CERT-FR

CERT-FR
Name	CERT-FR
Formed	2001
Jurisdiction	France
Headquarters	Paris
Parent agency	ANSSI

CERT-FR

CERT-FR is the national computer security incident response team of France, operating under the French National Cybersecurity Agency. It provides incident handling, alerts, and coordination among public institutions, private companies, and international partners, drawing on expertise linked to agencies and organizations across Europe and worldwide.

History

CERT-FR was created in 2001 amid growing concerns highlighted by incidents involving I LOVE YOU (computer virus), Code Red worm, SQL Slammer, Anna Kournikova virus, and the Nimda worm, reflecting a period when institutions such as Ministry of the Interior (France), Ministry of Defence (France), République française, and transnational entities like NATO Computer Incident Response Capability sought improved cyber resilience. Over time CERT-FR aligned with national reforms influenced by legislation such as the French Data Protection Act and directives from the European Union Agency for Cybersecurity and the European Commission. Its evolution paralleled milestones involving ENISA, Agence nationale de la sécurité des systèmes d'information, Agence nationale pour la sécurité des systèmes d'information, National Security Agency, and operational contexts including incidents linked to groups associated with Anonymous (group) and campaigns traced to actors like Fancy Bear, Cozy Bear, and operations referenced in Operation Aurora.

CERT-FR’s development intersected with high-profile events including responses to vulnerabilities like Heartbleed, Shellshock (software bug), WannaCry ransomware attack, and NotPetya. Collaboration and policy coordination involved counterparts such as US-CERT, CERT-EU, JPCERT/CC, CERT-UK, CERT-IN, and standards bodies including ISO/IEC 27001, Common Vulnerabilities and Exposures, and forums like FIRST.

Mission and Responsibilities

CERT-FR’s mission encompasses operational incident response, situational awareness, and advisory functions related to cybersecurity threats like ransomware campaigns attributed to groups formerly associated with REvil, Conti, and malware families such as Emotet. It issues alerts and advisories referencing vulnerabilities catalogued by Mitre Corporation and frameworks from NIST. Responsibilities include coordination with authorities such as Ministry of Armed Forces (France), Direction générale de la sécurité intérieure, and regulators like Autorité des marchés financiers when incidents affect critical sectors including entities in the Système d'information de santé and infrastructure covered by European Critical Infrastructure designations.

CERT-FR provides guidance on incident lifecycle practices drawn from models promoted by SANS Institute, Carnegie Mellon University, and standards referenced by OCDE and G7 cybersecurity agendas. It contributes to national strategies influenced by reports from institutions such as Inspection générale des finances (France) and Cour des comptes.

Organization and Structure

CERT-FR operates within the ANSSI structure, interacting with units connected to Direction générale de la sécurité extérieure, Direction centrale de la police judiciaire, and offices within Premier ministre (France). Teams include analysts, responders, and liaison officers who coordinate with private-sector counterparts like Orange S.A., Thales Group, Atos, Capgemini, and research groups at institutions such as INRIA, Université Paris-Saclay, École Polytechnique, Télécom Paris, and CNRS.

Its structure supports specialized cells focusing on malware analysis, threat intelligence, vulnerability handling, and CERT coordination, aligning practices with international bodies including FIRST, OASIS, and the Council of the European Union cyber policies. Staffing and expertise reflect collaborations with academia and industry including researchers from École normale supérieure, Sorbonne University, École des Mines de Paris, and private labs like Kaspersky Lab, ESET, CrowdStrike, Palo Alto Networks, and FireEye.

Activities and Services

CERT-FR provides services such as alert bulletins, incident triage, forensic support, vulnerability advisories, and public guidance during crises similar to responses seen in SolarWinds hack and supply-chain incidents affecting vendors like Microsoft and SolarWinds. It publishes security notices addressing threats tied to platforms from Microsoft Windows, Linux kernel, OpenSSL, Apache HTTP Server, WordPress, and vendors including Cisco Systems, Huawei, and VMware.

Operational activities include managing incident reports, conducting cyber exercises with stakeholders modeled on exercises like Cyber Europe, sharing indicators of compromise using formats promoted by MITRE ATT&CK and STIX/TAXII, and engaging in tabletop exercises with infrastructure operators such as Réseau de transport d'électricité, SNCF, and Aéroports de Paris (ADP). CERT-FR also contributes to capacity building with training influenced by curricula from SANS Institute, EC-Council, and university programs at HEC Paris.

Collaboration and Partnerships

CERT-FR maintains partnerships with national and international counterparts including CERT-EU, US-CERT, ENISA, NCSC (United Kingdom), JPCERT/CC, CERT-UK, CERT-IN, and law enforcement agencies like Europol and Eurojust. It coordinates with standards and industry groups such as IETF, W3C, OpenSSL Software Foundation, and private cybersecurity firms including Sophos, Trend Micro, and McAfee.

At the European level it engages with initiatives tied to the NIS Directive, GDPR, and projects supported by the European Commission and Horizon 2020, liaising with operators from sectors represented by organizations like Groupe BPCE, BNP Paribas, Société Générale, and energy firms such as EDF and TotalEnergies.

Notable Incidents and Responses

CERT-FR has been active in responses to incidents including mitigation efforts during global outbreaks like WannaCry ransomware attack and NotPetya, advisories during the Heartbleed and Shellshock (software bug) disclosures, coordination around supply-chain compromises akin to SolarWinds hack, and alerts concerning malware families such as Emotet and TrickBot. It has participated in investigations and coordinated disclosures involving vendors like Microsoft, Oracle Corporation, Adobe Inc., and Google.

CERT-FR’s publicized actions included collaboration with Europol during transnational takedown operations, information sharing with US-CERT on state-sponsored intrusion campaigns associated with APT28 and APT29, and support to critical infrastructure operators during incidents affecting Réseau Ferré de France-related systems and aviation stakeholders including Air France.

Category:Computer emergency response teams