BSC-CERT

BSC-CERT
Name	BSC-CERT
Type	Computer emergency response team
Established	2000s
Headquarters	Barcelona, Catalonia
Region served	Spain, Europe
Parent organization	Barcelona Supercomputing Center

BSC-CERT BSC-CERT is the incident response and cybersecurity coordination unit associated with the Barcelona Supercomputing Center. It provides technical incident handling, vulnerability coordination, and digital forensics support to research centers, academic networks, and high-performance computing facilities. The unit interfaces with national and international actors in cybersecurity, security operations, and research infrastructure protection.

Overview

BSC-CERT functions as a specialized incident response entity within the context of Barcelona Supercomputing Center operations and interacts with institutions such as European Union Agency for Cybersecurity, INCIBE, National Cryptologic Center (Spain), RedIRIS, and regional research networks like GÉANT. It addresses threats affecting compute clusters, storage arrays, and scientific data, coordinating with entities including CERN, EMBL, Max Planck Society, CNRS, and CSIC. The unit draws on frameworks and standards promulgated by ISO/IEC 27001, NIST Special Publication 800-61, ENISA, and aligns practices with initiatives from Horizon Europe, European Commission, and national research funding agencies.

History and Development

BSC-CERT emerged amid early 21st-century concerns about protecting large-scale compute resources, parallel to developments at Argonne National Laboratory, Oak Ridge National Laboratory, Lawrence Livermore National Laboratory, and Los Alamos National Laboratory. Its formation was influenced by incidents at supercomputing facilities and by collaborative models from FIRST member teams and regional CERTs such as CERT-EU and CERT-CC. Over time it incorporated lessons from high-profile events involving actors like the Shadow Brokers disclosures and vulnerabilities in ecosystem projects such as OpenSSL, Kubernetes, Slurm Workload Manager, Apache Hadoop, and Linux kernel. BSC-CERT's evolution paralleled advances in cluster security, containerization trends from Docker, orchestration from Kubernetes, and storage innovations tied to Ceph and Lustre.

Organization and Governance

BSC-CERT operates under the governance structures of the Barcelona Supercomputing Center and coordinates with oversight bodies such as the Ministry of Science and Innovation (Spain), regional authorities in Catalonia, and compliance frameworks referenced by European Data Protection Board guidance. Its team comprises incident responders, malware analysts, network engineers, and legal liaisons who engage with standards bodies including IETF, OWASP, FIRST, and ISO. The unit liaises with research governance actors like ETH Zurich, Imperial College London, University of Cambridge, University of Oxford, and national CERT counterparts such as CERT-FR, CERT-UK, and NCSC-NL for cross-border coordination.

Activities and Services

BSC-CERT provides payload analysis, intrusion detection tuning, threat intelligence sharing, and security posture assessments for projects supported by agencies like European Research Council, Spanish State Research Agency, and research infrastructures within ESFRI. It offers incident handling for HPC-specific issues—compromise of job schedulers like Slurm, abuse of MPI environments, or lateral movement through shared home directories—while engaging in proactive measures such as vulnerability disclosure coordination modeled on Bugcrowd and HackerOne programs. Training and exercises are run in collaboration with academic partners like Pompeu Fabra University, Polytechnic University of Catalonia, University of Barcelona, and consortiums such as EPI and PRACE.

Notable Incidents and Responses

BSC-CERT has responded to supply-chain and exploitation events reflecting broader incidents such as the SolarWinds compromise, vulnerabilities in Log4j, and targeted intrusions leveraging stolen credentials akin to attacks attributed to state and non-state actors in reports by CERT-EU and ENISA. Responses have included coordinated disclosure with projects like OpenSSL, remediation of compromised compute nodes affecting collaborative projects tied to HPC Wales and PRACE, and forensic reconstruction following ransomware intrusions similar in profile to incidents affecting Jisc and other research networks. The unit has contributed to post-incident analyses referenced in cross-institutional after-action reviews alongside teams from FIRST and US-CERT affiliates.

Partnerships and Collaborations

BSC-CERT maintains partnerships with academic, research, and operational organizations including RedIRIS, GÉANT, PRACE, EUDAT, EOSC, and national cybersecurity centers like INCIBE and CCN-CERT. International collaboration extends to contacts at CERN CERT, NERSC, JSC (Jülich Supercomputing Centre), SURFnet, and consortia such as GARR and HEAnet. It participates in exercises with institutional stakeholders such as European Commission DG CONNECT, NATO CCDCOE, and private-sector security vendors including Cisco, Palo Alto Networks, CrowdStrike, Splunk, and Fortinet for capability development and threat intelligence exchange.

Legal and Policy Framework

BSC-CERT operates within legal frameworks shaped by instruments such as the General Data Protection Regulation, Spanish national legislation under the Ley Orgánica de Protección de Datos, and EU cybersecurity directives like the NIS Directive and subsequent updates. Its operations reflect obligations arising from procurement and funding rules from Horizon 2020 and Horizon Europe, intellectual property norms pertaining to collaborative research with institutions like ESA and EIT Digital, and compliance with export-control considerations related to high-performance computing covered by agreements involving entities such as OECD member states.

Category:Computer security organizations Category:Cybersecurity in Spain