Incident Responders Gather in Kuala Lumpur for the 30th FIRST Conference

Kuala Lumpur is hosting the 30th annual conference of FIRST, the Forum of Incident Response and Security Teams, which runs from 24 to 30 June 2018 at the Shangri-La Hotel. Opening the event, the organisers said this edition had drawn more people than any before it: 829 attendees and security specialists from across the world.

Across five days the programme offers keynotes on incident response and global cybersecurity, workshops on incident response, management and technical subjects, a vendor showcase and exhibition, hackathons and training tracks. For years a central aim of the conference has been to raise awareness of why organisations need an incident response capability and why they should cooperate to solve computer security problems and fend off attacks. That aim is also why the event moves to a different city every year.

From a handful of members to 88 countries

FIRST began in 1988 with only a few members, set up in the wake of one of the earliest computer worms spread over the internet. It now has more than 400 members in 88 countries. Its members in ASEAN include the Malaysian Computer Emergency Response Team (MyCERT), Singapore CERT (SingCERT) and the Indonesia Security Incident Response Team on Internet Infrastructure Coordination Centre (IDS-SIRTII/CC), the teams that step in when a serious incident hits cyberspace. The audience also takes in product security teams from government, industry and academia, information security practitioners, policy and decision makers, and law enforcement officers.

Plenty of the people in the room have worked in the field for many years. Kim Zetter, an American journalist who covers cybersecurity and one of the invited speakers, summed up that long view at a media briefing held on Monday, straight after the official opening: "A lot has changed, and nothing has changed." In her view, awareness that security is a global matter is higher than it used to be. Everyone from individuals to nation states can now see that networks are linked together in ways they were not before, and that any one person's system can end up as a component in a bigger attack. That, she said, makes it increasingly important for everyone to look at their own level of security, for their own sake and for the global good.

Bringing policy makers into the conversation

The community's broad mission is to make life easier for security incident response teams around the world. It helps teams in different countries handle incidents more effectively by giving them access to the tools they need, to best practices and to trusted channels of communication with other member teams. Thomas Schreck, the chairman of FIRST, told the same briefing that over the past few years the organisation has also been working to educate neighbouring communities, policy makers among them.

Christopher Painter, a commissioner of the Global Commission on the Stability of Cyberspace, underlined that point. He said the community must keep building bridges to the policy and diplomatic worlds, because some misunderstanding remains: policy makers now accept that cybersecurity matters, he said, "but they don't know why". FIRST therefore helps clear up ideas about the field that are often misunderstood or simply wrong.

The organisation trains policy makers as well as technical staff so that they grasp the issues. Painter added that they do not need to join FIRST to understand the wider consequences, and he expects the field to weigh ever more heavily on national security, economic security, human rights and diplomacy in the years ahead. He said he thought the work FIRST is doing was great.