CERN Computer Security Team

CERN Computer Security Team
Name	CERN Computer Security Team
Formation	1994
Type	Unit
Headquarters	Geneva
Location	CERN
Region served	International
Leader title	Head
Parent organization	CERN

CERN Computer Security Team

The CERN Computer Security Team provides cybersecurity services, incident response, and research support for CERN's complex computing infrastructure. The team operates within an ecosystem that includes major scientific facilities and international collaborations such as the Large Hadron Collider, ATLAS experiment, and CMS experiment. It engages with global institutions including European Organization for Nuclear Research, European Grid Infrastructure, Fermilab, DESY, and TRIUMF to protect critical research computing, data repositories, and control systems.

History

The team's origins trace to the early 1990s when CERN hosted pioneers of the World Wide Web like Tim Berners-Lee and expanded networked services for collaborations such as LEP and LHC. Early interactions involved security challenges linked to systems developed at SLAC National Accelerator Laboratory, Brookhaven National Laboratory, Lawrence Berkeley National Laboratory, and CERN’s Computer Centre. Notable historical intersections include responding to incidents that involved software from projects like ROOT (data analysis framework), HEP (high energy physics), and grid middleware used by EGEE and Open Science Grid. Over time the team formalized roles paralleling standards from ISO/IEC 27001, NIST Cybersecurity Framework, and guidelines used by ENISA and CERT Coordination Center.

Organization and Responsibilities

The team is structured to integrate with operational groups supporting experiments such as LHCb experiment, ALICE (A Large Ion Collider Experiment), and services like CERN Document Server and EOS (CERN storage). Responsibilities include vulnerability management for platforms like Linux, Windows, and VMware ESXi, patch coordination with vendors such as Red Hat, Microsoft, and Canonical (company), and protecting applications including Drupal, Jenkins, and GitLab. The group liaises with governance bodies such as the CERN Council, IT Department (CERN), and project management offices for upgrades of services like CASTOR and CERNBox. It enforces policy in line with regulations like the General Data Protection Regulation where applicable to collaborate with legal offices and data protection officers.

Security Operations and Incident Response

Operational duties incorporate 24/7 monitoring through security information and event management tools interoperable with partners including FIRST and MISP Project. The team coordinates responses to incidents involving malware families documented by CERT-EU, US-CERT, and private firms such as Kaspersky Lab, Symantec, and CrowdStrike. It manages threat intelligence exchange with research networks like GEANT, Internet2, TERENA, and incident response teams such as CERT France and UK National Cyber Security Centre. The unit supports continuity for control systems in collaboration with Siemens, Schneider Electric, and research infrastructure teams operating PLC-based environments and accelerator control systems designed by CERN Engineering Department.

Research and Development

R&D activities include deploying defensive technologies used in projects associated with Grid computing, Cloud computing providers like OpenStack, and container platforms such as Docker and Kubernetes. The team contributes to tooling and analysis for vulnerabilities in software developed by collaborations like Gaudi (software) and data workflows using HTCondor. It publishes findings to workshops and conferences including USENIX Security Symposium, Black Hat, Chaos Communication Congress, SANS Institute events, and scientific venues like ISC High Performance and HEP Software Foundation. Collaborative development occurs with academic groups from ETH Zurich, École Polytechnique Fédérale de Lausanne, University of Oxford, University of Cambridge, and Imperial College London.

Collaboration and Outreach

Outreach encompasses training and capacity building with partner institutions including IHEP (Beijing), KEK, JINR, CERN School of Computing, and regional CERTs. The team coordinates exercises with international projects such as Wikimedia Foundation's infrastructure teams and engages in standards development with IETF and ISO. Public communication leverages relationships with media organizations and research publishers like Nature (journal), Science (journal), and conference organizers for transparent disclosure of vulnerabilities. Education initiatives include workshops in partnership with ITU, UNESCO, and university cybersecurity courses at EPFL and University of Geneva.

Notable Incidents and Impact

The team has managed responses to intrusions that had implications for experiments including data access concerns at ATLAS experiment and CMS experiment, coordinated mitigation for vulnerabilities affecting middleware from gLite and UNICORE, and addressed supply-chain risks involving vendors like Cisco Systems and Juniper Networks. Its incident handling influenced policies adopted by international labs such as Fermilab and DESY and contributed to best practices disseminated through FIRST and ENISA guidance. Strategic contributions include improving resilience for distributed analysis frameworks used across collaborations like Worldwide LHC Computing Grid and informing security hardening in projects funded by the European Commission.

Category:CERN Category:Computer security teams