CERT-FI

CERT-FI
Name	CERT-FI
Formed	2014
Jurisdiction	Finland
Headquarters	Helsinki
Parent agency	Traficom

CERT-FI is Finland's national computer emergency response team operating under the Finnish Transport and Communications Agency. It provides cybersecurity incident handling, vulnerability management, and national-level coordination for digital infrastructure. CERT-FI interacts with European Union institutions, NATO structures, private sector operators, and academic research centers to protect critical information systems across Finnish public and private sectors.

History

CERT-FI emerged amid reforms following European cybersecurity developments and national digitalization efforts. Its establishment intersected with work by the European Union Agency for Cybersecurity, NATO Cooperative Cyber Defence Centre of Excellence, ENISA, Council of the European Union, Finnish Transport and Communications Agency, and Finnish ministries such as the Ministry of Transport and Communications (Finland). The team's formation drew on precedents from national teams like CERT-EE, CERT-SE, CERT-NL, CERT-FR, US-CERT, JPCERT/CC, AusCERT, and FIRST. Policy drivers included directives like the NIS Directive and dialogues with entities such as European Commission, Europol, CERT-UK, and German Federal Office for Information Security. CERT-FI's timeline features engagements with events including exercises akin to Locked Shields, collaborations reflecting frameworks like GDPR, and coordination with actors such as Finnish Defence Forces and research centers including VTT Technical Research Centre of Finland.

Organization and Governance

CERT-FI operates within a governance framework linked to the Finnish Transport and Communications Agency and cooperates with ministries like the Ministry of the Interior (Finland), the Ministry for Foreign Affairs (Finland), and the Ministry of Defence (Finland). Its internal structure aligns with models used by NCSC-NL, CIRR, and national CSIRTs such as CERT-Bund and MELANI. Oversight and strategic policy connect CERT-FI to the Parliament of Finland deliberations, regulatory frameworks influenced by the European Parliament, and standards institutions like ISO, ETSI, and IETF. Leadership engages with international forums including FIRST, OAS CIS, OTAN, and bilateral links to teams such as CERT-RO, CERT-PL, CERT-IS, and CERT-CA.

Responsibilities and Services

CERT-FI's mandate covers incident handling, vulnerability coordination, situational awareness, and national warnings. It issues advisories comparable to notices from US-CERT, publishes alerts in coordination with ENISA advisories, and provides services resonant with offerings from Microsoft Security Response Center, Google Project Zero, and Kaspersky Lab. CERT-FI coordinates vulnerability disclosure processes akin to practices at CERT/CC and maintains information-sharing links with operators like F-Secure, Nokia, TietoEVRY, Ericsson, and cloud providers such as Amazon Web Services, Microsoft Azure, and Google Cloud Platform. Its service set includes liaison with telecom operators like Elisa (telecommunications), Telia Company, DNA Oyj, infrastructure firms like Fortum, and energy actors including Neste and ABB. CERT-FI also supports sectors represented by organizations such as Finnish Broadcasting Company, Yle, VR Group, and financial institutions including OP Financial Group and Nordea.

Incident Response and Coordination

CERT-FI conducts triage, forensic support, mitigation guidance, and national-level incident coordination. It synchronizes with law enforcement units such as the National Bureau of Investigation (Finland), court authorities, and prosecutors referencing cooperation norms used by Europol and INTERPOL. During major incidents, coordination practices mirror multi-stakeholder responses seen in incidents involving SolarWinds, WannaCry, NotPetya, and supply-chain events affecting vendors like Kaspersky Lab, Trend Micro, and McAfee. CERT-FI engages with private CSIRT teams from corporations such as Siemens, ABB, Huawei, Cisco Systems, and IBM X-Force while liaising with academic cyber ranges at institutions like Aalto University, University of Helsinki, and Tampere University. Cross-border incident coordination leverages mechanisms similar to CSIRT Network exchanges and ad hoc channels used by CERT-EU.

International Cooperation and Partnerships

CERT-FI maintains partnerships across European and global networks including ENISA, NATO, EUROPOL, FIRST, CERT-EU, and bilateral links to national teams such as CERT-SE, CERT-EE, CERT-PL, CERT-RO, CERT-IS, CERT-UK, US-CERT, JPCERT/CC, KISA (South Korea), and CERT-BR. It participates in joint exercises and information-sharing initiatives like Locked Shields, Cyber Europe, and collaborations with research institutions including Carnegie Mellon University, Oxford University, Stanford University, CERN, Fraunhofer Society, and Technische Universität München. Partnerships extend to vendors and security firms like F-Secure, WithSecure, NCC Group, FireEye, CrowdStrike, Palo Alto Networks, Fortinet, and SentinelOne for threat intelligence and tool exchanges. CERT-FI also engages with international policy bodies such as the United Nations, OSCE, and World Economic Forum on cyber norms and capacity building.

Notable Incidents and Contributions

CERT-FI has been involved in handling incidents that affected Finnish infrastructure and in publishing advisories that influenced practice across sectors represented by Nokia, Ericsson, Fortum, Neste, OP Financial Group, and Nordea. It contributed to national preparedness exercises reminiscent of responses to NotPetya and proactive coordination during events similar to compromises seen in SolarWinds and Exchange Server vulnerabilities. CERT-FI's publications and vulnerability coordination have intersected with disclosures from research groups including Google Project Zero, Citizen Lab, Talos (Cisco), Kaspersky Lab, Mandiant, and ESET. The team’s engagement with international exercises and policy fora has informed Finnish resilience strategies discussed within the Parliament of Finland and shaped cooperation with European Commission security initiatives.

Category:Computer emergency response teams Category:Cybersecurity in Finland