Incident Response

Forum of Incident Response and Security Teams (FIRST)

The Forum of Incident Response and Security Teams (FIRST) is a nonprofit professional organization made up of member incident response teams. It brings together a large number of incident response teams that span a wide spectrum of public resource, internal, vendor, and commercial teams; it is probably the only single organization dedicated solely to the advancement of incident response teams. Apart from the usual networking benefits that such an organization facilitates, FIRST holds periodic technical colloquia that focus on exchanging technical information among the member teams in sessions that are closed to nonmembers of FIRST. Additionally, FIRST holds an annual conference -- the only one of its kind -- dedicated exclusively to incident response. The conference usually includes several one-day seminars on incident response topics for start-up as well as experienced teams and their staff. As FIRST is a nonprofit organization, its funding comes primarily from the proceeds of the annual conferences, and it relies heavily on the volunteer efforts of the member teams in order to survive. It should be stressed that FIRST is not, and was never intended to be, an operational incident response team like the CERT/CC. Its sole function is to support and bring together its member teams.

Any company or organization that is setting up its own incident response program should look into FIRST, if only by attending one or more of its ...