CERTs, CSIRTs, and ISACs: 2025 and beyond

Are you confused about what CERTs, CSIRTs, and ISACs actually do? Fear not, you are not alone. These organisations have longstanding origins, but their mission and activities go often unnoticed. The original Computer Emergency Response Team Coordination Centre (CERT/CC), for example, was set up in 1988 at Carnegie Mellon University in Pittsburgh, Pennsylvania, as a response to the Morris Worm incident.

Since then, hundreds of CERTs/CSIRTs have been created. As of today, FIRST, their international network, accounts for 783 affiliated teams globally.

These organisations' value propositions have also transformed dramatically, over the years: today, they deliver services encompassing threat intelligence, vulnerability management, training, etc.

In this presentation, I will offer a unique deep dive into roles and differences between Computer Emergency Response Teams (CERTs), Computer Security Incident Response Teams (CSIRTs), and Information Sharing and Analysis Centres (ISACs). I will cover what they do, their common goals, and some of the challenges they face.

CERTs are usually set up to respond to cybersecurity incidents, such as for entire sectors, communities, or even countries. They focus on proactive activities like vulnerability management, public awareness campaigns, and working to boost overall cybersecurity.

On the other hand, CSIRTs are more about reacting to incidents as they happen, usually for a specific organization. They can handle incident detection, response and recovery, helping the organization 'bounce back' with minimal damage.

ISACs are platforms that help share important cybersecurity information among organizations in a specific industry. Threat intelligence is their 'bread and butter', but also sharing of technical best practices, and incident reporting, to keep everyone informed and ready for new threats.

Even though CERTs, CSIRTs, and ISACs have different focuses, they share common goals. They adopt a collaborative approach, whether within an organization, across sectors, or at national level. Sharing information and resources is key to improving overall cybersecurity. Each team is involved in some part of incident management, from detection and response to recovery and prevention. Their combined efforts help reduce the impact of cyber incidents. Plus, they aim to raise cybersecurity awareness and educate people about cyber-safe behaviours.

In my presentation, I will also offer first-hand insights into the challenges these teams face. Limited resources, unclear mandates and the 'eternal' information sharing dilemma can make it hard for these organisations to be effective. The ever-growing amount of data and threat intelligence can be overwhelming, and processing it to turn it into actionable insights can be a daunting challenge. As the cyber landscape constantly develops, these teams truly need to 'transform to evolve'. When they don't, they are left behind.

Building on my experience leading a CERT, I will share strategies that address such challenges. Strengthening partnerships, with internal and external stakeholders, can improve information sharing and response efforts. Investing in training and modern tooling can help stay ahead of the curve. Following industry best practices can boost the overall security and resilience of organizations and sectors. Thinking outside the box, to explore how to redesign modern threat intelligence, can do the rest.