CERT

CERT
Name	CERT
Caption	Incident response diagram
Formation	1988
Type	Computer security incident response
Headquarters	Pittsburgh, Pennsylvania
Region served	International
Leader title	Founder
Leader name	CERT Coordination Center

CERT is a term denoting teams and centers dedicated to handling computer security incidents, coordinating responses, and disseminating vulnerability information. Originating from an institutional response to large-scale compromises, CERT units operate within a networked ecosystem that includes academic institutions, private sector firms, international organizations, and national agencies. These teams engage with stakeholders across sectors such as Carnegie Mellon University, Department of Defense (United States), National Institute of Standards and Technology, European Union Agency for Cybersecurity, and Internet Engineering Task Force to reduce risk and improve resilience.

History

The concept began after the Morris worm incident, which catalyzed the creation of the original team at Carnegie Mellon University and led to the establishment of the CERT Coordination Center in 1988. Early activities involved collaboration with entities including DARPA, National Science Foundation, and private firms like IBM and Microsoft to share indicators, publish advisories, and develop coordinated disclosure practices. Over the 1990s and 2000s, CERT-like teams proliferated alongside the growth of the World Wide Web, with new units formed in response to incidents affecting Bank of America, Sony Pictures Entertainment, and other high-profile organizations. The expansion included national initiatives tied to frameworks such as the Budapest Convention on Cybercrime, the NIS Directive, and guidance from ISO/IEC standards bodies.

Structure and Organization

CERT units exhibit diverse governance models: academic-hosted centers, corporate incident response groups, and national teams embedded within ministries or agencies like Department of Homeland Security (United States), Ministry of Defence (United Kingdom), and National Cyber Security Centre (United Kingdom). Organizational roles often mirror best practices from CERT Coordination Center: incident handlers, malware analysts, vulnerability researchers, and liaison officers who interact with entities such as Interpol, Europol, Financial Services Information Sharing and Analysis Center, and sector-specific regulators. Funding sources range from university grants provided by National Science Foundation to contracts with firms like Cisco Systems and Symantec. Governance frameworks reference legal instruments including the Computer Fraud and Abuse Act, the General Data Protection Regulation, and procurement rules used by institutions like United Nations agencies.

Functions and Services

Primary services include incident triage, vulnerability disclosure, threat intelligence sharing, and advisories tailored for audiences such as Amazon Web Services, Google, and Apple Inc.. CERT teams maintain toolsets and publish analysis on malware families linked to actors tied to events like the NotPetya and WannaCry incidents, collaborating with research labs at Massachusetts Institute of Technology, Stanford University, and University of Cambridge. They operate hotlines and reporting channels used by telecom operators such as AT&T and Verizon Communications and coordinate with cloud providers including Microsoft Azure and Alibaba Cloud. In support of supply chain security, CERT units reference standards from National Institute of Standards and Technology and engage with consortia like Open Web Application Security Project.

Incident Response and Coordination

During major compromises, CERT teams engage in coordinated disclosure processes with vendors such as Red Hat and Oracle Corporation and law enforcement partners including Federal Bureau of Investigation and Cybersecurity and Infrastructure Security Agency. Playbooks align with practices advocated by organizations like SANS Institute and FIRST to manage containment, eradication, and recovery phases. CERTs participate in cross-border exercises with actors from NATO, ASEAN CERTs, and national incident response units to rehearse scenarios exemplified by supply chain attacks on firms like SolarWinds. Communication channels include mailing lists, secure portals, and platforms maintained by GitHub and Slack Technologies for coordination among affected parties and external researchers.

Training, Research, and Best Practices

CERT units produce curriculum and certifications in collaboration with educational partners such as Carnegie Mellon University's Heinz College and training providers like SANS Institute and (ISC)². Research output spans vulnerability disclosure policy, malware taxonomy, and resilience metrics published in venues such as IEEE Symposium on Security and Privacy, USENIX Security Symposium, and ACM Conference on Computer and Communications Security. Best practices propagated by CERTs reference frameworks including NIST Cybersecurity Framework, ISO/IEC 27001, and sector guidance from World Bank projects. Workshops and capture-the-flag events involve communities around DEF CON and Black Hat Briefings to cultivate practitioner skills.

Notable CERTs and Global Network

Prominent centers include the CERT Coordination Center at Carnegie Mellon University, national teams like United States-CERT, CERT-EU, Japan Computer Emergency Response Team Coordination Center, and country teams affiliated with APCERT and FIRST. Industry response units at organizations such as Microsoft Security Response Center and Google Project Zero collaborate with national CERTs and international bodies including ICANN and Internet Society to address systemic risks. Regional networks such as OAS-CERT and partnerships involving African Union initiatives extend capacity building to developing regions, creating a layered global network that links incident response, policy development, and operational research.

Category:Computer security