A Technical History of the SEI

The CERT/CC helps guard against devastating consequences from incidents by sharing its expertise
with government and other incident handlers and their managers, including US-CERT. The
CERT/CC protects the U.S. information infrastructure by providing technical assistance in repairing
compromised systems and limiting the damage caused by high-impact attacks. Access to composite
data enables the U.S. Department of Defense (DoD) and federal agencies to have a comprehensive
view of attack methods, vulnerabilities, and the impact of attacks.
Evolution of the CERT Division
In the years following CERT/CC’s establishment, the DoD and federal agencies became highly dependent
on the internet, as did businesses, including critical infrastructure providers. Moreover, they
moved away from proprietary software to adopt common information technologies. To better manage
these changes, the CERT/CC began addressing a wider range of security issues, and the larger
CERT program was formed, later becoming a division. Through the CERT Division, the SEI develops
and promotes the use of appropriate technology and systems management practices to resist attacks
on networked systems, to limit damage, and to ensure continuity of critical services.
Range of Issues
Establishment of the CERT/CC was the SEI’s introduction to a broad range of software and network
security issues.
The first issue, in accord with the CERT charter, was incident response (IR). From the beginning
it was clear that the need for skilled incident responders and response organizations would grow.
In addition to serving as a key response organization, the CERT/CC took on the task of developing
the mentoring and training programs, training delivery platforms, and cyber exercise platforms
that would scale to meet the growing workforce development need. After defining best
practices and sharing them with the IR community, the CERT/CC worked at the organizational
level then moved to the national level and its special technical IR needs; these activities included
helping to establish and providing ongoing support to US-CERT. Recognizing the need for a network
of incident responders, the CERT/CC was one of the founding members of the Forum of Incident
Response and Security Teams (FIRST). Later, GFIRST was formed to meet the particular
needs of government CSIRTs (computer security incident response teams). In effect, the SEI not
only spawned this international collection of cooperating organizations, it has also been a leader
in coordinating technical support to evolving incidents throughout the world.
Perpetrators of incidents take advantage of vulnerabilities in software products, so another early
issue was vulnerability analysis, also called for in the CERT charter. This work began with collecting
and categorizing vulnerability reports and establishing working relationships with more
than 600 vendors to mitigate security problems responsibly. The CERT/CC then established an
initiative to develop vulnerability discovery tools and analysis techniques, then provide them to
vendors, leading to fewer vulnerabilities in released software as the vendors begin using them in
their software development process. As a result, DoD and others’ acquisition teams are assured of
more secure software products out of the box and increased resistance to attacks.
Collecting and analyzing malicious code was a logical next step as vulnerability analysts and incident
responders saw “malcode” and “malware” toolkits exploiting vulnerabilities. The CERT/CC
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 163
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.