CERT-SE – The national CSIRT of Sweden

CERT-SE is Sweden’s national CSIRT (Computer Security Incident Response Team) supporting Swedish society in managing and preventing IT security incidents. Our constituency includes organisations in both private and public sector prioritising essential services and critical infrastructure. CERT-SE is located at the Swedish Civil Contingencies Agency (MSB).

Our mission includes:

• reacting rapidly when IT security incidents occur by spreading information and supporting affected organisations in resolving or mitigating negative effects
• coordinating efforts in managing large-scale IT security incidents
• cooperating with the governmental agencies included in the Swedish National Cyber Security Centre (NCSC-SE)
• acting as a contact point for corresponding functions in other countries including developing cooperation and information exchange.

For more information about CERT-SE, please see below.

To reach us, email cert@cert.se or call +46 10 240 40 40.

Knowledge and ability

CERT-SE contributes to increased knowledge and ability within the area of cyber security through:

• monitoring the cyber security space and providing information, guidance and best practice,
• national and international cooperation,
• sharing external monitoring with focus on news on IT security, cyber security and information security,
• planning and holding cooperation exercises with national and international stakeholders,
• lectures and training.

Managing incidents and vulnerabilities

CERT-SE supports organisations in managing IT security incidents and cyber attacks through:

• providing support to affected organisations in mitigating negative effects and restoring function,
• coordinating efforts among affected organisations,
• spreading warnings of critical vulnerabilities or risks of cyber attacks.

Situational awareness

CERT-SE contributes to improved situational awareness on cyber security in society through:

• providing CERT-SE situational awareness,
• contributing to national situational awareness within the Swedish National Cyber Security Centre (NCSC-SE).

CERT-SE encourages all Swedish organisations to share information on anomalies and incidents in their IT environments. By doing so, CERT-SE can provide support in managing the incident and warn other orgnisations.

Collaboration

CERT-SE participates in several national and international collaboration forums for information sharing. National forums are focused on information sharing for sector-specific actors (e.g. telecom, IT operations, SCADA and healthcare) as well as for government authorities. We regularly participate in various forums, including:

• Swedish National Cyber Security Centre (NCSC-SE)
• Forum of Incident Response and Security Teams (FIRST)
• International Watch and Warning Network (IWWN)
• TF-CSIRT/Trusted Introducer
• CSIRTs Network
• The European cyber crisis liaison organisation network (CyCLONe)
• The Swedish CERT-forum
• European Government CERTs group (EGC)

RFC 2350

Expectations for Computer Security Incident Response at CERT-SE