Computer Emergency Response Team Coordination Centre

Computer Emergency Response Team Coordination Centre
Name	Computer Emergency Response Team Coordination Centre
Abbreviation	CERT-CC
Formation	1988
Type	Incident response coordination
Headquarters	Pittsburgh, Pennsylvania
Parent organization	Carnegie Mellon University Software Engineering Institute

Computer Emergency Response Team Coordination Centre is an incident coordination entity focused on cybersecurity incident handling, vulnerability disclosure, and information sharing. It operates within the context of national and international cybersecurity communities, engages with academic institutions such as Carnegie Mellon University and Massachusetts Institute of Technology, and coordinates with industry actors like Microsoft, Google, Cisco Systems, and Symantec. The centre contributes to standards development with bodies such as Internet Engineering Task Force, Internet Corporation for Assigned Names and Numbers, and National Institute of Standards and Technology.

Overview

The centre serves as a hub for incident coordination among stakeholders including Federal Bureau of Investigation, Department of Homeland Security, European Union Agency for Cybersecurity, North Atlantic Treaty Organization, and private-sector partners such as Amazon (company), Facebook, Apple Inc., and IBM. It maintains situational awareness through feeds from vendors including Oracle Corporation, Red Hat, and VMware, Inc., and publishes advisories that inform operators at organizations like AT&T and Verizon Communications. The centre engages with standards and research communities including Institute of Electrical and Electronics Engineers, Association for Computing Machinery, SANS Institute, and ENISA.

History and Development

Origins trace to early coordination efforts following incidents affecting networks associated with research organizations like DARPA and National Science Foundation in the 1980s, paralleling work at institutions such as Stanford University and University of California, Berkeley. Over time the centre collaborated with government programs including U.S. Computer Emergency Readiness Team and initiatives linked to European Commission cybersecurity policy. It expanded capabilities by partnering with organizations including CERT Coordination Center affiliates, FIRST, and the Open Web Application Security Project. Notable milestones include integration of automated vulnerability disclosure practices influenced by advisories from Common Vulnerabilities and Exposures and coordination with Mitre Corporation.

Structure and Governance

Governance involves ties to research centers and institutional partners like Carnegie Mellon University, Software Engineering Institute, and advisory input from industry consortia such as Information Technology Industry Council and TechNet (association). Operational teams interface with law enforcement units such as United States Secret Service cyber units and international counterparts like Europol and INTERPOL. The organisation’s advisory boards historically include experts affiliated with MITRE, SRI International, RAND Corporation, and academic researchers from University of Cambridge and University of Oxford. Policy oversight has engaged policymakers from bodies including U.S. Congress committees and regulators such as Federal Communications Commission.

Roles and Activities

Primary activities include coordination of incident response alongside entities such as Mandiant (now part of Google), threat analysis in cooperation with Kaspersky Lab, and publication of vulnerability notes analogous to outputs from National Vulnerability Database. The centre runs sharing mechanisms compatible with frameworks such as Cyber Threat Intelligence standards from Structured Threat Information eXpression and engages with programmatic efforts like Bug Bounty platforms used by HackerOne and Bugcrowd. It provides training and exercises modeled after scenarios used by NATO Cooperative Cyber Defence Centre of Excellence and academic coursework at Carnegie Mellon University and Georgia Institute of Technology.

Partnerships and Collaboration

Partnerships span transnational organisations including United Nations Office on Drugs and Crime, Council of Europe, and regional bodies like African Union cyber initiatives. The centre collaborates with software vendors including Adobe Systems, Qualcomm, and Intel Corporation, as well as infrastructure operators such as Verisign and Akami Technologies (note: collaboration example). Research collaborations include projects with European Space Agency, NASA, and cybersecurity research labs at ETH Zurich and Tsinghua University. It participates in information sharing with industry groups like Financial Services Information Sharing and Analysis Center and Energy Information Sharing and Analysis Center.

Incidents and Response Operations

The centre has coordinated responses to incidents affecting large-scale infrastructure and service providers, working with responders from AT&T, Verizon Communications, and cloud providers such as Microsoft Azure and Amazon Web Services. It has engaged in mitigation efforts alongside incident responders from CrowdStrike and Palo Alto Networks during campaigns that overlapped with threats tracked by Fancy Bear and Cozy Bear-class operations. Operations include forensic collaboration with labs such as CERT/CC partners, evidence handling in cooperation with FBI Cyber Division, and cross-border takedown coordination with Europol and NCA United Kingdom.

Legal and Policy Framework

Activities occur within legal and policy frameworks shaped by legislation and frameworks like Computer Fraud and Abuse Act, General Data Protection Regulation, and policy instruments from United States Department of Commerce. The centre aligns disclosure practices with legal opinions from counsel used by entities such as Google LLC and Microsoft Corporation and coordinates with regulators including Securities and Exchange Commission when incidents affect publicly traded companies like Equifax and Yahoo!. It engages in policy dialogues involving international agreements such as aspects of Budapest Convention on Cybercrime and contributes to guidance referenced by National Cyber Security Centre (UK) and Australian Cyber Security Centre.

Category:Computer security organizations