CERT-AU

CERT-AU
Name	CERT-AU
Formation	2000
Headquarters	Canberra, Australian Capital Territory
Region served	Australia
Parent organization	Australian Signals Directorate

CERT-AU CERT-AU is the national computer emergency response team for Australia, responsible for coordinating cybersecurity incident response, information sharing, and mitigation across public and private sectors. Based in Canberra, CERT-AU operates within the Australian Signals Directorate alongside other national security and intelligence bodies. It engages with international counterparts, industry partners, and research institutions to reduce cyber threats affecting critical infrastructure, corporations, universities, and citizens.

History

CERT-AU was established in 2000 amid rising concerns following international incidents such as the ILOVEYOU worm and the Melissa virus, prompting parallels with responses by CERT Coordination Center, United States Computer Emergency Readiness Team, Computer Emergency Response Team of Ukraine, and NATO Cooperative Cyber Defence Centre of Excellence. Early collaborations involved Australian agencies like the Australian Federal Police, Australian Security Intelligence Organisation, Department of Defence (Australia), and state-based entities including the New South Wales Police Force and the Victoria Police. Major global events such as the Stuxnet operation, the Sony Pictures hack, and the WannaCry cyberattack influenced CERT-AU's evolution in threat intelligence, incident coordination, and public advisories. CERT-AU’s growth paralleled developments at organizations like US-CERT, CERT-EU, Japan Computer Emergency Response Team Coordination Center, and regional teams including CERT NZ and APCERT. Over time, CERT-AU incorporated lessons from breaches affecting Equifax, Target Corporation, Marriott International, and attacks on Australian Parliament House to refine protocols and partnerships with entities such as Commonwealth Bank of Australia, Telstra, Optus, Qantas, and universities like Australian National University and University of Sydney.

Organization and Governance

CERT-AU functions under the auspices of the Australian Signals Directorate and interfaces with ministers from portfolios such as the Department of Home Affairs (Australia) and the Attorney-General's Department. Its governance reflects coordination with the Council of Australian Governments, state and territory authorities including the Government of New South Wales and Victorian Government, and statutory bodies like the Australian Communications and Media Authority and the Office of the Australian Information Commissioner. Internally, CERT-AU collaborates with agencies such as the Australian Cyber Security Centre, the Australian Criminal Intelligence Commission, and the Australian Transaction Reports and Analysis Centre. Advisory engagement extends to industry regulators including the Australian Prudential Regulation Authority and the Australian Securities and Investments Commission, as well as international liaison with the Five Eyes partners: United States Department of Homeland Security, Government Communications Headquarters, Communications Security Establishment (Canada), and New Zealand Ministry of Defence. CERT-AU’s organizational model mirrors practices seen at the National Cyber Security Centre (UK) and the European Union Agency for Cybersecurity.

Functions and Services

CERT-AU provides incident reporting, vulnerability coordination, advisories, and situational awareness similar to services offered by Microsoft Security Response Center, Cisco Talos, and Google Project Zero. It issues alerts on malware like Conficker, Zeus, Mirai, and exploits such as Heartbleed, Shellshock, and Log4Shell. Services include coordination of patching efforts for products from vendors like Microsoft, Apple Inc., Google, Cisco Systems, Fortinet, VMware, and Adobe Systems. CERT-AU publishes guidance used by operators of Australian Prudential Regulation Authority-regulated entities, Australian Broadcasting Corporation, and transport firms such as Sydney Trains and Airservices Australia. It facilitates information sharing through platforms akin to FIRST (organisation), MISP, and sector-specific ISACs including models like Financial Services Information Sharing and Analysis Center and collaborates with research centers such as Australian Research Council projects at University of Melbourne and Monash University.

Major Incidents and Responses

CERT-AU has coordinated responses to incidents affecting national infrastructure, telecoms, finance, and education, drawing on case studies like the Optus data breach, the Medibank cyberattack, and supply-chain compromises comparable to SolarWinds hack. It supported mitigation during campaigns attributed to state actors linked to incidents reminiscent of operations targeting Microsoft Exchange Server and proxying tactics similar to those used in the NotPetya outbreak. Responses have involved coordination with organisations including AustCyber, ASIO, AFP, and private firms such as Deloitte, KPMG, PwC, and CrowdStrike. CERT-AU’s advisories have been timed alongside international alerts from US-CERT, CISA, NCSC (UK), and industry vendors during vulnerabilities like PrintNightmare and ProxyLogon.

Partnerships and Collaboration

CERT-AU maintains bilateral and multilateral ties with bodies such as APCERT, FIRST, Interpol, Europol, and regional partners including ASEAN Cybersecurity Centre initiatives. Collaboration extends to academia—Queensland University of Technology, Griffith University, CSIRO, and Commonwealth Scientific and Industrial Research Organisation projects—and industry groups like Australian Information Industry Association and Digital Transformation Agency. It liaises with critical infrastructure operators including Sydney Water, Ausgrid, EnergyAustralia, and TransGrid, and with cloud providers such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform. CERT-AU participates in exercises modeled on Cyber Storm and Locked Shields, and engages with standards organizations including ISO and IEC through national bodies like Standards Australia.

Legal and Policy Framework

CERT-AU operates within legislative frameworks including the Telecommunications Act 1997 (Cth), privacy laws administered by the Office of the Australian Information Commissioner, and policy instruments from the Department of Home Affairs (Australia), Minister for Defence (Australia), and Attorney-General of Australia. Its activities align with national strategies such as the Australian Cyber Security Strategy and regulatory expectations set by Australian Signals Directorate directives and the Australian Government Information Security Manual. International legal coordination involves treaties and agreements with United States, United Kingdom, Canada, and New Zealand authorities, and engagement with conventions discussed at forums like the United Nations General Assembly cyber norms debates and Budapest Convention on Cybercrime initiatives.

Category:Computer security organizations