terena logo
22 November 2005
TERENA AND FIRST Organise First Joint CSIRT Training Course

Following on from the TRANSITS project (Training of Network Security Incident Teams Staff), TERENA and FIRST, the global Forum of Incident Response and Security Teams, have agreed to organise at least two training workshops per year for members (and future members) of Computer Security Incident Response Teams (CSIRTs). The first in this new series of training events took place in Vienna, Austria on 21-22 November 2005. The workshop was sponsored by ISPA, the Austrian Association of Internet Service Providers.

Following on from the TRANSITS project (Training of Network Security Incident Teams Staff), TERENA and FIRST, the global Forum of Incident Response and Security Teams, have agreed to organise at least two training workshops per year for members (and future members) of Computer Security Incident Response Teams (CSIRTs). The first in this new series of training events took place in Vienna, Austria on 21-22 November 2005. The workshop was sponsored by ISPA, the Austrian Association of Internet Service Providers.

The training course was attended by 28 trainees from 16 European countries, from the academic, business and government sectors. Their feedback on the workshop contents, the delivery of the materials and the logistics of the event was very positive. Tutors were Andrew Cormack (UKERNA, United Kingdom), Ulrich Kiermayr (ACOnet CERT, Austria), Jan Meijer (SURFnet-CERT, Netherlands), Klaus Möller (DFN-CERT, Germany) and Don Stikvoort (S-CURE BV, Netherlands). The workshop was organised by Don Stikvoort of the FIRST Secretariat and Aukje Bakker and Karel Vietsch of the TERENA Secretariat.

The course was presented using the most recent version of the TRANSITS course materials. As in the last training workshops that were organised as part of the TRANSITS project, a number of informal, interactive sessions were organised in addition to the five modules that form the core of the training materials:  Don Stikvoort presented the Trusted Introducer service, Jan Meijer related a recent crime story from the Netherlands, Ulrich Kiermayr discussed collaboration in the security area at a national level taking Austria as an example, and Klaus Möller took participants through an analysis of a real-life incident.

A PGP key signing party was part of the programme of the first day. On the evening of the second day, an informal interactive session concluded the event. In this session, trainees were divided in four teams and presented step-by-step with two real-life cases of security incidents; they were then asked to develop a response to the problem, taking into account all aspects that had been taught during the course.

The next CSIRT training course organised by TERENA and FIRST is expected to take place in the first half of 2006. The event will be announced in due course on the TRANSITS website: http://www.ist-transits.org/