CERT and NCSC 101

The talk opens with how computer emergency response teams emerged after the 1988 Morris worm and spread into hundreds of teams worldwide. It separates a CERT from a security operations centre: a CERT serves a defined constituency and shares information rather than running an organisation's own defences. The speaker then walks through how a national team triages incoming reports and sends notice-and-takedown requests to hosting providers and network operators.

Case studies form the middle. Traffic data from a 2007 wave of attacks on Estonia let teams ask many countries to clean up compromised machines. A criminal hosting provider that kept receiving fresh address blocks showed why takedowns alone fail. During a 2016 botnet that exploited home routers, automated reports led to a coordinated warning to operators and users. Groups such as FIRST and the EGC provide channels for this work, each with different levels of trust.

The closing section covers the NIS2 directive, which writes national CERT duties into law and separates them from regulators so organisations feel safe reporting. The takeaway is to report incidents early, know who to call, and build relationships before a crisis hits.