View source for United States Computer Emergency Readiness Team

{{Short description|US federal cybersecurity government organization}}{{About|text=For the current federal agency, see [[Cybersecurity and Infrastructure Security Agency]]. For the general term, see [[Computer emergency response team]].}}{{Update|reason=CISA retired US-CERT in February 2023 [https://www.cisa.gov/news-events/alerts/2023/02/24/us-cert-and-ics-cert-transition-cisa 1]|date=December 2023}}
{{Infobox government agency
| name            = United States Computer Emergency Readiness Team
| native_name     = 
| native_name_a   = 
| native_name_r   = 
| type            = 
| seal            = 
| seal_width      = 
| seal_caption    = 
| logo            = US-CERT logo.png
| logo_width      = 
| logo_caption    = Logo of the team
| image           = 
| image_size      = 
| image_caption   = 
| formed          = {{Start date|2003|09}}
| preceding1      = FedCIRC
| preceding2      = <!-- up to |preceding6= -->
| dissolved       = 
| superseding1    = 
| superseding2    = <!-- up to |superseding6= -->
| jurisdiction    = 
| headquarters    = DHS Ballston Facility, 1110 N Glebe Rd, [[Arlington, VA]] 22201
| coordinates     = <!-- {{coord|LATITUDE|LONGITUDE|type:landmark_region:US|display=inline,title}} -->
| motto           = 
| employees       = 
| budget          = $93 million (2013)<ref>{{cite report|url=https://www.dhs.gov/xlibrary/assets/mgmt/dhs-budget-in-brief-fy2013.pdf|date=2013|title=FY 2013 Budget in Brief|author=DHS|access-date=2017-01-02|archive-date=2017-01-18|archive-url=https://web.archive.org/web/20170118155336/https://www.dhs.gov/xlibrary/assets/mgmt/dhs-budget-in-brief-fy2013.pdf|url-status=live}}</ref>
| minister1_name  = 
| minister1_pfo   = 
| minister2_name  = 
| minister2_pfo   = <!-- up to |minister7_name= -->
| deputyminister1_name = 
| deputyminister1_pfo = 
| deputyminister2_name = 
| deputyminister2_pfo = <!-- up to |deputyminister7_name= -->
| chief1_name     = 
| chief1_position = 
| chief2_name     = 
| chief2_position = <!-- up to |chief9_name= -->
| public_protector = 
| deputy          = 
| parent_department = 
| parent_agency   = [[Cybersecurity and Infrastructure Security Agency]]
| child1_agency   = 
| child2_agency   = <!-- up to |child25_agency= -->
| keydocument1    = <!-- up to |keydocument6= -->
| website         = {{URL|https://www.us-cert.gov|US-CERT.gov}}
| map             = 
| map_size        = 
| map_caption     = 
| footnotes       = 
| embed           = 
}}

The '''United States Computer Emergency Readiness Team''' ('''US-CERT''') was a team under the [[Cybersecurity and Infrastructure Security Agency]] of the [[Department of Homeland Security]]. 

On February 24, 2023, the Cybersecurity and Infrastructure Security Agency (CISA) retired US-CERT and ICS-CERT, integrating CISA’s operational content into a new CISA.gov website that better unifies CISA's mission. CISA will continue to be responsible for coordinating cybersecurity programs within the U.S. government to protect against malicious cyber activity, including activity related to industrial control systems. In keeping with this responsibility, CISA will continue responding to incidents, providing technical assistance, and disseminating timely notifications of cyber threats and vulnerabilities.<ref>{{cite web |title=US-CERT and ICS-CERT Transition to CISA {{!}} CISA |url=https://www.cisa.gov/news-events/alerts/2023/02/24/us-cert-and-ics-cert-transition-cisa |website=www.cisa.gov |access-date=14 June 2024 |language=en |date=24 February 2023}}{{source-attribution}}</ref>

US-CERT was a branch of the [[National Cybersecurity and Communications Integration Center]] of the Office of Cybersecurity and Communications.<ref name="About NCCIC">{{cite web |title=About the National Cybersecurity and Communications Integration Center |url=https://www.dhs.gov/about-national-cybersecurity-communications-integration-center |url-status=live |archive-url=https://web.archive.org/web/20130904150945/http://www.dhs.gov/about-national-cybersecurity-communications-integration-center |archive-date=September 4, 2013 |access-date=September 4, 2013}}</ref> US-CERT is responsible for analyzing and reducing cyber threats, vulnerabilities, disseminating cyber threat warning information, and coordinating incident response activities.<ref name="US-CERT Infosheet">{{cite web|title=US-CERT Infosheet Version 2|url=http://www.us-cert.gov/sites/default/files/publications/infosheet_US-CERT_v2.pdf|access-date=September 4, 2013|archive-date=May 12, 2013|archive-url=https://web.archive.org/web/20130512035526/http://www.us-cert.gov/sites/default/files/publications/infosheet_US-CERT_v2.pdf|url-status=live}}</ref>

The division brings advanced network and digital media analysis expertise to bear on malicious activity targeting the networks within the United States and abroad.

==Background==
The concept of a national Computer Emergency Response Team (CERT) for the United States was proposed by Marcus Sachs ([[Auburn University]]) when he was a staff member for the [[U.S. National Security Council]] in 2002 to be a peer organization with other national CERTs such as [[AusCERT]] and CERT-UK, and to be located in the forthcoming [[Department of Homeland Security]] (DHS). At the time the United States did not have a national CERT. [[Amit Yoran]] ([[Tenable, Inc.]], CEO), DHS's first Director of the National Cyber Security Division, launched the United States Computer Emergency Readiness Team (US-CERT) in September 2003 to protect the [[Internet]] infrastructure of the United States by coordinating defense against and responding to [[Cyber attack|cyber-attacks]]. The first Director of the US-CERT was Jerry Dixon ([[CrowdStrike]], CISO); with the team initially staffed with cybersecurity experts that included Mike Witt ([[NASA]], CISO), Brent Wrisley (Punch Cyber, CEO), Mike Geide (Punch Cyber, CTO), Lee Rock ([[Microsoft]], SSIRP Crisis Lead), Chris Sutton ([[Export-Import Bank of the United States]], CISO & CPO), Jay Brown ([[Federal government of the United States|USG]], Senior Exec Cyber Operations), Mark Henderson ([[Internal Revenue Service|IRS]], Online Cyber Fraud), Josh Goldfarb (Security Consultant), Mike Jacobs ([[United States Department of the Treasury|Treasury]], Director/Chief of Operations), Rafael Nunez ([[United States Department of Homeland Security|DHS]]/[[Cybersecurity and Infrastructure Security Agency|CISA]]), Ron Dow ([[General Dynamics]], Senior Program Mgr), Sean McAllister (Network Defense Protection, Founder), Kevin Winter ([[Deloitte]], CISO-Americas), Todd Helfrich (Attivo, VP), Monica Maher ([[Goldman Sachs]], VP Cyber Threat Intelligence), Reggie McKinney ([[United States Department of Veterans Affairs|VA]]) and several other cybersecurity experts. In January 2007, Mike Witt was selected as the US-CERT Director, who was then followed by Mischel Kwon (Mischel Kwon and Associates) in June 2008. When Mischel Kwon departed in 2009, a major reorganization occurred which created the [[National Cybersecurity and Communications Integration Center]] (NCCIC).

US-CERT is the 24-hour operational arm of the NCCIC which accepts, triages, and collaboratively responds to incidents, provides technical assistance to information system operators, and disseminates timely notifications regarding current and potential security threats, [[exploit (computer security)|exploits]], and [[vulnerability (computing)|vulnerabilities]] to the public via its National Cyber Awareness System (NCAS).<ref name="US-CERT About Us">{{cite web|title=US-CERT About Us|url=http://www.us-cert.gov/about-us|access-date=September 4, 2013|archive-date=September 10, 2013|archive-url=https://web.archive.org/web/20130910010402/http://www.us-cert.gov/about-us/|url-status=dead}}</ref>

US-CERT operates side-by-side with the Industrial Control Systems Computer Emergency Response Team (ICS-CERT) which deals with security related to [[industrial control system]]s. Both entities operate together within NCCIC to provide a single source of support to [[critical infrastructure]] stakeholders.<ref name=ICS-CERT>{{cite web|title=More Information about the Industrial Control Systems Cyber Emergency Response Team|url=http://ics-cert.us-cert.gov/More-Information-about-Industrial-Control-Systems-Cyber-Emergency-Response-Team|access-date=September 4, 2013|archive-url=https://web.archive.org/web/20131006094324/http://ics-cert.us-cert.gov/More-Information-about-Industrial-Control-Systems-Cyber-Emergency-Response-Team|archive-date=October 6, 2013|url-status=dead|df=mdy-all}}</ref>

==Capabilities==
There are five operational aspects which enable US-CERT to meet its objectives of improving the nation’s cybersecurity posture, coordinate cyber information sharing, and proactively manage cyber risks while protecting the constitutional rights of Americans.<ref name="US-CERT Home Page">{{cite web|title=US-CERT Home Page|url=http://www.us-cert.gov/|access-date=September 4, 2013|archive-date=November 11, 2008|archive-url=https://web.archive.org/web/20081111045032/http://www.us-cert.gov/|url-status=live}}</ref>

===Threat Analysis and information sharing===
This feature is involved with reviewing, researching, [[vetting]] and documenting all Computer Network Defense (CND) attributes which are available to US-CERT, both [[Classified information|classified]] and unclassified.

It helps promote improved mitigation resources of federal departments and agencies across the [[Einstein (US-CERT program)|Einstein]] network by requesting deployment of countermeasures in response to credible [[Threat (computer)|cyber threats]].

This feature  conducts technical analysis on data provided from partners, constituents, and monitoring systems to understand the nature of attacks, threats, and [[vulnerability (computing)|vulnerabilities]], as well as develop tips, indicators, warnings, and actionable information to further US-CERT’s CND mission.

===Digital analytics===
This feature conducts digital [[Digital forensics|forensic]] examinations and [[malware]] artifact analysis (reverse engineering) to determine attack vectors and mitigation techniques, identifies possible threats based on analysis of malicious code and digital media, and provides indicators to mitigate and prevent future intrusions.

===Operations===
This feature informs the CND community on potential threats which allows for the [[Hardening (computing)|hardening]] of cyber defenses, as well as, develops [[near real-time]]/rapid response community products (e.g., [[reports]], [[white papers]]).

When a critical event occurs, or has been detected, Operations will create a tailored product describing the event and the recommended course of action or mitigation techniques, if applicable, to ensure constituents are made aware and can protect their organization appropriately.

===Communications===
This feature supports NCCIC information sharing, development, and web presence.  It is responsible for establishing and maintaining assured communications, developing and disseminating information, products, and supporting the development and maintenance of [[collaboration tool]]s.

===International===
This feature partners with foreign governments and entities to enhance the global [[cybersecurity]] defense posture.  It supports bilateral engagements, such as CERT-to-CERT information sharing/trust building activities, improvements related to global collaboration, and agreements on data sharing [[International standard|standards]].

== Criticism ==
A January 2015 report by Senator [[Tom Coburn]], ranking member of the [[United States Senate Committee on Homeland Security and Governmental Affairs|Committee on Homeland Security and Governmental Affairs]], expressed concern that "[US-CERT] does not always provide information nearly as quickly as alternative private sector threat analysis companies".<ref>{{Cite web|url = http://www.hsgac.senate.gov/download/?id=B92B8382-DBCE-403C-A08A-727F89C2BC9B|title = A Review of the Department of Homeland Security's Missions and Performance|date = January 2015|access-date = December 20, 2015|website = hsgac.senate.gov|last = Coburn|first = Tom.|archive-date = September 6, 2023|archive-url = https://web.archive.org/web/20230906111609/https://www.hsgac.senate.gov/download/?id=B92B8382-DBCE-403C-A08A-727F89C2BC9B|url-status = live}}</ref>

==See also==
* [[Alert (TA15-337A)]]
* [[CERT Coordination Center]]
* [[Einstein (US-CERT program)]]
* [[National Infrastructure Security Co-ordination Centre]]

==References==
{{Reflist}}

==External links==
* {{Official website}}
* [http://www.us-cert.gov/nccic/ NCCIC National Cybersecurity and Communications Integration Center] {{Webarchive|url=https://web.archive.org/web/20130201074320/http://www.us-cert.gov/nccic/ |date=2013-02-01 }}
* [http://ics-cert.us-cert.gov/ ICS-CERT Industrial Control Systems Computer Emergency Response Team]
* [http://www.first.org/members/teams Forum of Incident Response and Security Teams - Members]
{{Department of Homeland Security}}
{{Authority control}}

[[Category:United States Department of Homeland Security agencies|Computer Emergency Readiness Team]]
[[Category:Computer emergency response teams]]
[[Category:2003 establishments in Virginia]]
[[Category:Government agencies established in 2003]]