luxembourg.

Compliance statement

The Restena Foundation confirms adhering to the eduVPN policy published as described within the document ‘eduVPN compliance statement’ published on eduVPN website.

Privacy statement

For security, compliance and monitoring reasons, the Restena Foundation logs some session details for a duration of 30 days. The recorded details are:

User id in the form of a pseudonym.
Time of client connect.
Time of client disconnect.
Client source IP address.
Assigned IPv4 and IPv6 addresses.

Assistance and support

Administrative contact: admin@restena.lu
Technical contact: noc@restena.lu

Services

Other services that might be of interest to you

Service list custom block

Help desk block

Activer la communication sécurisée TLS sur une boîte e-mail

cglaser — Thu, 14 Mar 2024 10:57:16 +0000

cglaser Fri 15/03/2024 - 10:14

Publication date: 13 March 2024

In order to connect to Restena's email servers, the use of Transport Layer Security (TLS) encryption is recommended and will be mandatory from December 2024 to strengthen the security of communications. Depending on the email client - or mailbox - different configurations apply to establish a secure connection.

Select the email client you are using from the list below to find out how to proceed:

Attention! The TLS protocol must be activated individually on all the email clients used

Le DNS chiffré disponible grâce à de nouveaux résolveurs

cglaser — Mon, 11 Mar 2024 13:25:20 +0000

cglaser Mon 11/03/2024 - 14:37

On 14 and 21 March 2024, the Restena Foundation will replace the servers on which the two recursive resolvers benefiting institutions connected to the national research and education network (RESTENA network) are configured. With its DNS servers that focus on data security and protection, Restena provides institutions using the ‘Public DNS resolver’ with data security, confidentiality, and protection for DNS requests by means of a neutral DNS resolution that validate the responses obtained by using DNSSEC technology.

Encrypted access to DNS resolvers

New servers integrated into the RESTENA network infrastructure, research and education institutions can benefit from a new feature: accessing the community DNS resolver by using DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH), two technologies that encipher DNS communications between client and server.

The DoT and DoH services will be immediately available to any institution wishing to use these technologies but will require server authentication. To achieve this, it will be essential to implement the X.509 certificate signature (SPKI pin) for resolvers.

I implement the X.509 certificate signature

A step closer to a new infrastructure

Replacing the servers ns.restena.lu and arakis.restena.lu by the servers dns1.restena.lu et dns2.restena.lu - which will still use their current IPv4 and IPv6 addresses - is a further step within the project to renew servers initiated by Restena. In February 2024, Restena already replaced the server on which its recursive resolver open to the general public was configured.

In the future, renewing servers will allow the integration of our community recursive resolvers inside a bright new dedicated infrastructure, developed within the LuCySe4RE - Enhancing Cybersecurity Services for the Luxembourgish Research and Education community project, a project whose aim is to improve protection against the cybersecurity risks faced by the Luxembourg research and education community.

Further information

‘Public DNS resolver’ service webpage

‘DNS servers’ service webpage

Documentation ‘Authenticate servers for community DNS resolvers'

News ‘The public DNS resolver to reconfigure’

Authentifier les serveurs des résolveurs DNS de la communauté

cglaser — Fri, 01 Mar 2024 14:55:51 +0000

cglaser Fri 01/03/2024 - 16:10

To authenticate Restena servers, X.509 certificate hash (SPKI pin) is essential.

This signature will be made available as soon as the change planned on Tiesdays 17 and 24 March 2024 is over.

Nouvelle grille tarifaire pour les opérations sur le .lu

cglaser — Fri, 01 Mar 2024 09:06:44 +0000

cglaser Fri 01/03/2024 - 10:17

After 14 years without any evolution in prices for operations related to administering .lu domain names, new fees go into effect on 1 March 2024. With this increase, the Restena Foundation, acting as the registry for domain names with the national extension .lu, intends to reduce the impact of the increasing cost base and ensure the stability and smooth operation of the .lu domain.

All registrars accredited to offer .lu domain names are impacted by this evolution. The registration, renewal fees as well as reinstating a domain name in redemption are impacted. The fees for an unsuccessful transfer of management to another registrar and an unsuccessful trade (change of ownership) remain the same.

The Restena Foundation is passing on this evolution to the rate applied in its role as a .lu registrar. Customers of the classic management (using paper forms) and those of the online management (using my.lu/online platform) are now paying a few additional euros to register, renew, trade, transfer and restore a domain name.

Further information

News ‘New prices for .lu operations’ published on dns.lu

News ‘New prices as of 1 March 2024’ published on my.lu

Le résolveur DNS public à reconfigurer

cglaser — Tue, 13 Feb 2024 09:38:56 +0000

cglaser Tue 13/02/2024 - 10:51

On 15 February 2024, the Restena Foundation will replace the server on which is configured its recursive resolver open to the general public. This resolver, that focuses on data security and protection, is offered within the ‘Public DNS resolver’ service that provides anyone with data security, confidentiality, and protection for DNS requests by means of neutral and recursive resolvers that validate the responses obtained by using DNSSEC technology.

This replacement is part of the project to renew servers initiated by Restena, but not only. In the future, it will allow the integration of the recursive resolver open to the general public inside a bright new dedicated infrastructure, developed within the LuCySe4RE - Enhancing Cybersecurity Services for the Luxembourgish Research and Education community project, a project whose aim is to improve protection against the cybersecurity risks faced by the Luxembourg research and education community.

New server, new configuration

The public DNS resolver offered by Restena is accessible by using DNS-over-TLS and DNS-over-HTTPS, two technologies that encipher DNS communications between client and server. This server will be replaced on Thursday 15 February 2024: kaitan.restena.lu leaves room to dnspub.restena.lu

Any person using kaitan.restena.lu must therefore reconfigure server used by the public DNS resolver. Either at system level (for DNS-over-TLS) or at browser level (for DNS-over-HTTPS), the name server, the SPKI pin and the query URL requires update. If not, users run the risk of not being able to access the systems configured on the resolver.

I configure my server for the public DNS resolver

Scheduled unavailability on 15 February 2024

The intervention scheduled on 15 February 2024 will lead to a service interruption between 7.00 a.m. and 4 p.m. Neither the current nor the new public recursive resolver will work for all or part of the day.

Consequently, the DoT/DoH public resolution service will be temporarily unavailable. Users of Restena’s public resolver – who have only configured this resolver - will temporarily be unable to access their systems, such as websites. To avoid this problem, we recommend adding another server - temporarily or otherwise.

Info! DNS resolvers set up for users from research and education community in Luxembourg are not concerned by the renewal..

Further information

‘Public DNS resolver’ service webpage

Documentation ‘Configure your server for the public DNS resolver’

L’intelligence artificielle sous l’angle de la protection des données

cglaser — Mon, 05 Feb 2024 15:22:58 +0000

cglaser Mon 05/02/2024 - 16:30

On 29 January 2024, the Restena Foundation and the University of Luxembourg co-organised the 7th edition of the Data Privacy Day dedicated to data protection. Once again, the event was held in hybrid mode, bringing together people interested in the subject beyond Luxembourg's borders. More than 260 participants, a record number for the event since its creation in 2018, gathered around the central theme of the 2024 edition: artificial intelligence (IA).

After the opening speech by Malte Beyer-Katzenberger, Team Leader at the European Commission, speakers from the National Commission for Data Protection (Commission nationale pour la protection des données - CNPD), BEE SECURE, the Luxembourg Institute of Science and Technology (LIST), the Maastricht University, the University of Luxembourg and the law firm /c law follow one another on Data Privacy Day 2024 stage.

Artificial intelligence, a source of challenges and opportunities

Artificial intelligence is all around us. It uses a wide range of technologies: recommendation systems, image or voice recognition, text generation, self-driving cars, etc. These technologies and the tools that implement them create challenges in protecting privacy and the people whose personal data is processed. Risk of data leak to third parties, reputation damage, mobbing, blackmailing, faking evidence, surveillance, and identification are just a few examples.

When Artificial intelligence is using personal data, regulation compliance is essential. The European Union already has several data initiatives, including the Data Governance Act, the Data Act or the General Data Protection Regulation (GDPR) and the guidance provided by the supervisory authorities to ensure its application.

The RGPD, which defines the main framework for personal data processing within the European Union since May 2018, was discussed during the conference. Like other legislation, the RGPD establishes rules to allow the free movement of personal data and protect the rights and freedoms of natural persons. It is considered as the key legal text when personal data is concerned.

Further regulation expected

Article 22 GDPR, ‘Automated individual decision-making, including profiling’, is already a safeguard for individual rights in the domain of automated decision-making, on the integration of artificial intelligence. However, the AI Act - specifically designed to regulate the use of artificial intelligence in the European Union and which should come into force by 2026 – will offer specific regulation for AI based on a risk approach like the RGPD. Interacting with the RGPD, it will be a significant key step in the regulation of artificial intelligence. In particular, the AI Act will include an artificial intelligence systems classification based on their purpose, which will determine the level of compliance, requirements and obligations. On the other way around, this new regulation will impact data protection experts and Data protection officers (DPOs). This remains to be determined to what extent, as the role of DPOs is defined within the RGPD.

Generally speaking, and perhaps even more so in an academic and research context, any institution processing personal data with AI techniques must comply with data protection laws and document their processing. Even if the legislation is behind technological development and lacks in certain areas, compliance cannot be ignored. The utmost caution must therefore be taken when using AI technology in combination with personal data.

Relive the event by viewing the Data Privacy Day 2024 video and photo gallery or by accessing the presentations on the event website: dataprivacyday.lu