State of the Practice of Computer Security Incident Response Teams ...

2.3.2 The Creation of FIRST
In August 1989 an invitational workshop was organized by the CERT/CC to discuss not only
what was learned during the first year of operation but also what the next steps were in coordinating
relationships between the teams. 14 This became the first event drawing practitioners
from the field and the start of the annual conferences that are now organized by the Forum of
Incident Response and Security Teams. 15
In October 1989 another worm attacked the Internet, which now consisted of approximately
170,000 hosts. This worm, called WANK, exploited vulnerabilities in systems connected to
the Digital Equipment Corporation’s proprietary network, DECNET. Three teams coordinated
their activities to provide the response to this worm: the Department of Energy’s Computer
Incident Advisory Capability (CIAC), the NASA Space Physics Analysis Network, and
the CERT/CC. Various warnings were released from both CIAC and CERT/CC that were
helpful to the Internet community, even though many administrators did not heed the warnings
and were infected by a variant of the WANK worm called OILZ released two weeks
later.
After this example of successful collaboration between teams, more discussions ensued on
how to set up a response team network. During a 1990 workshop by NIST and CERT/CC, a
panel session presented and discussed the ideas for such a network. The session, titled “Developing
the Response Team Network,” included the following presentations:
• Dennis D. Steinauer (NIST, USA), “The Response Center Network : Developing It and
Making It Work”
• Richard D. Pethia (CERT/CC, USA), “Developing the Response Team Network”
• Ronald H. Hysert (Canadian System Security Centre), “Developing the Computer Security
Incident Response Network: A Canadian Perspective”
• Christopher C. Harvey (SPAN, France), “The Development of Response Teams in
Europe”
From these and other discussions, goals for future collaboration were established. These
goals were to share information among CSIRTs and, if needed, to aid one another during incidents
and network-wide attacks. The CSIRT community is still pursuing these goals today.
Teams working in various collaborations are looking for the most effective way to establish a
coordination network.
14
15
Today FIRST conferences are international forums for CSIRTs and security teams involved in
incident handling. To read more about them see .
20 CMU/SEI-2003-TR-001