CERT to sell security threat information

From...

By Sam Costello

(IDG) -- The CERT Coordination Center (CERT/CC), a government-funded Internet security group, said Thursday that it would begin offering to private sector companies advance notice security alerts that it had previously only shared with the government.

CERT/CC, formerly the Computer Emergency Response Team, is a federally funded research and development center based at Pittsburgh's Carnegie Mellon University that studies Internet security threats and receives approximately $3.5 million a year from the government.

MESSAGE BOARD Security on the Net   IDG.net INFOCENTER IDG.net's main page Free daily newsletters Instant help from the Dummies Network Computerworld Communities Features Cool gifts for cool nerds! Your complete guide to broadband DSL bloodbath continues Visit an IDG site Choose a site: IDG.net CIO Computerworld Darwin Dummies.com GamePro.com The Industry Standard ITWorld.com InfoWorld.com JavaWorld LinuxWorld Macworld Online Network World Fusion PC World Publish.com UnixInsider IDG.net search

CERT/CC had previously supplied its early warning information to only the U.S. Department of Defense and the General Services Administration, but under the new plan will offer those alerts, usually 45 days before they are released to the general public, to companies that are members of the Internet Security Alliance, of which CERT/CC is a member, a CERT/CC spokesman said. CERT/CC had provided its early warnings only to the government because it is a government-funded organization, and to avoid releasing inflammatory or inaccurate information, a spokesman said.

CERT/CC joined the Internet Security Alliance because the organization had "been looking for a vehicle to allow us to work more closely with the private sector" for some time, as both public and private sector companies face the same threats, said Rich Pethia, director of CERT/CC. The alliance is open to any company and is hoping to get "good cross-sector representation" from all types of companies and from many countries, Pethia said.

Internet Security Alliance members will pay membership dues based on the company's size, ranging from $2,500 to $70,000. Companies contributing at the highest level will receive seats on the alliance's executive board, Pethia said. Other members will receive benefits such as data analysis and training and education in addition to security bulletins, he said. Alerts will still be made generally available, as they had been previously, after the 45-day period has passed.

The Internet Security Alliance was formed in partnership with the Electronic Industries Alliance, an umbrella trade group of electronics groups which boasts a membership of 2,100 companies. The Internet Security Alliance has a dozen members already, including the NASDAQ Stock Market, VeriSign and Mellon Financial.

Guninski finds another hole in MS Exchange security
March 29, 2001
Symantec launches new version of security suite
March 21, 2001
Hacker steals huge credit card database
December 13, 2000
CERT steps up disclosure of security holes
October 12, 2000

Location services: The eye is on you
(PCWorld.com)
Bob Toxen's Linux security tips
(Unix Insider)
Insider monitoring seen as next wave in IT security
(Computerworld)
Is it secure, or is it an illusion?
(Network World Fusion)
Secure the home office sensibly and easily
(InfoWorld.com)
12 keys to keeping your company safe
(CIO)
Another flaw exposed in TCP
(InfoWorld.com)

CERT/CC
The Electronic Industries
The Internet Security Alliance
See related sites about Science and Technology

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.