United States Computer Emergency Readiness Team

The United States Computer Emergency Readiness Team (US-CERT) is an organization within the Department of Homeland Security’s (DHS) Cyber Security and Infrastructure Security Agency (CISA). Specifically, US-CERT is a branch of the Office of Cybersecurity and Communications' (CS&C) National Cybersecurity and Communications Integration Center (NCCIC).[2]

Not to be confused with Computer emergency response team.
United States Computer Emergency Readiness Team
Logo of the US-CERT
Agency overview
FormedSeptember 2003 (2003-09)
Preceding
  • FedCIRC
HeadquartersDHS Nebraska Avenue Complex, Washington, D.C.
Annual budget$93 million (2013)[1]
Parent agencyCybersecurity and Infrastructure Security Agency
WebsiteUS-CERT.gov

US-CERT is responsible for analyzing and reducing cyber threats, vulnerabilities, disseminating cyber threat warning information, and coordinating incident response activities.[3]

The division brings advanced network and digital media analysis expertise to bear on malicious activity targeting the networks within the United States and abroad.

Background

Amit Yoran (Tenable, CEO), DHS's first Director of the National Cyber Security Division created the United States Computer Readiness Team (US-CERT) in September 2003 to protect the Internet infrastructure of the United States by coordinating defense against and responding to cyber-attacks. The first US-CERT Director was Jerry Dixon (CrowdStrike, CISO); with the team initially staffed with cybersecurity experts that included Mike Witt (NASA, CISO), Brent Wrisley (Punch Cyber, CEO), Mike Geide (Punch Cyber, CTO), Jay Brown (USG, Senior Exec Cyber Operations), Lee Rock (Microsoft, SSIRP Crisis Lead), Mark Henderson (IRS, Online Cyber Fraud), Josh Goldfarb (Security Consultant), Mike Jacobs (Treasury, Director/Chief of Operations), Rafael Nunez (DHS/CISA), Ron Dow (General Dynamics, Senior Program Mgr), Sean McAllister (Network Defense Protection, Founder), Kevin Winter (Deloitte CISO-Americas), Todd Helfrich (Attivo, VP), Monica Maher (Goldman Sachs, VP Cyber Threat Intelligence), and Reggie McKinney (VA).

US-CERT is the 24-hour operational arm of the NCCIC which accepts, triages, and collaboratively responds to incidents, provides technical assistance to information system operators, and disseminates timely notifications regarding current and potential security threats, exploits, and vulnerabilities to the public via its National Cyber Awareness System (NCAS).[4]

US-CERT operates side-by-side with the Industrial Control Systems Computer Emergency Response Team (ICS-CERT) which deals with security related to industrial control systems. Both entities operate together within NCCIC to provide a single source of support to critical infrastructure stakeholders.[5]

Capabilities

There are five operational aspects which enable US-CERT to meet its objectives of improving the nation’s cybersecurity posture, coordinate cyber information sharing, and proactively manage cyber risks while protecting the constitutional rights of Americans.[6]

Threat Analysis and information sharing

This feature is involved with reviewing, researching, vetting and documenting all Computer Network Defense (CND) attributes which are available to US-CERT, both classified and unclassified.

It helps promote improved mitigation resources of federal departments and agencies across the Einstein network by requesting deployment of countermeasures in response to credible cyber threats.

This feature conducts technical analysis on data provided from partners, constituents, and monitoring systems to understand the nature of attacks, threats, and vulnerabilities, as well as develop tips, indicators, warnings, and actionable information to further US-CERT’s CND mission.

Digital analytics

This feature conducts digital forensic examinations and malware artifact analysis (reverse engineering) to determine attack vectors and mitigation techniques, identifies possible threats based on analysis of malicious code and digital media, and provides indicators to mitigate and prevent future intrusions.

Operations

This feature informs the CND community on potential threats which allows for the hardening of cyber defenses, as well as, develops near real-time/rapid response community products (e.g., reports, white papers).

When a critical event occurs, or has been detected, Operations will create a tailored product describing the event and the recommended course of action or mitigation techniques, if applicable, to ensure constituents are made aware and can protect their organization appropriately.

Communications

This feature supports NCCIC information sharing, development, and web presence. It is responsible for establishing and maintaining assured communications, developing and disseminating information, products, and supporting the development and maintenance of collaboration tools.

International

This feature partners with foreign governments and entities to enhance the global cybersecurity defense posture. It supports bilateral engagements, such as CERT-to-CERT information sharing/trust building activities, improvements related to global collaboration, and agreements on data sharing standards.

Criticism

A January 2015 report by Senator Tom Coburn, ranking member of the Committee on Homeland Security and Governmental Affairs, expressed concern that "[US-CERT] does not always provide information nearly as quickly as alternative private sector threat analysis companies".[7]

See also

References
  1. DHS (2013). FY 2013 Budget in Brief (PDF) (Report).
  2. "About the National Cybersecurity and Communications Integration Center". Retrieved September 4, 2013.
  3. "US-CERT Infosheet Version 2" (PDF). Retrieved September 4, 2013.
  4. "US-CERT About Us". Retrieved September 4, 2013.
  5. "More Information about the Industrial Control Systems Cyber Emergency Response Team". Archived from the original on October 6, 2013. Retrieved September 4, 2013.
  6. "US-CERT Home Page". Retrieved September 4, 2013.
  7. Coburn, Tom. (January 2015). "A Review of the Department of Homeland Security's Missions and Performance". hsgac.senate.gov. Retrieved December 20, 2015.

 This article incorporates public domain material from websites or documents of the United States Department of Homeland Security.

This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.