Introduction to FIRST
Derrick Scholl
FIRST Steering Committee
ChairMarch 26, 2008

FIRST Introduction March 2008

What is FIRST?
• Forum of Incident Response and Security
Teams• Formed from early “CERT System” work at
CMU’s CERT/CC started in 1989
• As we look at 20 years, much has changed– “Hacking” wasn’t largely profit oriented– WWW didn’t exist– Phishing didn’t exist• But what is important has not
FIRST Introduction March 2008

FIRST Vision
FIRST is a premier organization andrecognized global leader in incident
response. Membership in FIRSTenables incident response teams tomore effectively respond to security
incidents by providing access to bestpractices, tools, and trusted
communication with member teams.

FIRST Introduction March 2008

FIRST Mission
FIRST is an international confederation of trusted computer incident
response teams who cooperatively handle computer security
incidents and promote incident prevention programs.
••
•
•
•

FIRST members develop and share technical information, tools,
methodologies, processes and best practices
FIRST encourages and promotes the development of quality security
products, policies & services
FIRST develops and promulgates best computer security practices
FIRST promotes the creation and expansion of Incident Response
teams and membership from organizations from around the world
FIRST members use their combined knowledge, skills and experienceto promote a safer and more secure global electronic environment.

FIRST Introduction March 2008

FIRST Steering Committee• Derrick Scholl(Chairman)• Chris Gibson (CFO)• Pete Allor• “Paco” Coll
• Yurie Ito

FIRST Introduction March 2008

• Scott McIntyre• Tom Mullen• Lilliana Solha• Ken van Wyk• Arnold Yoon

Membership Summary• FIRST currently has 191 members fromaround the world– All continents except Antarctica– Growing steadily

FIRST Introduction March 2008

Events

FIRST Introduction March 2008

2008 Events

FIRST Introduction March 2008

FIRST Meetings• Annual Conferences– ~300 – 400 attendees– Late June
– Open Registration• Technical Colloquia– May be large or small– Regional, National or International– Presentations and Hands On Training

FIRST Introduction March 2008

Upcoming Events• April 7 – 11 Steering Committee
Meeting, Kyoto• June 22-27, 2008 Annual Conference Vancouver, British Columbia, Canada• Sep – Nov. TCs in North and SouthAmerica• June 2009 – Annual Conference –Kyoto, JapanFIRST Introduction March 2008

• Registration now open
• Early registration fee before 25 April• Do not have to be a FIRST member toattend

FIRST Introduction March 2008

SIGs

FIRST Introduction March 2008

FIRST SIGs
Special Interest Groups (SIGs):•••••••Abuse Handling (AH)
Artifact Analysis (AA)Common Vulnerability Scoring System (CVSS)Internet Infrastructure Vendors (Vendor SIG)
Law Enforcement/CSIRT Cooperation (LECC)
Network Monitoring (NM)CSIRT Metrics (Metrics)• SIG Board Members: Jason Rafail, Cristine Hoepers, Carol
Overes, Andrew Cormack, Scott McIntyre

FIRST Introduction March 2008

Vendor SIG• Vendors working together on security• Current participants:
AlcatelApple
Aruba Networks
Axillance
BeewareCisco Systems
EricssonForce10 Networks
Hitachi
HPIBMIntel

FIRST Introduction March 2008

Juniper
Microsoft
MindjetMotorola
NECNetasq
Nokia
NortelNTT
OracleRedHatRicoh USA
SAP
SGI
Skype
Sun Microsystems

CEP

FIRST Introduction March 2008

Corporate Executive Programme(CEP)• www.globalcep.com• FIRST provided initial seed money of $50,000 USD(~July 2005)• Since then, the CEP has been self-funding• January 2007 – Webex presentation (open to FIRSTmembers)• January 2007 – Recruiting event in London• May 2007 – Annual meeting, Gleneagles, Scotland• November 2007 – Regional meeting, Boston, USA• January 2008 – Regional meeting, London

FIRST Introduction March 2008

Liaison Efforts

FIRST Introduction March 2008

FIRST reaching out
Presentations at the following conferences:• Second Training Conference of the G8, Rome Italy• G8 Hi-Tech Crime Conference, Moscow, Russia• 1st meeting of the Internet Governance Forum (IGF)[WSIS], Athens, Greece• APWG Fall General Meeting, Orlando, Florida, USA• APWG eCrime Researchers Summit, Orlando,Florida, USA• GOVCERT-NL

FIRST Introduction March 2008

What can I do?
• Join FIRST!
• Attend the Annual Conference• Join a SIG

FIRST Introduction March 2008

FIRST Contact• Steering Committee first-sc@first.org• Membership Committeefirst-mc@first.org
http://www.FIRST.org

FIRST Introduction March 2008