Software Engineering Institute

July 8, 2011—Representatives from the SEI’s CERT Program recently hosted the 2011 Annual Meeting of Computer Security Incident Response Teams (CSIRTs) with National Responsibility. The meeting was conducted on June 18 and 19 in Vienna, Austria. Inaugurated by CERT in 2006, the meeting provides a forum to discuss the cybersecurity challenges of nations, economies, and critical infrastructures. This year’s meeting was co-sponsored by Austria’s GovCERT and by the Department of Homeland Security’s United States Computer Emergency Readiness Team (US-CERT).

National CSIRTs serve as the central coordinating organizations within their countries for incident analysis and handling activities. Among other objectives, they seek to serve as a trusted point of contact and support incident reporting and mitigation across various sectors within a nation’s borders.

Jeffrey Carpenter, technical manager of the CERT Coordination Center, noted that national CSIRTs face the challenge of improving their capabilities in an environment of limited resources. “We’re working on how to build effective ways for National CSIRTs to collaborate, share information, and share solutions to common problems,” said Carpenter. Better sharing mechanisms for national CSIRTS can reduce duplication of effort on the same problems, improving the capabilities of national CSIRTS while containing costs. “We’re helping national CSIRTs work together,” said Carpenter, “rather than individually, to solve problems common to all of them.”

Among the items on the agenda, two major themes emerged at this year’s meeting: how to better share technical solutions to common problems and how to anticipate challenges arising from the changing technical landscape. “We’re examining what the situation will be five to ten years into the future,” noted Carpenter. “The community recognizes there are significant changes in technology that will have a considerable impact on national CSIRTs.”

Currently, CERT is working with about 75 functioning national CSIRTs. “We work with all of them to one degree or another. We’ve been at work in this area for more than 15 years,” said Carpenter. “Having worked to help numerous countries establish a national CSIRT, we’re now starting to achieve critical mass.” Many national CSIRTs have followed CERT’s advice in the creation of their national CSIRT and have adopted tools and processes originally developed by CERT. This has allowed CERT to turn its focus to helping these national CSIRTs become more effective. For more information about the work CERT is doing to support CSIRTs with national responsibility, please visit http://www.cert.org/csirts/national/.