4th TF-CSIRT Meeting

Programme and Presentations

The 4th TF-CSIRT seminar and meeting took place at Weston Room II & III at the Weston Conference Centre, Manchester on 27-28 September 2001.

Thursday, 27 September 2001

Seminar

09:30-09:45 Welcome. Overview of the programme.
Logistics announcements. Network configuration. Apologies. Introduction of those present.

Seminar Session 1. Current Practice in CSIRTs Organisation, structure, working methods among Governmental CSIRTs

1.1. UNIRAS - Dave Parker.
1.2. CERTA - Michel Dupuy.
1.3. Computer forensics by Ian Pomfret (BT).
1.4. The Work Of The UK NHTCU by Patrick Briggs.
1.5. Discussion.

Seminar Session 2. Invited presentation

2.1.IAAC (Information Assurance Advisory Council) Project in UK as part of EWIS component of DDSI by Michael Knights of Kings College in London.

Seminar Session 3. Demonstration of Incident Handling Systems used by CSIRTs

3.1. Demonstration of Remedy based Incident Handling System.
3.2. Demonstration of Magic TSD based Incident Handling System.

Friday, 28 September 2001

4th TF-CSIRT meeting

1. Welcome and Apologies.
2. Round of Introductions.
3. Minutes of Last Meeting (Ljubljana May 30-June 1 2001) - Status report on actions from last meeting.
4. 'Trusted Introducer' Pilot Service·

    4.1. Status Report - presentation by Don Stikvoort (TBC).
    4.2. Presentation of the new TI Board (new TI Board).
5. Training Workshops for new CSIRTs.
  • Proposal to CEC regarding funding Workshop and Preliminary Workshop Programme - Andrew Cormack
  • Discussion
6. Relations with CEC and funding possibilities  - Karel Vietsch and others.
    6.1. CEC documents on Computer Security issues in eEurope.
    6.2. Project proposals discussion.
7. Report on CERT/IRT object proposal by Wilfried Woeber.
  • Summary of CERT/IRT object proposal.
8. Update on FIRST - David Crochemore and others.
  • FIRST Conference 2001 - overview and results.
  • FIRST14 Conference Call for papers - Discussion.
  • Other FIRST Developments.
9. IODEF/ITDWG update - Jan Meijer.
10. Clearinghouse for Incident Handling Tools: Questionnaire and follow-on activity - Yuri Demchenko.
11. Results of yesterday's Seminar Sessions. Summary conclusions and follow-up actions.
12. Other Work Items.
    12.1. Encouraging and Assisting the Establishment of new CSIRTs (short presentations by new members). 12.2. Legal Issues and Relations with Law Enforcement Agencies (UK - Andrew Powell).
13. Date and Venue of Next Meetings.
14. Any Other Business.

Accompanying events:
IODEF/ITD Working Group meeting - Wednesday September 26, 2001 from 16:00-18:00.
Trusted Introducer: Meeting of Level-2 Teams (closed meeting)- Thursday September 27, 2001 from 17:30-17:45.