CERT Coordination Center

CERT Coordination Center
CERT/CC · Public domain · source
Name	CERT Coordination Center
Formation	1988
Type	Research and incident response center
Headquarters	Pittsburgh, Pennsylvania
Parent organization	Carnegie Mellon University Software Engineering Institute

CERT Coordination Center

The CERT Coordination Center is an incident response and vulnerability coordination organization based at the Carnegie Mellon University Software Engineering Institute in Pittsburgh, Pennsylvania. Founded following public disclosure debates and high-profile cybersecurity incidents involving the Morris worm and early Internet infrastructure, the center serves as a nexus for reporting computer security incidents, coordinating responses to software vulnerabilities, and advancing defensive research across industry, United States Department of Defense, and international partners. It maintains relationships with vendors such as Microsoft, Cisco Systems, Apple Inc., and IBM, while engaging with standards bodies including the Internet Engineering Task Force, the National Institute of Standards and Technology, and the International Organization for Standardization.

History

The center traces origins to 1988 after the Morris worm incident and was established amid debates involving Robert Tappan Morris and legal frameworks like the Computer Fraud and Abuse Act. Early personnel included researchers from Carnegie Mellon University and collaborators from SRI International and RAND Corporation, who linked academic vulnerability research to operational coordination during incidents such as the Solar Sunrise intrusions and the late 1990s I love you (computer virus) outbreaks. During the 2000s the center expanded coordination for disclosure practices influenced by incidents like the SQL Slammer worm and collaborations with corporate responders at CERT/CC-associated vendor forums. Post-2010, the center contributed to responses for events such as the Stuxnet analysis discussions and informed policy dialogues involving the White House and the Department of Homeland Security following high-profile breaches like the Sony Pictures hack and Target data breach.

Organization and Governance

The center operates within the Software Engineering Institute under the umbrella of Carnegie Mellon University and coordinates with federal entities including the Department of Homeland Security United States Computer Emergency Readiness Team and the Federal Bureau of Investigation. Its governance involves advisory boards drawing members from corporations such as Google, Facebook, Amazon (company), AT&T, and Verizon Communications as well as academic partners including Massachusetts Institute of Technology, Stanford University, University of California, Berkeley, and Georgia Institute of Technology. Leadership interacts with standards and policy institutions like the Internet Engineering Task Force, the National Security Agency, and the European Union Agency for Cybersecurity. Operational teams mirror incident response structures used by CERTs and CSIRTs worldwide and coordinate through frameworks aligned with NIST Special Publication guidance and ISO/IEC 27001 practices.

Services and Activities

The center provides vulnerability coordination, incident handling guidance, vulnerability notes, and training programs that mirror curricula used by SANS Institute, EC-Council, and university courses at Carnegie Mellon University. It issues technical advisories akin to those from Microsoft Security Response Center, and produces workflows comparable to FIRST incident response playbooks. Services include proactive vulnerability disclosure facilitation with vendors like Oracle Corporation and Adobe Inc., malware analysis in collaboration with laboratories such as VirusTotal and Kaspersky Lab, and secure coding guidance informed by initiatives like the Common Vulnerabilities and Exposures list and Common Weakness Enumeration. The center hosts incident coordination during major botnet takedowns that involve ISPs such as Comcast and backbone operators like Level 3 Communications.

Major Incidents and Responses

The center has been involved in coordinated responses to incidents including the Morris worm aftermath historically, large-scale distributed denial-of-service attacks that targeted providers including Akamai Technologies customers, and disclosure coordination following vulnerabilities in products from Microsoft, Apple Inc., and Cisco Systems. It played roles in analysis and information sharing during the Conficker worm, the Heartbleed OpenSSL vulnerability, and the Shellshock Bash bug, working alongside groups such as OpenSSL Project contributors, the National Cyber Security Centre (UK), and the Internet Storm Center. The center also contributed to cross-sector response exercises with entities like United States Cyber Command, critical infrastructure operators such as North American Electric Reliability Corporation, and financial institutions including JPMorgan Chase.

Research and Publications

Scholarly output includes vulnerability notes, best-practice guides, and empirical studies often cited alongside work from IEEE, ACM, and publications in venues such as the USENIX Security Symposium and Black Hat USA. Topics cover incident handling methodologies, software assurance informed by CERT Coordination Center datasets, secure coding practices mirrored by OWASP guidelines, and measurements of malware ecosystems compared with analyses from Symantec and McAfee. The center’s publications have influenced standards development at NIST and ISO, and its datasets have supported academic research at institutions like University of Cambridge and ETH Zurich.

Partnerships and Community Outreach

The center maintains partnerships with international Computer Emergency Response Teams such as CERT-UK, CERT-EU, AUSCERT, and JPCERT/CC, and collaborates with private sector partners including Microsoft Security Response Center, Google Project Zero, CrowdStrike, and FireEye. Outreach includes training workshops for operators from organizations such as World Bank and United Nations agencies, conference participation at DEF CON and RSA Conference, and cooperative vulnerability disclosure programs with technology companies like Cisco Systems and Oracle Corporation. The center supports community-driven initiatives involving open-source projects such as the OpenSSL Project and works with standards organizations including the Internet Engineering Task Force and ISO to foster resilient operational practices.

Category:Computer security organizations