US-CERT

US-CERT
Agency name	United States Computer Emergency Readiness Team
Formed	September 2003
Preceding1	Federal Computer Incident Response Center (FedCIRC)
Jurisdiction	Federal government of the United States
Headquarters	Arlington County, Virginia
Parent department	United States Department of Homeland Security
Parent agency	Cybersecurity and Infrastructure Security Agency

US-CERT. The United States Computer Emergency Readiness Team is a pivotal operational component within the federal cybersecurity apparatus. It was established to protect the nation's internet infrastructure by coordinating defense against and response to cyber attacks. Operating under the Cybersecurity and Infrastructure Security Agency within the United States Department of Homeland Security, it serves as a central hub for collaborating with federal agencies, the private sector, and international partners to manage cyber risks and incidents.

History and establishment

The organization was formally created in September 2003, building upon the foundation of the earlier Federal Computer Incident Response Center. Its establishment was a direct response to the increasing frequency and sophistication of cyber threats following the turn of the millennium, highlighted by incidents like the Code Red (computer worm) and the Nimda worm. The National Strategy to Secure Cyberspace, released by the George W. Bush administration, called for a centralized national capability, leading to its formation within the then-new United States Department of Homeland Security. This move consolidated various federal cybersecurity response functions under a single, mission-focused entity to improve coordination and situational awareness across the Federal government of the United States.

Mission and functions

Its core mission is to improve the nation's cybersecurity posture, defend against malicious activity, and communicate cyber risk information to the public. Primary functions include operating a 24/7 watch and warning center that monitors for emerging threats and active incidents across federal networks. It analyzes vulnerabilities and disseminates critical alerts and guidance through products like security bulletins and technical advisories. Furthermore, it provides direct incident response support to federal civilian agencies, helping to contain breaches and facilitate recovery, while also fostering information sharing with critical infrastructure operators through initiatives like the Industrial Control Systems Cyber Emergency Response Team.

Organizational structure

The team is organized into several key divisions focusing on operations, analysis, and stakeholder engagement. It operates the National Cybersecurity and Communications Integration Center, a flagship facility that co-locates personnel from various partners for real-time collaboration. Key internal groups include the Operations Division for continuous monitoring and the Analysis Division for in-depth threat research. Leadership is provided by a director who reports through the Cybersecurity and Infrastructure Security Agency to senior officials at the United States Department of Homeland Security. The structure is designed to integrate efforts with other entities like the National Security Agency and the Federal Bureau of Investigation on complex threats.

Key programs and initiatives

Significant programs include the Enhanced Cybersecurity Services initiative, which shares classified threat indicators with certified providers to protect critical infrastructure. It manages the Cyber Information Sharing and Collaboration Program to facilitate real-time data exchange between government and private sector entities. The team also runs the Vulnerability Coordination program, working with researchers and vendors like Microsoft and Cisco Systems to responsibly disclose and patch software flaws. Public awareness campaigns, such as the "Stop. Think. Connect." initiative, are conducted in partnership with organizations like the National Cyber Security Alliance to promote safer online behavior.

Notable incidents and responses

The entity has played a central role in responding to major cyber events, including the widespread WannaCry ransomware attack that impacted organizations globally, including the National Health Service in the United Kingdom. It issued urgent alerts and provided mitigation guidance during the SolarWinds supply chain compromise, which affected numerous federal agencies and private companies. Other significant response efforts involved the Heartbleed security bug in OpenSSL, the Equifax data breach, and disruptive attacks on critical infrastructure, coordinating closely with agencies like the Federal Energy Regulatory Commission and international bodies like the European Union Agency for Cybersecurity.

Relationship with other cybersecurity entities

It maintains extensive partnerships across the cybersecurity ecosystem. Within the U.S. government, it collaborates closely with the National Institute of Standards and Technology on frameworks, the Department of Defense and its United States Cyber Command, and law enforcement via the Federal Bureau of Investigation. It works with sector-specific agencies like the Financial Services Information Sharing and Analysis Center. Internationally, it engages with counterparts such as the United Kingdom's National Cyber Security Centre, CERT-EU, and forums like the Forum of Incident Response and Security Teams to share threat intelligence and coordinate cross-border incident management, strengthening global cyber defense.

Category:Computer security organizations Category:United States Department of Homeland Security agencies Category:Computer emergency response teams Category:Organizations established in 2003