1. Computer Emergency Response Teams
CERTs
Andy Bone
JANET-CERT Manager

2. What’s in a name INCIDENT RESPONSE
CERTS come in many shapes and sizes, they can have many names:
Some of the more common are:
CSIRT - Computer Security Incident Response Team
SIRT - Security Incident Response Team
IRT - Incident Response teams
CERT is a registered trademark to CERT CC situated at Carnegie Melon University, Pittsburgh. The original CERT created by the US Government in 1988 after a major internet worm attack.
CERTS come in many shapes and sizes use many names:
Some of the more common are
CSIRT - Computer Security Incident Response Team
SIRT - Security Incident Response Team
IRT - Incident Response teams
CERT is a registered trademark to CERT CC situated at Carnegie Melon University, Pittsburgh
But all said and done there is one service that must be undertaken if a team is to fit into any of these categories, and that is INCIDENT RESPONSE.
This is process of reacting to computer security incidents as highlighted by Andrew, these can be generated either by our constituents within the JANET network or externally by foreign input when an incident is generated from JANET.
INCIDENT RESPONSE

3. Types of CERT Internal CERTs - Janet CERT
provide services for their parent organisation.
Co-ordination Centers – CERT CC
coordinates across other CERT’s tend to work on a bigger scale such as country, world stage.
Analysis Centers
focus on trends to provide early warning of attacks.
Vendor Teams
track and provide early warnings for vulnerabilities, they may also perform incident handling within their organisation.
Incident Handling Providers
Independent providing services for profit
There are several different kinds of CERTs, all offering differing services to differing constituents all with there own set of services and particular problems:
Internal CERTs – such as Janet CERT – provide services for their parent organisation.
Co-ordination Centers – such as CERT CC – coordinates across other CERT’s tend to work on a bigger scale such as country, world stage.
Analysis Centers – focus on trends to hopefully provide early warnings of attacks.
Vendor Teams – track and provide early warnings for vulnerabilities, they may also perform incident handling within their organisation.
Incident Handling Providers – Independent providing services for profit

4. Why a CERT
This graph illustrates the growth in enquires to JANET-CERT. These vary from simple scans or probes to a full blown crack’s, with root permission, backdoor Trojans and with rootkits installed. Networks are growing in complexity. Dependency on them is increasing as we see growth in all variants of the e-society. LANs their derivatives and the internet are all targets to computer misusers. CERT’s can help ……….
1997
1998
1999
2000
2001
2002

5. What can a CERT Offer
Co-ordination of world wide as well as local incidents
It is know and is trusted (vital) by its constituency
Current specialist knowledge and resources
Speedy response (in line with SLA)
Triage of Incidents
Protects its constituents, their reputation and the network
Central point to gather and disseminate information
Has access to internal/external sources and contacts
Can tailor and distribute relevant information to its own constituency

6. JANET-CERT Service Level Agreement through the JISC Response
Receive and co-ordinate incident reports until completion.
Offer advice to our constituents on corrective actions.
Liaison with both internal/external sites/agencies including other CERTS and law enforcement to resolve differences.
Protect the network
Authorised to disconnect or block sites or equipment that pose a threat
Mention the libraries incident

7. JANET-CERT Information
We provide two mailing lists providing information (CERT Contacts)
UK-Security-Announce (Read only external to CERT)
CERT advisories of new threats/solutions or announcements
UK-Security (Cert Contacts and related recommended constituents)
Security related discussion and the information provided above.
Technical, policy and minor legal Support.
Web site (
Papers, reports, articles, guides and notes.
In Paper and digital form at

8. JANET-CERT Awareness Liaison Training courses Conferences & Workshops
Presentations
Liaison
Other CERTS (UK-CERT, TF-CSIRT and FIRST)
Law enforcement and the security services.
External network operators and ISPs
Anyone else that asks to share mutual information.
UNIRAS
TERENA
Mention the eCSIRT project

9. JANET-CERT Resources Staffing Manned Communications
Currently 8 personnel
Manned
From 0800 – 1800 Mon-Fri
Oncall 1800 – 2359 weeknights and 0900 – 1700 weekends excluding UK bank holidays, Xmas day, boxing day and Easter Sunday.
Communications
Telephone: +44 (0)
Fax: +44 (0)

10. Questions