Threats, malware, and attack techniques
Computer Emergency Response Team (CERT)
A computer emergency response team (CERT), also called a CSIRT, is a group responsible for receiving reports of security incidents, coordinating the response, and publishing warnings and guidance for the community it serves.
Types of team
- National CERTs serve a country, coordinating across sectors and with other national teams.
- Sector and coordination CERTs serve an industry, a research network or a region.
- Internal CSIRTs serve one organisation and handle its incidents end to end.
- Vendor and product teams handle vulnerabilities and incidents in what they make.
What they do
The FIRST CSIRT Services Framework groups the work into managing incidents, managing vulnerabilities, monitoring for and detecting events, analysing situations, and transferring knowledge through advisories and training. Not every team offers every service; the framework is a menu, not a mandate.
Why they matter for brand abuse
National CERTs are often the fastest route to a provider in their country, and many accept phishing reports about domains and hosts in their jurisdiction. When a phishing site targeting a brand is hosted somewhere the brand has no relationship, the national CERT for that country is a useful escalation, alongside the registrar and host.
Related terms
Sources
- FIRST CSIRT Services Framework 2.1
- FIRST: Forum of Incident Response and Security Teams
- NIST SP 800-61 Rev. 3: incident response recommendations
External guidance is general. Adapt it to your legal, regulatory and operational requirements.