Our Research
Cybersecurity Center Development
Cybersecurity center development aims to increase the overall U.S. cybersecurity posture by developing, operationalizing, and improving government and industry organizations’ incident management capabilities so they can protect themselves from attacks and limit the damage and scope of attacks.
Cyber attacks pose significant risks to all organizations throughout the world, and when computer security incidents occur, organizations must respond quickly and effectively. Since organizations cannot completely prevent computer security incidents, they must mitigate the risks these attacks pose and be prepared to act when they do occur. It is critical that an organization responds to attacks quickly and effectively by recognizing, analyzing, and responding to incidents, thereby limiting damage and reducing recovery costs.
Critical to these incident response efforts are cybersecurity centers, which are teams of experts who mitigate threats by identifying, protecting, detecting, responding to, and recovering from incidents. These centers may take the form of computer security incident response teams (CSIRTs), security operations centers (SOCs), product security incident response teams (PSIRTs), CSIRTs of national responsibility, or other similar incident management teams. This international capacity building, information sharing, and global cyber workforce development are key efforts in the pursuance of U.S. objectives in cyberspace. The SEI prepares these cybersecurity center teams to effectively assess and manage cybersecurity incidents.
In the broader Internet community, [CSIRTs] form a "global network" from a diverse group of organizations and sectors, such as critical infrastructure, government, industry, and academia.
Angel Luis Hueca Senior Cybersecurity Operations Researcher
Protect Your Organization from Ever-Changing Cyber Attacks
Over the last two decades, the SEI has been significantly involved in developing and maturing incident response capabilities around the globe. SEI experts have produced numerous frameworks and methodologies for the creation, implementation, and development of incident response teams and SOCs.
SEI experts collaborate with the international incident response community, government stakeholders, private sector, academia, and relevant regional and international organizations to promote and advance the state of cybersecurity cooperation, build cybersecurity capacity, and promulgate security operations and incident response best practices.
SEI experts prepare incident response teams and SOCs to effectively assess and manage their organization’s cybersecurity incidents. Our experts also provide support in planning and developing capabilities and skills, and they network with other teams around the globe.
These activities allow the SEI to leverage its unique position and experience in the community to provide teams with targeted technical assistance and connect established peer organizations around the world. As an extension of this capacity building, the SEI develops and provides tailored workshops for managers, project leaders, technical staff, and computer forensic professionals. SEI experts provide practical and tabletop exercises, facilitated discussions, exchanges of best practices, and implementations of cybersecurity roadmaps.
To support national CSIRTs, members of the SEI’s CERT Division founded the Forum of Incident Response and Security Teams (FIRST), the premier organization and recognized global leader in incident response. Membership in FIRST enables incident response organizations to access a sizable network of peer organizations and best practices from all sectors. Through incident response and security operations development initiatives, the SEI works with the United States Government to support the efforts of teams to meet the FIRST criteria and achieve membership. In conjunction with annual FIRST conferences, the SEI hosts the Annual Technical Meeting for CSIRTs with National Responsibility (NatCSIRT).
What We Offer
Join Us for
NATCSIRT Meeting 2023
June 2-3, 2023, Montreal, Canada
Since 2006, the SEI’s CERT Coordination Center has hosted an annual technical meeting specifically for National CSIRTs. This meeting, the Annual Technical Meeting of CSIRTs with National Responsibility, provides an opportunity for such organizations to meet and discuss the unique challenges of their roles. This annual meeting is held in coordination with the Annual FIRST Conference. Drawing technical staff from teams in more than 55 countries, the meeting provides a forum for networking and collaboration among this unique group of organizations.
Latest from the SEI Blog
Our Vision for the Future of the Cyber Security Center Development
As the field of incident response continues to adapt to emerging threats, the SEI has expanded our work to continue supporting the growing field of cybersecurity. Capacity building includes continued mentorship, maturation of services, and guidance on cybersecurity policy and governance. The SEI is exploring new methods and mechanisms for information sharing and sector incident response development, including critical infrastructure sectors. It will also become increasingly important to incorporate cybersecurity and incident response planning into the architecture and development of Smart Cities, as well as considering how Artificial Intelligence (AI) and Machine Learning (ML) will apply to our work in resilience and incident response.
To learn more about this and other topics discussed in the Year in Review, visit resources.sei.cmu.edu and search for “2019 SEI Year in Review Resources.”