Projects

Partner organization/s: State institutions or legal entities of private law

Status: Ongoing

Short description of the project: A unified web portal for electronic services in the public and private sectors, where more than 700 electronic services are hosted. Services are available to portal users on a "one-stop-shop" principle - after registering on the portal and agreeing to the terms of use of the portal. The portal user has the opportunity to electronically request public information from various state agencies, as well as fill out an application to receive various services, use a qualified electronic signature/stamp on it if necessary, send the completed application to the recipient, and receive a response through the portal.

Partner organization(s): -

Status: Completed

Short project description: Attacks on Georgian websites are frequent, during which malicious actors "hack" the website and post harmful information there.

This harmful information can be both viruses and terrorist propaganda.

Similar attacks have also been successfully carried out against Georgian government pages.

The problem with such attacks is often that they are difficult to detect in a timely manner.

A monitoring system was created that regularly visits all important Georgian government and non-governmental

pages and checks for the presence of traces of an attack.

Partner organization(s): Civil Service Bureau

Status: Ongoing

Short description of the project: Through the system, public officials ensure the completion and publication of asset declarations at predetermined intervals. The system is owned by the Civil Service Bureau, which uses it to administer the declaration process and monitor the submitted declarations.

Partner organization/s: -

Status: Completed

Project summary: The Computer Emergency Response Team (CERT.GOV.GE) of the Data Exchange Agency, a legal entity under public law of the Ministry of Justice of Georgia, has implemented the "MISP" platform, which allows us to share incidents involving malicious code with various international organizations. Access to the platform can be granted to representatives of the public and private sectors. Also, with the help of this same platform, the team receives various types of so-called "feeds," which are planned to be integrated into various services. At this stage, nearly 60 feed sources have been added.

Partner organization/s: -

Status: Ongoing/Permanent

Short description of the project: Phishing is one of the simplest attack vectors for an attacker, as humans are still considered the weakest link in an organization. Phishing is often carried out in the form of an email requesting the execution of malicious code or a user password. In case of a successful attack, it can prove devastating for an organization, as it may lead to unauthorized access to the organization's internal network, misappropriation of user files, and much more. To protect against phishing, it is essential to raise the security awareness of the organization's employees, which is facilitated by phishing simulation. A phishing simulator is a simple application that allows us to create and simulate a scenario based on the organization's needs. As mentioned, phishing is mainly encountered via email; therefore, the application allows for sending simulated phishing emails to employees.

Partner organization/s: -

Status: Completed

Short description of the project: A laboratory for malicious code analysis has been developed by the Computer Emergency Response Team (CERT.GOV.GE) of the Data Exchange Agency, a legal entity under public law of the Ministry of Justice of Georgia. Upon request, subjects of critical information systems will have the opportunity to use the mentioned system for the automatic analysis of their files.

Partner organization(s): -

Status: Ongoing/Permanent

Short project description: The awareness-raising program consists of various activities. These include: a fun calendar featuring amusing drawings about important cyberattack vectors; conducting presentations in schools and universities; posting important news on social networks about the vulnerabilities of various systems; and conducting training sessions and introducing current threats to journalists.

Partner organization/s: -

Status: Ongoing/Permanent

Short description of the project: The portal "CheckNet.ge" allows users to: check the history of Georgian websites and find out what kind of security problems were recorded on them at different times; by viewing the history of website records, get information about a specific problem on a website, for example, "Deface", "Phishing" and "Malicious Code"; check their own IP addresses and get information about their infection or inclusion in various blacklists (if any).

The "CheckNet.ge" portal is available to all citizens of Georgia. The use of the portal is free.

Partner organization/s: FIRST, Trusted-Introducer

Status: Ongoing/Permanent

Short description of the project: The Computer Emergency Response Team of the Data Exchange Agency of the Ministry of Justice of Georgia (CERT.GOV.GE) actively cooperates with international organizations. The team is a full member of global CSIRT associations, such as FIRST and Trusted-Introducer. Membership in these associations allows the team to communicate quickly and effectively with CSIRT groups from various countries during the cyber incident response process. It also enables the team to gain experience from best practices that exist in different countries.

Partner organization/s: -

Status: Ongoing/Permanent

Short description of the project: The Computer Emergency Response Team (CERT.GOV.GE) of the LEPL "Digital Governance Agency" of the Ministry of Justice of Georgia has created a cyber incident response management system for critical information system subjects. This system will allow organizations to share incidents with the Computer Emergency Response Team as quickly and effectively as possible and to monitor the incident response process. The mentioned system facilitates the centralization of cyber incidents and the creation of a unified database in the country.

Partner Organization/s: -

Status: Completed

Project Brief Description: Cyberspace, just like any other space, requires appropriate protection. It is especially important to have appropriate response mechanisms and coordinated action during crisis situations. In a crisis situation, the IT and information security-related resources available in the country are scattered, and their consolidation and coordination are complicated, which is associated with critical risks. It is necessary to create a scheme and mechanism for the rapid and effective mobilization of resources; at the same time, it is important that valuable human resources have a convenient environment for communication and joint work. One of the most appropriate solutions to achieve this is the creation of an information security association (union) in Georgia. The proposed name of the association is: "Georgian Cyber Security Association". Within the framework of the project, the following should be carried out: determination of the legal status of the association; planning and preparation of the goals, structure, work specifics, and infrastructure of the association; negotiation with the target audience to participate in the association; creation of a flexible and effective team in which maximum involvement of its members is achieved. Cyber security forum meetings have been held for the fourth year and bring together up to 40 cyber security professionals.

Partner organization/s: -

Status: Ongoing/Permanent

Short description of the project: The Computer Emergency Response Team of the Data Exchange Agency of the Ministry of Justice of Georgia (CERT.GOV.GE) can provide interested organizations with so-called blacklists of IP addresses, which include IP addresses that distribute various types of infections or represent infected command and control centers for computers (Bot, C&C). In case of blocking according to these lists of IP addresses, the number of malicious files coming from the Internet to the organization's computers will be minimized, and already infected computers will no longer be able to connect to the criminal command center. Blacklists are processed in various formats: plain, squid, bindzone, iptables, json, cvs, etc.

Partner organization(s): -

Status: Ongoing/Permanent

Short description of the project: A secure DNS server, which, when used, automatically blocks websites on your network that pose a threat to your computer. This refers to adult, infected, and so-called "phishing" content. The service can be used by all citizens of Georgia and allows for minimizing the risks of the service user becoming infected. This service can be used by both organizations and private individuals. To activate the service, you need to use the DNS addresses of the Computer Emergency Response Team (CERT.GOV.GE) of the LEPL "Digital Governance Agency" of the Ministry of Justice of Georgia.

Partner organization/s: -

Status: Ongoing/Permanent

Short description of the project: Within the framework of the Cyber Class project, a 7-week program has been created for students, which includes laboratory work and presentations. Participation in the Cyber Class is possible for students and school pupils, who are selected through an interview. After completing the Cyber Class, students will become familiar with the following types of laboratory work: malware analysis, log file analysis, network traffic analysis, web application penetration testing, computer forensics, scanning of servers and services, and information security.

Partner organization/s: -

Status: Ongoing/Permanent

Short project description: Since 2014, cyber exercises have been held annually, in which successful organizations from the private and public sectors participate. Cyber exercises represent a competition between red and blue teams in cybersecurity. The goal of the cyber exercises is to promote cybersecurity in organizations critical to the country and to share contacts, which is extremely important in crisis situations. Participants are also given the opportunity to respond to real cyber incidents, which are conducted in an environment created specifically for the cyber exercises.

Partner organization/s: -

Status: Ongoing/Permanent

Short description of the project: Since 2016, for the first time in the region, the Cyber Security Bureau (CERT.GOV.GE) of the Data Exchange Agency of the Ministry of Justice of Georgia held a Cyber Olympiad, in which 50 teams and about 150 participants took part. The participating teams were composed of students and schoolchildren. Laboratory exercises based on real incidents were specially prepared for the Olympiad, and a testing platform was created, on which the exercises and the results of the Cyber Olympiad were posted.

Partner organization(s): -

Status: Completed

Project description: The Computer Emergency Response Team (CERT.GOV.GE) of the Data Exchange Agency of the Ministry of Justice of Georgia has launched HoneyPot systems in test mode within the group's server infrastructure, the purpose of which is to detect and restrict unauthorized access to information systems. The following services are being emulated: ftp, ssh, nameserver, http, msrpc (Microsoft RPC), microsoft-ds, ms-sql-s, mysql, sip and sip-tls. Full integration and automation of the system have been carried out, which allows the information collected by the HoneyPot systems to be automatically forwarded to international partners.

Partner organization/s: -

Status: Completed

Short project description: The Computer Emergency Response Team (CERT.GOV.GE) of the LEPL "Digital Governance Agency" of the Ministry of Justice of Georgia has implemented two types of network sensors, through which network traffic is monitored in several organizations, which allows for the timely detection of various types of ongoing cyberattacks.

Partner organization(s): Arbor Networks, Shadowserver, Team Cymru, CERT-EU, CERT BUND and others

Status: Ongoing/Permanent

Project brief description: The Data Exchange Agency (DEA) of the Ministry of Justice of Georgia, through its Computer Emergency Response Team (CERT.GOV.GE), has created an IP address monitoring portal. Every day, the portal is updated with several tens of thousands of infected IP addresses located within the Georgian cyberspace. Reports are received daily from international partner organizations: Arbor Networks, Shadowserver, Team Cymru, CERT-EU, CERT BUND, and others. More than 30 organizations from both the public and private sectors are involved in the portal. Over the last 4 years, information on 20,000,000 infected IP addresses located in the Georgian cyberspace has been uploaded to the system, of which 220,000 represent unique IP addresses.

Partner organization/s: -

Status: Ongoing/Permanent

Short description of the project: A web application penetration testing service has been successfully established within the Computer Emergency Response Team for the Government of Georgia (CERT.GOV.GE) of the LEPL "Digital Governance Agency" of the Ministry of Justice of Georgia. Penetration testing on web applications is conducted using the "OWASP" methodology and tools recommended by them. The team also has a network scanning service, which includes internal and external network scanning as well as configuration auditing of network devices. The aforementioned service has been implemented in more than 50 organizations.

Partner organization/s: -

Status:Completed

Short description of the project: The Computer Emergency Response Team of the Data Exchange Agency of the Ministry of Justice of Georgia (CERT.GOV.GE) created a three-day basic course for subjects of critical information systems. The course was conducted twice, after which information security managers and specialists of critical information system subjects underwent the training. In total, more than 30 information security specialists from the public sector were trained.

Partner Organization(s): NATO Science for Peace Project

Status: Completed

Project Summary: Within the framework of the NATO Science for Peace project, the Cyber Security Bureau of the Data Exchange Agency of the Ministry of Justice of Georgia (CERT.GOV.GE) created training materials on cyber incident response in the city of Ankara. Based on these materials, training was provided to network and system administrators from 7 different countries: Afghanistan, Moldova, Macedonia, Montenegro, Azerbaijan, Ukraine, and Mongolia. In total, more than 150 information technology specialists completed these trainings.