CERT to sell security alerts

Computer security organisation CERT today said it will sell its security warnings to multinational corporations - a service it provides to US government agencies for free.

The move comes as the taxpayer-funded CERT Coordination Center, formerly the Computer Emergency Response Team at Carnegie Mellon University, joins the Electronic Industries Alliance (EIA) to launch the Internet Security Alliance (ISA).

The new organisation will distribute up-to-the-minute warnings to international corporations about cyber-threats, offer security advice, and establish a seal program to certify the security of companies' computer networks. Members, paying $2,500 to $70,000 annually depending on their revenue, will receive warnings roughly 45 days before the information is available to the public.

TRW, Nasdaq, Mellon Bank and VeriSign have signed up as members and more than 30 corporations have expressed interest in the service. "There are opportunities here to build on 13 years of experience in this area," CERT spokesman Bill Pollack said.

Pollack also said they had been limited by the fact that the large majority of funding comes from the government. The CERT currently receives about $3.5m from the government, most of which comes from the Defence Department.

Dave McCurdy, president of EIA, said the difference is the ISA is open to businesses regardless of sector. "Our mission is to increase the awareness within corporate leadership of the risk and help them provide the tools to manage those risks."

McCurdy also said the ISA will focus on higher-level issues that managers should be concerned about. "It will be looking more at issues like policy and standards."

As part of the new agreement, CERT will continue to provide the early warnings to the Defence Department and the General Services Administration, and will also offer them to alliance members.