A Technical History of the SEI

Teams (FIRST), which was formed in 1989 and now boasts 289 members worldwide (as of January
2013). 29
In the early years, the CERT/CC staff responded to every incident report and worked closely with
individuals reporting incidents. This activity enabled the staff to understand the practices involved
in incident response and determine how to make them repeatable. Upon noticing that many people
made the same mistakes, the center began writing “tech tips” and checklists (an early tech tip was
a UNIX security checklist). By the mid-1990s, the CERT/CC had accumulated enough knowledge
and experience to codify processes and teach others how to do incident response, resulting in the
first training courses and a handbook for CSIRTs [West-
Brown 2003]. 30 The CERT/CC also assisted in the establishment
of response teams; for example, CERT experts
helped the Army with structure, organizational listing,
and training for ACERT, the Army’s incident
response team. After working at the organization level,
the CERT/CC moved to the national level and the nation’s
special technical needs. The center played a significant
role in the creation and continued evolution of
US-CERT, the national CSIRT for the United States,
and Q-CERT, the national CSIRT of Qatar. As industry
capacity grew, the CERT/CC focused more on codifying
best practices and growing capacity.
The View from Others
Since CERT was formed it has
been a great help to me and my
several employers since that time.
I wish to thank you for your great
work!
– a physicist working in a
government institute of
science
Thanks to all of you – you’re doing
a great service to the information
security community. Keep up the
good work!
– an information security
officer
These online docs were very useful.
In fact the checklist was how
we found the network sniffer….
– a user of the Intruder
Detection Checklist
CERT/CC staff now helps loosely coordinate national
CSIRTS, supporting central points such as Information
Sharing and Analysis Centers (ISACs), and providing
operational coordination for critical infrastructure/key
resource (CIKR) led by the DHS and DoD. The
CERT/CC holds an annual technical meeting that helps
it effectively share knowledge and tools. Its location at
the SEI and Carnegie Mellon enables it to serve as a
neutral, trusted, third party to coordinate responses to
high-impact incidents across geographic, national, political,
and economic boundaries. The CERT/CC is concentrating
on threats that affect national and economic security,
with a focus on government and critical infrastructure and on threats from the most serious
adversaries, especially threats that do not yet have a commercial solution. The center seeks ways
to identify threats and remediate them, concentrating on the technological cutting edge.
29 Information and a list of members are available at http://www.first.org.
30 Additional materials for CSIRTS are at http://www.cert.org/incident-management/csirt-development/index.cfm.
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 167
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.