In 1988, one of the first pieces of computer malware – named the Morris worm after its developer – incapacitated a large share of the internet, which at the time was still a modest system comprising about 60,000 computers. This development gave birth to the idea of responding to future online security incidents with Computer Emergency Response Teams (CERTs). These teams of computer experts would be deployed whenever someone caused trouble on the internet and the resulting damage needed to be contained as quickly as possible. The launch of the first-ever ransomware attack – the AIDS Trojan – just one year later further confirmed the need for CERTs.
But the teams of IT security experts soon realised that there was often a limit to what they could do on their own. The CERTs had to network with one another so they could coordinate countermeasures to attacks that crossed national borders. And another factor was also key in this exchange: each team of specialists needed to learn about new security incidents from other groups as quickly as possible so it could efficiently protect its own infrastructure. The global Forum of Incident Response and Security Teams (FIRST) was established in 1990 for this very purpose. Its goal was to enable and encourage exchange between CERTs around the world through networking, communication, building trust and cooperation.
Now, over three decades later, the threat situation has fundamentally changed. The damage caused by cybercrime is growing every year, with global damage estimated at a trillion dollars for 2020 alone. What might be a lucrative business field for attackers is a growing challenge for IT security experts, which is why the issue of trusted communities has become all the more important. The reasons are the same as they were 30 years ago: CERTs need to learn from one another quickly and work together efficiently whenever an incident occurs.
Here are a few examples of trusted communities:
- Sector-specific CERTs: SWITCH operates sector-specific CERTs with trusted communities for Swiss universities, banks, industry and logistics, as well as the energy sector. The parties involved have known one another for many years and openly exchange detailed information about the latest security incidents in the sector in regular teleconferences and meetings. If dialogue is to remain open, it is vital that the group of individuals remains manageable and that everyone knows one another, that they strictly adhere to the agreed rules, and that they contribute.
- Security researchers: Security researchers and malware analysts are dealing with far more than just the Morris worm and the AIDS Trojan these days. Modern malware and the infrastructure behind it are far more complex. No individual working alone could ever capture all the active families of malware. The only way for today’s experts to succeed is to work closely together on a global scale in confidential, closed ‘lists’. This requires them to maintain an excellent reputation and an active presence over the years. In a group like this, spying on colleagues or failure to abide by the rules would have fatal consequences.
- CERT forums: CERTs often organise themselves into geographical and sector-specific forums. Here, too, the focus is on exchanging information about – and cooperating during – acute security incidents. During FIRST conferences, CERTs with the same sector-specific problems arrange themselves into smaller groups, facilitating closer exchange than a larger forum generally allows. Clear rules and active involvement are vital here too.
As different as trusted communities are, the basic rules for success always remain the same: participants need to make themselves personally known and get involved in the group. And information must only be used under the agreed conditions. What’s more, many of these communities aren’t open to the public, and admission is often by invitation only following a security check. And just like anything else in life, trust is something that takes time to build up, but it can be destroyed in an instant.
A trusted community with eight to ten participants naturally operates differently than one with over 500 parties. I asked Dr Serge Droz, Chair of FIRST and Senior Security Engineer at Proton Technologies, what role cooperation plays in cybersecurity, both on a national and an international level:
