A Technical History of the SEI

collects over one million pieces of malicious code each month, entering the malware into its Artifact
Catalog. As incident responders deal with the growing frequency of malcode-based attacks,
they need the ability to analyze malicious coded packages quickly, determine the effects of the
malicious code, and understand how to mitigate those effects. Similarly, law enforcement agents
investigating cybercrimes need the ability to identify the source of malicious code attacks. The
CERT/CC has an ongoing effort to develop analysis techniques, tools, and the training to help
other responders and investigators increase their capability to research and mitigate malicious
code-based attacks. Automated tools significantly decrease analysis time and enable researchers,
analysts, and investigators to be increasingly effective at identifying and understanding malicious
code. As a result of CERT/CC work, federal agencies have recovered from serious cyber attacks
quickly and solved cybercrimes.
The CERT Secure Coding Initiative grew from the conviction that it is not sufficient to merely respond
to security compromises and the vulnerabilities behind them. Rather, vendors need to release
less vulnerable software in the first place. CERT secure coding guidelines and standards help developers
prevent vulnerabilities by addressing them early in product development. Tools for analyzing
the code enable vendors to validate conformance to the standards. The result is more secure out-ofthe-box
software products and protection for DoD, federal agency, and business systems. Secure
coding practices are in use by virtually all defense contractors as well as industry vendors.
DoD needs led to the development of network situational awareness tools, along with analysis
techniques for quantitatively characterizing threats and targeted intruder activity. At the time,
DoD security operations were driven by known issues that were dealt with in real time without
knowledge of the threat behind them. The DoD needed retrospective analysis with historical data
and a baseline of the Non-Secure Internet Protocol Router Network (NIPRnet) as a whole. CERT
toolsets are now in use at large operations centers in the DoD and the Department of Homeland
Security; the tools collect and analyze large volumes of data that enable analysts to understand
broad network activity and take appropriate action. US-CERT has used Einstein 26 to meet statutory
and administrative requirements of DHS to help protect federal computer networks and the
delivery of essential government services. The CERT Division gains far-reaching influence with
open source tools and participation in Internet Engineering Task Force (IETF) working groups.
DoD interest in incidents by insiders—staff, former staff, and contractors—prompted the CERT Division’s
initial work on insider threat. CERT analysts realized just how critically serious insider threat is
when they met with the Olympic Committee on cyber aspects of the Salt Lake City Olympic Games, a
U.S. Secret Service National Special Security Event (NSSE). It formed a CERT insider threat group,
which collected hundreds of case studies of actual incidents and worked with federal law enforcement
profilers to examine both the technical and behavioral aspects. This research has expanded to specific
domains and types of attack, including espionage, enabling the recently established CERT Insider
Threat Center to provide more specific and actionable guidance. Using the center’s results, information
assurance staff and counterintelligence analysts have implemented technical controls for catching insiders.
The DoD and federal civilian agencies are identifying insider threat proactively using SEI techniques
and tools instead turning to forensics after a crime.
26 Einstein is an intrusion detection system that monitors the network gateways of government departments
and agencies in the United States for unauthorized traffic (en.wikipedia.org/wiki/Einstein).
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 164
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.