TRANSITS I courses are aimed at new or potential CSIRT personnel who wish to gain a good grounding in the main aspects of working in an incident handling and response team. They cover basic incident handling and response techniques, operational practices, as well as organisational and legal issues. Trainees also get a unique opportunity to mix with their peers and discuss security issues in a secure and trusted environment, whilst being tutored by leading members of the European CSIRT community.

TRANSITS I courses are open to individuals currently working for a CSIRT or network security related organisation, and those with bona-fide interest in establishing a CSIRT. Applications are welcomed from commercial, governmental, law enforcement and military organisations, as well as NRENs and research and education institutes.

TERENA normally organises two TRANSITS I courses per year. These are two full days in duration and involve 25-30 trainees at a time. You can read from a Student's perspective in this blog post. The following modules are covered:

  • Organisation - Covers how CSIRTs fit within their organisations and includes planning the team, defining its constituency, determining which services to offer, staffing, communicating with external parties, funding, and obtaining management authority.
  • Technical - Covers how intruders attack systems and their motivations, how network protocols can be abused, vulnerabilities of operating systems and services, denial-of-service attacks, hiding traces, and information gathering techniques. Includes several practical exercises.
  • Operational - Covers the incident handling process from initial reports, through triage, investigation, resolution, closure, to post-analysis. Includes practical exercises and a survey of useful tools.
  • Legal - Covers areas of European legislation likely to affect CSIRTs in their work, and that operatives should be familiar with. This includes data protection, computer misuse, network monitoring, collection of evidence, and working with law enforcement agencies.

Other topics such as PGP keys and relevant RFCs are also covered during the course.

Forthcoming Courses

The next TRANSITS I workshop will be held on 13-14 April 2016 in Egmond aan Zee, the Netherlands.

The next TRANSITS I workshop will be held in Egmond aan Zee in the Netherlands. The following courses will be announced here as soon as the details are known.

Other licensed courses are also periodically organised by third parties.

Course Fees

TRANSITS I course fees are €1,100 for commercial companies, or €750 for non-commercial organisations.

These fees include accommodation for three nights, two lunches, two evening meals, coffee breaks, and course materials.


Applicants to TRANSITS I courses are subject to a vetting procedure and are usually required to provide references. This is to ensure that individuals fulfil the course requirements and have a legitimate interest in network security. Application forms should therefore be completed as fully as possible.

Trainees are typically experienced system, network or IT administrators, although interested persons from other backgrounds are welcome to contact the organisers to discuss the suitability of the course for them. They are expected to have an awareness of the security issues involved in connecting computers to the Internet, and must be committed to using their skills to improve the security of computers and networks. Familiarity with Internet protocols, addresses and port numbers is assumed.