Computer Emergency Response Team

Computer Emergency Response Team
Name	Computer Emergency Response Team
Founded	November 1988
Founder	Defense Advanced Research Projects Agency
Location	Pittsburgh, Pennsylvania, United States
Key people	CERT Division (Software Engineering Institute)
Focus	Computer security, incident response

Computer Emergency Response Team. A Computer Emergency Response Team (CERT) is a specialized group of experts responsible for responding to and mitigating major cybersecurity incidents. These teams are typically established by governments, corporations, or academic institutions to address threats like viruses, denial-of-service attacks, and other forms of cyberattack. Their work is crucial for maintaining the security and resilience of national critical infrastructure and the global Internet.

Overview

The primary mission of a CERT is to serve as a central coordination point for handling computer security emergencies. This involves analyzing emerging malware threats, providing technical advisories, and facilitating information sharing among various stakeholders, including other CERTs, ISPs, and law enforcement. Teams often operate under frameworks like the Forum of Incident Response and Security Teams (FIRST) to standardize practices. Their activities are integral to national strategies for cyber defense, as seen in initiatives by the Department of Homeland Security in the United States and the European Union Agency for Cybersecurity (ENISA).

History

The concept originated in direct response to the Morris worm incident of November 1988, which severely disrupted the early ARPANET. Following this, the Defense Advanced Research Projects Agency (DARPA) funded the creation of the first team at the Software Engineering Institute (SEI) at Carnegie Mellon University. This original group, initially called the CERT Coordination Center, set the foundational model for incident response. Throughout the 1990s, as the World Wide Web expanded and threats like the ILOVEYOU virus emerged, many nations, including Japan through JPCERT/CC and Germany via the Federal Office for Information Security (BSI), established their own national teams. The evolution continued with the formation of regional entities like APCERT for the Asia-Pacific region.

Functions and responsibilities

Core functions include 24/7 incident handling, where teams analyze attack vectors from phishing to advanced persistent threats (APTs). They issue security advisories and vulnerability notes for software from vendors like Microsoft or Oracle Corporation. Proactive measures involve running honeypots to gather threat intelligence and conducting cyber exercises such as those coordinated by the North Atlantic Treaty Organization (NATO). Many also provide digital forensics support to organizations like the Federal Bureau of Investigation (FBI) and assist in patch management for systems within national infrastructures like the power grid.

Types and structure

Teams are organized into several categories, including national CERTs (like CERT-FR in France or CERT-In in India), corporate CERTs within entities such as IBM or Siemens, and academic CERTs at institutions like Stanford University. Military and defense-focused teams, such as the United States Cyber Command, operate separately. Coordination is often hierarchical, with national teams like AusCERT in Australia liaising with sectoral teams for finance or healthcare, and international bodies like the International Telecommunication Union (ITU) helping to federate efforts. Funding and oversight typically come from government agencies, such as the National Institute of Standards and Technology (NIST) in the U.S.

Notable teams

Prominent global teams include the original CERT Coordination Center (CERT/CC) at Carnegie Mellon University. In Europe, key entities are CERT-EU for European Union institutions and GovCERT.ch in Switzerland. The Asia-Pacific region is served by KrCERT/CC in South Korea and SingCERT in Singapore. Other significant national teams are CIRCL in Luxembourg, CERT.br in Brazil, and CERT-UK, now part of the National Cyber Security Centre (NCSC) in the United Kingdom. Coordination among these is often managed through the Forum of Incident Response and Security Teams (FIRST).

Challenges and criticisms

Major challenges include the sheer volume of incidents, often overwhelming teams during events like the WannaCry ransomware attack. Jurisdictional conflicts can arise when attacks cross borders, complicating cooperation with agencies like Europol. Some critics argue that the voluntary information-sharing model can be slow, as seen in responses to SolarWinds hack. There are also concerns about potential overlaps with functions of intelligence agencies like the National Security Agency (NSA) and about the transparency of teams operating under laws like the USA PATRIOT Act. The rapid evolution of threats from IoT devices and artificial intelligence-driven attacks continually tests their capacity.

Category:Computer security organizations Category:Emergency management