My CERT PL - Free Security Tools for Everyone (in Poland)

### Overview In this presentation, Krzysztof Zając from CERT Polska (one of Poland's three national-level CERTs, responsible for private entities and the general public) presents **mojecert.pl** (My CERT PL). The initiative is a free security portal designed to help organizations, small businesses, and individuals assess and strengthen their cybersecurity posture. The platform addresses several recurring challenges faced by national CERTs: cyber incidents stemming from unpatched vulnerabilities or leaked credentials (such as an attack on the Polish Press Agency used to publish fake mobilization news), difficulty communicating available security tools to the public, limited visibility into non-governmental infrastructure, and fragmented or outdated organizational contact information.

### Key Topics - **Target Audience and Motivation**: Providing free scanning and threat notifications to everyone—ranging from personal blog owners to large enterprises—especially entities lacking substantial cybersecurity budgets. - **Domain & Subnet Onboarding**: Users register infrastructure assets. Domain ownership is verified via DNS TXT records or file placement on the web server; subnet verification is handled manually via ISP confirmation or RIPE database records to prevent unauthorized scanning. - **Core Services Offered**: Automated vulnerability scanning, leaked credential notifications, network event monitoring, security advisories, fishing protection verification, and email spoofing diagnostics. - **Ecosystem Collaboration**: Sharing dashboards and threat data with sectoral CERTs (such as the Polish financial sector CERT and health sector CERT) and integrating European NIS2 directive requirements. - **Architecture and Development Philosophy**: Building rapidly using open-source utilities and "boring," dependable technologies rather than complex frameworks.

### Technical Details - **Security Scanning (Artemis)**: Scanning is powered by CERT Polska's open-source tool Artemis, which orchestrates modular scans utilizing established open-source tools like Nuclei and SQLMap. Artemis runs dozens of modules to identify issues ranging from outdated WordPress versions and misconfigured email security (SPF/DMARC) to severe flaws like SQL injection and remote code execution. - **Network Event Aggregation (N6)**: CERT Polska's open-source N6 aggregator ingests data from more than 90 sources (notably Shadowserver) to track malicious activity such as malware command-and-control communication, infected hosts (e.g., SmokeLoader), and scanning activity. Mojecert.pl enriches this telemetry with accessible explanations. - **Credential Leak Monitoring**: Ingests password dumps from public releases, internal threat hunting, commercial providers, and stealer malware logs to alert affected email providers and website administrators. - **Phishing Defense Verification & MailGoose**: Allows administrators to test whether local networks are protected by the CERT Polska warning list, a DNS-level blocklist that blocked 141 million malicious page views in 2025. It also integrates MailGoose, an open-source tool for validating SPF, DKIM, and DMARC configurations. - **Tech Stack & Operations**: Developed with Django, PostgreSQL, and Kubernetes without complex single-page JavaScript frameworks. Scans repeat cyclically (defaulting to every two months), managed by a team that expanded from two to six developers.

### Takeaways - **Rapid, Pragmatic Deployment**: Starting small with a basic beta after five months proved successful; projects do not need polished graphic design or extensive feature sets upfront to deliver immediate value. - **Opt-in Legal Foundation**: By having users register and give explicit consent to be scanned, CERTs, hosting providers, or NGOs do not require prior government mandate or broad statutory scanning authority. - **Demonstrated Impact**: Mojecert.pl has grown to over 20,000 users and 24,000 verified domains, uncovering hundreds of thousands of vulnerabilities. Future planned capabilities include on-boarding additional sectoral CERTs and a privacy-preserving file reputation check to assess malware without leaking sensitive data to public repositories.