CERT-PT

CERT-PT
Name	CERT-PT
Formation	2007
Type	Computer Emergency Response Team
Headquarters	Porto
Region served	Portugal
Parent organization	National Cybersecurity Centre

CERT-PT is the national Computer Emergency Response Team for Portugal, responsible for coordinating incident response, vulnerability handling, and cybersecurity awareness. Established to strengthen national resilience, CERT-PT interacts with public institutions, private sector entities, and international cyber organizations to address threats and incidents. The team operates within Portugal's national cybersecurity framework and collaborates with multinational partners on cross-border incidents and threat intelligence sharing.

History

CERT-PT was created in 2007 as part of Portuguese efforts to align with European cybersecurity strategies and to respond to rising incidents that affected entities like the Port of Sines and the Lisbon Stock Exchange. Early interactions included coordination with ENISA, NATO Cooperative Cyber Defence Centre of Excellence, Europol, and national agencies such as Polícia Judiciária and Serviço de Informações de Segurança. Over time, CERT-PT engaged with international events including responses tied to vulnerabilities disclosed by Full Disclosure and incidents related to exploit frameworks like Metasploit Framework and scandals involving actors referenced in reports by Mandiant and FireEye. The unit's evolution mirrored policy shifts influenced by the Directive on security of network and information systems and legislative measures such as Portugal's transpositions of NIS Directive provisions and subsequent national cybersecurity laws.

Organization and Governance

CERT-PT operates within the governance structures associated with the National Cybersecurity Centre (Portugal), coordinating with ministries including Ministry of Internal Administration and regulatory bodies like Autoridade Nacional de Comunicações. Its governance model includes liaisons with the European Union Agency for Law Enforcement Cooperation and technical communities including RIPE NCC and IETF. Organizational roles are informed by standards and frameworks developed by ISO/IEC JTC 1, NIST, and best practices advocated by FIRST. Collaborations extend to academic partners such as University of Porto, NOVA University Lisbon, and research centres like INESC TEC and Fraunhofer Society affiliates. Oversight involves interaction with parliaments and committees referencing documents from European Commission and institutions like Council of the European Union.

Roles and Responsibilities

CERT-PT's mandate covers incident coordination, vulnerability disclosure, and national capacity building, aligning with practices from US-CERT and coordination patterns seen in CERT/CC. Responsibilities include liaison with law enforcement agencies such as GNR (Portugal) and Public Security Police (PSP), cooperation with financial regulators like Banco de Portugal and markets regulators including Comissão do Mercado de Valores Mobiliários, and advisories to critical infrastructure operators such as REN (Portugal) and Águas de Portugal. CERT-PT issues guidance referenced by telecommunications operators like Altice Portugal, cloud providers similar to Amazon Web Services, and software vendors in the manner of advisories from Microsoft Security Response Center and Google Project Zero. It also supports exercises inspired by tabletop scenarios used by Cyber Europe and incident simulations paralleling exercises from NATO CCDCOE.

Services and Operations

Services include handling reported incidents, publishing alerts, coordinating vulnerability disclosure with vendors such as Cisco Systems, Fortinet, Juniper Networks, and working with platform providers like Apple Inc., Google LLC, and Microsoft Corporation. Operational activities incorporate threat intelligence exchange via hubs similar to STIX and TAXII ecosystems, malware analysis comparable to reports from Kaspersky Lab and Symantec, and CERT-style coordination found at CERT-EU and US-CERT. CERT-PT maintains contact channels resembling those used by ICANN and incident playbooks consistent with SANS Institute guidance. It provides training and outreach akin to initiatives by Cybersecurity and Infrastructure Security Agency and partners with sectoral CERTs modeled after FIN-CCERT and GovCERT.NL.

Incidents and Response Actions

CERT-PT has managed incidents involving phishing campaigns, ransomware outbreaks, and supply-chain concerns reminiscent of cases investigated by Europol and INTERPOL. Response actions include coordination during incidents that affected utilities or transport operators comparable to scenarios involving Maersk and advisories following vulnerabilities like Heartbleed and Log4Shell. The team has participated in public notifications and mitigation guidance similar to alerts from CERT/CC and coordinated cross-border responses alongside entities such as ENISA and CERT-EU. CERT-PT's incident reports have informed stakeholders ranging from energy sector operators like Galp Energia to academic institutions such as Universidade de Coimbra.

Partnerships and International Cooperation

CERT-PT engages in partnerships with international bodies including ENISA, FIRST, TF-CSIRT, CERT-EU, and bilateral arrangements with national teams like CERT-BE and CERT-PT (non-linked example) — coordinated where appropriate via multinational forums such as G7 and European Council cyberworking groups. Collaborative efforts involve interfaces with industry consortia such as GSMA, ETSI, and OWASP, and with private-sector security firms including Trend Micro, CrowdStrike, Palo Alto Networks, and Check Point Software Technologies. Academic and research collaboration extends to memberships and joint projects with European Space Agency cybersecurity initiatives, cooperative labs similar to ENISA Threat Landscape reports, and participation in capacity-building programs supported by World Bank and Council of Europe.

Category:Computer emergency response teams