How CERT PL Improves The Security Of The Polish Internet

The talk describes how Poland's national CERT scans the public internet to prevent incidents rather than only responding to them. After a university accidentally exposed a Git folder containing API keys, the team built Artemis, a system that takes a list of domains, enumerates subdomains, runs a couple dozen modules and produces ready-to-send reports for each organisation.

The checks range from domain expiry, DNS zone transfers and dangling hosting accounts to email spoofing protections, TLS and HTTP redirects, exposed services, CMS and plugin versions, and common web flaws such as SQL injection and cross-site scripting. Other modules flag JavaScript loaded from expired domains, weak passwords, directory listings, exposed repositories, login panels and leftover configuration backups. Target lists come from government data portals, certificate transparency logs, scraped public registers and voluntary submissions. Results are filtered so that only interesting findings reach the export, which produces a package of emails per organisation, written in Polish, for almost automated delivery.

The takeaways are practical. Broad coverage mattered most, so the speaker argued against designs that need per-organisation agreements or manual steps, since those would limit scanning to a small subset. Scanners often get blocked by firewalls and CDNs, so the team publishes its scanning addresses and asks administrators to allowlist them, and it applies rate limits. Finding accurate contacts proved harder than building domain lists. The project grew iteratively, starting with one check on one entity type, and the speaker encouraged others to start small, translate the reports and send a first batch of findings.