CINXE.COM

<!doctype html><html lang="en" class="web tlp-clear" data-studio-config="eyJ4aHJDcmVkZW50aWFscyI6ZmFsc2UsInhockhlYWRlcnMiOnt9fQo="><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title>Internet Governance</title> <meta property="og:title" content="Internet Governance" /> <meta property="og:type" content="website" /> <meta property="og:image" content="https://www.first.org/_/img/first-big-icon.png" /> <meta property="og:url" content="https://www.first.org/global/governance/" /> <meta property="og:site_name" content="FIRST — Forum of Incident Response and Security Teams" /> <meta property="fb:profile_id" content="296983660669109" /> <meta property="twitter:card" content="summary" /> <meta property="twitter:site" content="@FIRSTdotOrg" /><meta name="viewport" content="initial-scale=1,maximum-scale=1.0,user-scalable=no" /><link rel="icon" type="image/png" href="/1st.png" /><link rel="apple-touch-icon" sizes="128x128" href="/favicon.png" /><link rel="stylesheet" type="text/css" href="/_/web.css?20241031194005" /><link rel="stylesheet" type="text/css" href="/_/web.css?20241031194005" /></head><body><header><div id="header" data-studio="CU52CV1W8g"><div id="c5" data-studio="Yu8FjCC11g"><div id="topbar"> <div class="sites right"> <ul> <li><a href="https://support.first.org" class="kb-datalist"><img src="/_/img/icon-portal_support.svg" alt="FIRST Support" title="FIRST Support" /></a></li> <li><a href="https://portal.first.org" class="button"><span class="no-tiny">Member </span>Portal</a></li> </ul> </div> <div class="first-logo"> <p><a href="/"><img src="/_/img/first-org-simple-negative.svg" alt="FIRST.Org" title="FIRST" /></a></p> </div> <div class="nav"> <ul class="navbar"><li><a href="/about">About FIRST</a><ul><li><a href="/about/mission">Mission Statement</a></li><li><a href="/about/history">History</a></li><li><a href="/about/sdg">Sustainable Development Goals</a></li><li><a href="/about/organization">Organization</a><ul><li><a href="/about/organization/directors">Board of Directors</a></li><li><a>Operations Team</a><ul><li><a href="/about/organization/ccb">Community & Capacity Building</a></li><li><a href="/about/organization/events">Event Office</a></li><li><a href="/about/organization/executive-director">Executive Director</a></li><li><a href="/about/organization/infrastructure">Infrastructure</a></li><li><a href="/about/organization/secretariat">Secretariat</a></li></ul></li><li><a href="/about/organization/committees">Committees</a><ul><li><a href="/about/organization/committees/compensation-committee">Compensation Committee</a></li><li><a href="/about/organization/committees/conference-program-committee">Conference Program Committee</a></li><li><a href="/about/organization/committees/membership-committee">Membership Committee</a></li><li><a href="/about/organization/committees/rules-committee">Rules Committee</a></li><li><a href="/about/organization/committees/standards">Standards Committee</a></li></ul></li><li><a href="/events/agm">Annual General Meeting</a></li><li><a href="/about/organization/reports">Annual Reports and Tax Filings</a></li></ul></li><li><a href="/about/policies">FIRST Policies</a><ul><li><a href="/about/policies/anti-corruption">Anti-Corruption Policy</a></li><li><a href="/about/policies/antitrust">Antitrust Policy</a></li><li><a href="/about/policies/bylaws">Bylaws</a></li><li><a href="/about/policies/board-duties">Board duties</a></li><li><a href="/about/bugs">Bug Bounty Program</a></li><li><a href="/about/policies/code-of-conduct">Code of Conduct</a></li><li><a href="/about/policies/conflict-policy">Conflict of Interest Policy</a></li><li><a href="/about/policies/doc-rec-retention-policy">Document Record Retention and Destruction Policy</a></li><li><a href="/newsroom/policy">FIRST Press Policy</a></li><li><a href="/about/policies/gen-event-reg-refund-policy">General Event Registration Refund Policy</a></li><li><a href="/about/policies/event-site-selection">Guidelines for Site Selection for all FIRST events</a></li><li><a href="/identity">Identity & Logo Usage</a></li><li><a href="/about/policies/mailing-list">Mailing List Policy</a></li><li><a href="/about/policies/media">Media Policy</a></li><li><a href="/about/policies/privacy">Privacy Policy</a></li><li><a href="/about/policies/registration-terms-conditions">Registration Terms & Conditions</a></li><li><a href="/about/policies/terms">Services Terms of Use</a></li><li><a href="/about/policies/standards">Standards Policy</a></li><li><a href="/about/policies/diversity">Statement on Diversity & Inclusion</a></li><li><a href="/about/policies/translation-policy">Translation Policy</a></li><li><a href="/about/policies/travel-policy">Travel Policy</a></li><li><a href="/about/policies/uniform-ipr">Uniform IPR Policy</a></li><li><a href="/about/policies/whistleblower-policy">Whistleblower Protection Policy</a></li></ul></li><li><a href="/about/partners">Partnerships</a><ul><li><a href="/global/partners">Partners</a></li><li><a href="/global/friends">Friends of FIRST</a></li><li><a href="/global/supporters/">FIRST Supporters</a></li><li><a href="/about/sponsors">Sponsors</a></li></ul></li><li><a href="/newsroom">Newsroom</a><ul><li><a href="/newsroom/news">What's New</a></li><li><a href="/newsroom/releases">Press Releases</a></li><li><a href="/newsroom/news/media">In the News</a></li><li><a href="/podcasts">Podcasts</a><ul><li><a href="/newsroom/news/first-impressions/">FIRST Impressions Podcast</a></li><li><a href="/newsroom/news/podcasts/">FIRSTCON Podcast</a></li></ul></li><li><a href="/newsroom/newsletters">Newsletters</a></li><li><a href="/newsroom/policy">FIRST Press Policy</a></li></ul></li><li><a href="/about/procurement">Procurement</a></li><li><a href="/about/jobs/">Jobs</a></li><li><a href="/contact">Contact</a></li></ul></li><li><a href="/members">Membership</a><ul><li><a href="/membership/">Becoming a Member</a><ul><li><a href="/membership/process">Membership Process for Teams</a></li><li><a href="/membership/process-liaisons">Membership Process for Liaisons</a></li><li><a href="/membership/#Fees">Membership Fees</a></li></ul></li><li><a href="/members/teams">FIRST Teams</a></li><li><a href="/members/liaisons">FIRST Liaisons</a></li><li><a href="/members/map">Members around the world</a></li></ul></li><li><a href="/global">Initiatives</a><ul><li><a href="/global/sigs">Special Interest Groups (SIGs)</a><ul><li><a href="/global/sigs/framework">SIGs Framework</a></li><li><a href="/global/sigs/academicsec" class="borderb">Academic Security SIG</a></li><li><a href="/global/sigs/ai-security">AI Security SIG</a></li><li><a href="/global/sigs/automation">Automation SIG</a></li><li><a href="/global/sigs/bigdata">Big Data SIG</a></li><li><a href="/cvss">Common Vulnerability Scoring System (CVSS-SIG)</a><ul><li><a href="/cvss/calculator/4.0">Calculator</a></li><li><a href="/cvss/v4.0/specification-document">Specification Document</a></li><li><a href="/cvss/v4.0/user-guide">User Guide</a></li><li><a href="/cvss/v4.0/examples">Examples</a></li><li><a href="/cvss/v4.0/faq">Frequently Asked Questions</a></li><li><a href="/cvss/v4-0">CVSS v4.0 Documentation & Resources</a><ul><li><a href="/cvss/calculator/4.0">CVSS v4.0 Calculator</a></li><li><a href="/cvss/v4.0/specification-document">CVSS v4.0 Specification Document</a></li><li><a href="/cvss/v4.0/user-guide">CVSS v4.0 User Guide</a></li><li><a href="/cvss/v4.0/examples">CVSS v4.0 Examples</a></li><li><a href="/cvss/v4.0/faq">CVSS v4.0 FAQ</a></li></ul></li><li><a href="/cvss/v3-1">CVSS v3.1 Archive</a><ul><li><a href="/cvss/calculator/3.1">CVSS v3.1 Calculator</a></li><li><a href="/cvss/v3.1/specification-document">CVSS v3.1 Specification Document</a></li><li><a href="/cvss/v3.1/user-guide">CVSS v3.1 User Guide</a></li><li><a href="/cvss/v3.1/examples">CVSS v3.1 Examples</a></li><li><a href="/cvss/v3.1/use-design">CVSS v3.1 Calculator Use & Design</a></li></ul></li><li><a href="/cvss/v3-0">CVSS v3.0 Archive</a><ul><li><a href="/cvss/calculator/3.0">CVSS v3.0 Calculator</a></li><li><a href="/cvss/v3.0/specification-document">CVSS v3.0 Specification Document</a></li><li><a href="/cvss/v3.0/user-guide">CVSS v3.0 User Guide</a></li><li><a href="/cvss/v3.0/examples">CVSS v3.0 Examples</a></li><li><a href="/cvss/v3.0/use-design">CVSS v3.0 Calculator Use & Design</a></li></ul></li><li><a href="/cvss/v2">CVSS v2 Archive</a><ul><li><a href="/cvss/v2/guide">CVSS v2 Complete Documentation</a></li><li><a href="/cvss/v2/history">CVSS v2 History</a></li><li><a href="/cvss/v2/team">CVSS-SIG team</a></li><li><a href="/cvss/v2/meetings">SIG Meetings</a></li><li><a href="/cvss/v2/faq">Frequently Asked Questions</a></li><li><a href="/cvss/v2/adopters">CVSS Adopters</a></li><li><a href="/cvss/v2/links">CVSS Links</a></li></ul></li><li><a href="/cvss/v1">CVSS v1 Archive</a><ul><li><a href="/cvss/v1/intro">Introduction to CVSS</a></li><li><a href="/cvss/v1/faq">Frequently Asked Questions</a></li><li><a href="/cvss/v1/guide">Complete CVSS v1 Guide</a></li></ul></li><li><a href="/cvss/data-representations">JSON & XML Data Representations</a></li><li><a href="/cvss/training">CVSS On-Line Training Course</a></li><li><a href="/cvss/identity">Identity & logo usage</a></li></ul></li><li><a href="/global/sigs/csirt">CSIRT Framework Development SIG</a></li><li><a href="/global/sigs/cyberinsurance">Cyber Insurance SIG</a><ul><li><a href="/global/sigs/cyberinsurance/events">Cyber Insurance SIG Webinars</a></li></ul></li><li><a href="/global/sigs/cti">Cyber Threat Intelligence SIG</a><ul><li><a href="/global/sigs/cti/curriculum/">Curriculum</a><ul><li><a href="/global/sigs/cti/curriculum/introduction">Introduction</a></li><li><a href="/global/sigs/cti/curriculum/cti-introduction">Introduction to CTI as a General topic</a></li><li><a href="/global/sigs/cti/curriculum/methods-methodology">Methods and Methodology</a></li><li><a href="/global/sigs/cti/curriculum/pir">Priority Intelligence Requirement (PIR)</a></li><li><a href="/global/sigs/cti/curriculum/source-evaluation">Source Evaluation and Information Reliability</a></li><li><a href="/global/sigs/cti/curriculum/machine-human">Machine and Human Analysis Techniques (and Intelligence Cycle)</a></li><li><a href="/global/sigs/cti/curriculum/threat-modelling">Threat Modelling</a></li><li><a href="/global/sigs/cti/curriculum/training">Training</a></li><li><a href="/global/sigs/cti/curriculum/standards">Standards</a></li><li><a href="/global/sigs/cti/curriculum/glossary">Glossary</a></li><li><a href="/global/sigs/cti/curriculum/cti-reporting/">Communicating Uncertainties in CTI Reporting</a></li></ul></li><li><a href="/global/sigs/cti/events/">Webinars and Online Training</a></li><li><a href="/global/sigs/cti/cti-program">Building a CTI program and team</a><ul><li><a href="/global/sigs/cti/cti-program/program-stages">Program maturity stages</a><ul><li><a href="/global/sigs/cti/cti-program/stage1">CTI Maturity model - Stage 1</a></li><li><a href="/global/sigs/cti/cti-program/stage2">CTI Maturity model - Stage 2</a></li><li><a href="/global/sigs/cti/cti-program/stage3">CTI Maturity model - Stage 3</a></li></ul></li><li><a href="/global/sigs/cti/cti-program/starter-kit">Program Starter Kit</a></li><li><a href="/global/sigs/cti/cti-program/resources">Resources and supporting materials</a></li></ul></li></ul></li><li><a href="/global/sigs/digital-safety">Digital Safety SIG</a></li><li><a href="/global/sigs/dns">DNS Abuse SIG</a><ul><li><a href="/global/sigs/dns/policies">Code of Conduct & Other Policies</a></li><li><a href="/global/sigs/dns/dns-abuse-examples">Examples of DNS Abuse</a></li></ul></li><li><a href="/global/sigs/ethics">Ethics SIG</a><ul><li><a href="/global/sigs/ethics/ethics-first">Ethics for Incident Response Teams</a></li></ul></li><li><a href="/epss/">Exploit Prediction Scoring System (EPSS)</a><ul><li><a href="/epss/model">The EPSS Model</a></li><li><a href="/epss/data_stats">Data and Statistics</a></li><li><a href="/epss/user-guide">User Guide</a></li><li><a href="/epss/research">EPSS Research and Presentations</a></li><li><a href="/epss/faq">Frequently Asked Questions</a></li><li><a href="/epss/who_is_using">Who is using EPSS?</a></li><li><a href="/epss/epss_tools">Open-source EPSS Tools</a></li><li><a href="/epss/api">API</a></li><li><a href="/epss/papers">Related Exploit Research</a></li><li><a>Blog</a><ul><li><a href="/epss/articles/prob_percentile_bins">Understanding EPSS Probabilities and Percentiles</a></li><li><a href="/epss/articles/log4shell">Log4Shell Use Case</a></li><li><a href="/epss/articles/estimating_old_cvss">Estimating CVSS v3 Scores for 100,000 Older Vulnerabilities</a></li></ul></li><li><a href="/epss/partners">Data Partners</a></li></ul></li><li><a href="/global/sigs/msr/">FIRST Multi-Stakeholder Ransomware SIG</a></li><li><a href="/global/sigs/hfs/">Human Factors in Security SIG</a></li><li><a href="/global/sigs/ics">Industrial Control Systems SIG (ICS-SIG)</a></li><li><a href="/global/sigs/iep">Information Exchange Policy SIG (IEP-SIG)</a></li><li><a href="/global/sigs/information-sharing">Information Sharing SIG</a><ul><li><a href="/global/sigs/information-sharing/misp">Malware Information Sharing Platform</a></li></ul></li><li><a href="/global/sigs/le">Law Enforcement SIG</a></li><li><a href="/global/sigs/malware">Malware Analysis SIG</a><ul><li><a href="/global/sigs/malware/ma-framework">Malware Analysis Framework</a></li><li><a href="/global/sigs/malware/ma-framework/malwaretools">Malware Analysis Tools</a></li></ul></li><li><a href="/global/sigs/metrics">Metrics SIG</a><ul><li><a href="/global/sigs/metrics/events">Metrics SIG Webinars</a></li></ul></li><li><a href="/global/sigs/netsec/">NETSEC SIG</a></li><li><a href="/global/sigs/passive-dns">Passive DNS Exchange</a></li><li><a href="/global/sigs/policy">Policy SIG</a></li><li><a href="/global/sigs/psirt">PSIRT SIG</a></li><li><a href="/global/sigs/red-team">Red Team SIG</a></li><li><a href="/global/sigs/cpg">Retail and Consumer Packaged Goods (CPG) SIG</a></li><li><a href="/global/sigs/ctf">Security Lounge SIG</a></li><li><a href="/global/sigs/tic/">Threat Intel Coalition SIG</a><ul><li><a href="/global/sigs/tic/membership-rules">Membership Requirements and Veto Rules</a></li></ul></li><li><a href="/global/sigs/tlp">Traffic Light Protocol (TLP-SIG)</a></li><li><a href="/global/sigs/transport">Transportation and Mobility SIG</a></li><li><a href="/global/sigs/vulnerability-coordination">Vulnerability Coordination</a><ul><li><a href="/global/sigs/vulnerability-coordination/multiparty">Multi-Party Vulnerability Coordination and Disclosure</a></li><li><a href="/global/sigs/vulnerability-coordination/multiparty/guidelines">Guidelines and Practices for Multi-Party Vulnerability Coordination and Disclosure</a></li></ul></li><li><a href="/global/sigs/vrdx">Vulnerability Reporting and Data eXchange SIG (VRDX-SIG)</a><ul><li><a href="/global/sigs/vrdx/vdb-catalog">Vulnerability Database Catalog</a></li></ul></li><li><a href="/global/sigs/wof">Women of FIRST</a></li></ul></li><li><a href="/global/governance">Internet Governance</a></li><li><a href="/global/irt-database">IR Database</a></li><li><a href="/global/fellowship">Fellowship Program</a><ul><li><a href="https://portal.first.org/fellowship">Application Form</a></li></ul></li><li><a href="/global/mentorship">Mentorship Program</a></li><li><a href="/hof">IR Hall of Fame</a><ul><li><a href="/hof/inductees">Hall of Fame Inductees</a></li></ul></li><li><a href="/global/victim-notification">Victim Notification</a></li><li><a href="/volunteers/">Volunteers at FIRST</a><ul><li><a href="/volunteers/list">FIRST Volunteers</a></li><li><a href="/volunteers/participation">Volunteer Contribution Record</a></li></ul></li><li><a href="#new">Previous Activities</a><ul><li><a href="/global/practices">Best Practices Contest</a></li></ul></li></ul></li><li><a href="/standards">Standards & Publications</a><ul><li><a href="/standards">Standards</a><ul><li><a href="/cvss">Common Vulnerability Scoring System (CVSS-SIG)</a></li><li><a href="/tlp">Traffic Light Protocol (TLP)</a><ul><li><a href="/tlp/use-cases">TLP Use Cases</a></li></ul></li><li><a href="/standards/frameworks/">Service Frameworks</a><ul><li><a href="/standards/frameworks/csirts">CSIRT Services Framework</a></li><li><a href="/standards/frameworks/psirts">PSIRT Services Framework</a></li></ul></li><li><a href="/iep">Information Exchange Policy (IEP)</a><ul><li><a href="/iep/iep_framework_2_0">IEP 2.0 Framework</a></li><li><a href="/iep/iep-json-2_0">IEP 2.0 JSON Specification</a></li><li><a href="/iep/iep-polices">Standard IEP Policies</a><ul><li><a href="https://www.first.org/iep/2.0/first-tlp-iep.iepj">IEP TLP Policy File</a></li><li><a href="https://www.first.org/iep/2.0/first-unknown-iep.iepj">IEP Unknown Policy File</a></li></ul></li><li><a href="/iep/iep_v1_0">IEP 1.0 Archive</a></li></ul></li><li><a href="/global/sigs/passive-dns">Passive DNS Exchange</a></li><li><a href="/epss">Exploit Prediction Scoring System (EPSS)</a></li></ul></li><li><a href="/resources/papers">Publications</a></li></ul></li><li><a href="/events">Events</a></li><li><a href="/education">Education</a><ul><li><a href="/education/first-training">FIRST Training</a><ul><li><a href="/education/trainings">Training Courses</a></li><li><a href="/education/trainers">FIRST Trainers</a></li></ul></li></ul></li><li><a href="/blog">Blog</a></li></ul> </div> </div> <div id="home-buttons"> <p><a href="/join" data-title="Join"><img alt="Join" src="/_/img/icon-join.svg"><span class="tt-join">Join<span>Details about FIRST membership and joining as a full member or liaison.</span></span></a> <a href="/learn" data-title="Learn"><img alt="Learn" src="/_/img/icon-learn.svg"><span class="tt-learn">Learn<span>Training and workshop opportunities, and details about the FIRST learning platform.</span></span></a> <a href="/participate" data-title="Participate"><img alt="Participate" src="/_/img/icon-participate.svg"><span class="tt-participate">Participate<span>Read about upcoming events, SIGs, and know what is going on.</span></span></a></p> </div></div></div></header><div id="body" data-studio="CU52CV1W8g"><div id="c1" data-studio="Yu8FjCC11g"><h1 id="Internet-Governance">Internet Governance</h1> <p>As part of achieving our mission of enabling incident response teams to more effectively respond to incidents, FIRST often contributes technical expertise to Internet Governance stakeholders by providing context, best practices and information around the role of security teams. </p></div><div id="c2" data-studio="Yu8FjCC11g" class="toc-h2"><h2 id="FIRST-s-participation-in-the-Internet-Governance-Forum">FIRST’s participation in the Internet Governance Forum</h2> <p>As an outcome of the World Summit on the Information Society in Tunis in 2005, the United Nations Secretary-General announced in July of 2006 the creation of an internet governance body called the Internet Governance Forum (IGF). The IGF is a forum for multi-stakeholder dialogue on public policy issues related to internet governance. </p> <p>Rather than a formal body of negotiation, the IGF is the United Nations forum which creates an opportunity for open and inclusive dialogue and the exchange of ideas around internet governance. Participants in the IGF hail from all major stakeholder communities: private sector, intergovernmental organizations and government, civil society, academia and the technical community.</p> <p>FIRST and its experts, as members of the Technical Community, regularly participates in the Internet Governance Forum as part of technical panel sessions, and through more structured working groups. This enables the FIRST community to share its expertise and best practices with other technology community stakeholders, and by creating awareness of the mission of incident response and security teams with policymakers.</p></div><div id="c3" data-studio="Yu8FjCC11g" class="toc-h2 toc-h3 citation"><h2 id="Best-Practices-Forum-on-Incident-Response-Teams">Best Practices Forum on Incident Response Teams</h2> <p>In 2013, the IGF Multistakeholder Advisory Group (MAG) decided to increase its intersessional work, including the development of a Best Practices Forum on Establishing Computer Security Incident Response teams for Internet Security. Maarten Van Horenbeeck, Christine Hoepers, Adli Wahid, Yurie Ito and Jean-Robert Hountomey participated as lead experts to the forum. Various other FIRST members contributed to the discussions.</p> <p>The forum’s goal was to determine opportunities and challenges involved in the establishment of Computer Emergency Response Teams. </p> <h3 id="9th-session-of-the-Internet-Governance-Forum-Istanbul-Turkey-September-2014">9th session of the Internet Governance Forum – Istanbul, Turkey, September 2014</h3> <p>A video recording of the Best Practices Forum meeting in Istanbul is available. The session was led by Christine Hoepers, Adli Wahid and Maarten Van Horenbeeck of FIRST:</p> <div style="text-align:center;background:#eee;"><iframe width="560" height="315" style="display:inline-block" src="https://www.youtube.com/embed/YnOljPgfqmI" frameborder="0" allowfullscreen></iframe></div> <p>The final outcome document can be downloaded <a href="/global/governance/bpf-csirt-2014-outcome.pdf">here</a>.</p> <p>The multi-stakeholder group noted the following insights:</p> <blockquote> <ul> <li>There is a strong preference for the term CSIRT over CERT. This is the reason why the CSIRT abbreviation is used in this document. </li> <li>There are different CSIRT within different organizations. Their goals, constituency and services may differ. However, all are involved in mitigating cybersecurity incidents or emergencies on behalf of its constituency. This constituency can be within their own organization and/or can be delivered to others outside of it. </li> <li>The most important factor is that these CSIRT are able to work together, accept each other’s information and deliver what they are supposed to. </li> <li>In cooperation, everything comes down to trust. There is no legislation that can give trust to an organization. It is built up over time, time and again, with delivering what is needed and promised, in a timely fashion, and providing the security and adhering to the sensitivities needed for cooperation. </li> <li>The success or failure of a CSIRT has everything to do with the correct determination of its deliverables, next to the perceptions of other stakeholders. Sometimes, success is not clearly defined, which contributes to confusion around whether the CSIRT is delivering or not. </li> <li>The way CSIRT cooperate on the global, regional and national level on sharing knowledge, providing training facilities and actively work on trusted relationships has led to documents that are freely shared and available to all. These documents often describe a possible way to achieve a certain goal, rather than define a common practice which the community has converged upon.</li> <li>Many CSIRT around the world mitigate incidents and respond to emergencies on a daily basis and are successful in their work. They do so in collaboration with many different partners. There are several formal and informal networks that have proven to be a success. However, these networks are not easily accessible to everyone concerned yet, due to regional differences in budgets and priority settings. </li> <li>There is a clear need for a “CSIRT of last resort” in a country. It is not important who this CSIRT is, as long as its function is clear to all and it is able to act on request for assistance from third parties. In many countries this will be a national, governmental CSIRT, but, as examples show, it may also be a CSIRT operated by other stakeholders. The most important thing is that a CSIRT is able to coordinate any incident at a national level, when no other party involved is able to take on that role. </li> </ul> </blockquote> <p>During the main wrap-up session, Adli Wahid provided a briefing on the Best Practices Forum. A video of the complete wrap-up session is available in <a href="https://youtu.be/sO63BuaOFNI">English</a>, <a href="https://www.youtube.com/watch?v=lPMab1R0qxU">Arabic</a>, <a href="https://www.youtube.com/watch?v=f8x9TUad814">Spanish</a>, and <a href="https://www.youtube.com/watch?v=oGFT2o6YFhY">Turkish</a>.</p> <h3 id="10th-session-of-the-Internet-Governance-Forum-Joao-Pessoa-Brazil-November-2015">10th session of the Internet Governance Forum – João Pessoa, Brazil, November 2015</h3> <p>A video recording of the Best Practices Forum meeting in João Pessoa is available. The session was moderated by Christine Hoepers of FIRST.</p> <div style="text-align:center;background:#eee;"><iframe style="display:inline-block" width="560" height="315" src="https://www.youtube.com/embed/VQjyoRIoKxY" frameborder="0" allowfullscreen></iframe></div> <p>A transcript from the session is also available <a href="http://www.intgovforum.org/cms/187-igf-2015/transcripts-igf-2015/2324-2015-11-11-bpf-establishing-and-supporting-computer-security-incident-response-teams-csirts-workshop-room-6">here</a>.</p> <p>The final outcome document can be downloaded <a href="/global/governance/bpf-csirt-2015-report.pdf">here</a>.</p> <p>The multi-stakeholder group noted the following insights:</p> <blockquote> <ul> <li>There is a need for policymakers to discuss the role of CSIRTs with the CSIRT community to avoid misconceptions around the role of CSIRTs. </li> <li>CSIRTs are recommended to be actively involved in relevant policy discussion at both the national and international level. In order to engage with other stakeholders it is important to be where they are. The provided examples show that it brings influence and understanding. </li> <li>Every government has the right to create the CSIRT it needs. It is recommended though that governments make an informed decision, taking into consideration the potential consequences of their choice. </li> <li>Where CSIRTs are concerned privacy and security have to stand together in order for a CSIRT to be truly successful. </li> <li>Data protection is a term that is better understood in a general sense than privacy. Hence it is advised to use this term in a CSIRT context more as it is far more concrete.</li> <li>Data protection has to be at the core of the work of a CSIRT.</li> <li>It is recommended to involve Data Protection Commissioners more in the work of CSIRTs. </li> <li>To ensure transparency and accountability where data protection is concerned, it is advised to make a study whether a standard protocol can assist attaining transparency, as well as more conscious decisions about limits to data sharing, anonymization of data where possible and the handling of data by CSIRTs. </li> <li>CSIRTs should minimize data collection and processing, while also focusing on their constituency and anonymizing relevant information. </li> <li>A well-run CSIRT is an essential part in the protection of data and security within a society. </li> <li>Further study is recommended into the expanding role of CSIRTs. This could e.g. include whether there are sensible limits to tasks given and what role a CSIRT can play in enhancing cooperation in the security chain between other stakeholders, e.g. manufacturers of ICT products and providers of ICT services and does the current definition of a CSIRT match the reality of work asked and tasked. </li> <li>Further study is recommended into the ways CSIRTs and law enforcement can enhance their cooperation in meaningful ways, each from within its respective mission.</li> <li>Further study is recommended into responsible disclosure and how to create conditions that ethical hackers can contribute to a safer Internet experience for all.</li> <li>CSIRTs have a role in handling effects of cybercrimes and providing technical support for investigations, but cybercrime is overall crime and as such should be dealt by law enforcement entities, like the police. Containing too much of this work within a CSIRT, or making a CSIRT part of a law enforcement agency is likely to have significant impact on its ability to work with the private sector.</li> <li>The work of this BPF is seen as extremely valuable by the community. It is recommended to be continued</li> </ul> </blockquote> <p>During the main wrap-up session, Christine Hoepers provided a briefing on the Best Practices Forum. A video of the complete wrap-up session is available in <a href="https://www.youtube.com/watch?v=ChxL_5C269k">English</a>, <a href="https://www.youtube.com/watch?v=jIHVmXFDmeU">Arabic</a>, <a href="https://www.youtube.com/watch?v=oD1gqfwysA0&t=7975s">Spanish</a>, <a href="https://www.youtube.com/watch?v=9gpYhW4l230">Russian</a>, <a href="https://www.youtube.com/watch?v=GQotMITH3lE">French</a> and <a href="https://www.youtube.com/watch?v=PpZz53yP5f8">Chinese</a>.</p> <h2 id="Best-Practices-Forum-on-Cybersecurity">Best Practices Forum on Cybersecurity</h2> <h3 id="11th-session-of-the-Internet-Governance-Forum-Guadalajara-Mexico-December-2016">11th session of the Internet Governance Forum – Guadalajara, Mexico, December 2016</h3> <p>Leading up to the 11th session of the IGF in Mexico, Several FIRST experts contributed a <a href="/global/governance/bpf-cybersecurity-2016-first-contribution.pdf">formal response</a> to the BPF on cybersecurity. In addition, we invited our members to submit individual responses where they had meaningful best practices to add, upon which several submitted a public response. </p> <p>A video recording of the Best Practices Forum meeting in Guadalajara is available. The session was moderated by Maarten Van Horenbeeck of FIRST:</p> <div style="text-align:center;background:#eee;"><iframe style="display:inline-block" width="560" height="315" src="https://www.youtube.com/embed/P1cxUnimmFQ" frameborder="0" allowfullscreen></iframe></div> <p>The following provisional statements found general consensus across the multi-stakeholder community which participated in the forum:</p> <blockquote> <ul> <li>The involvement of government, private sector, civil society and other stakeholders in handling cybersecurity was stressed as fundamental in terms of sharing best practices, sharing results of critical assessments and identifying globally accepted standards of cybersecurity. All stakeholders must understand, respect and trust each other’s expertise and competences.</li> <li>It was emphasized that to many today, the word “cybersecurity” is often loaded with context, and many organizations associate it with government decision making, or commercial security solutions. Within the IGF, it was said, there is an opportunity to redefine cybersecurity as a common goal between all stakeholders, and to work towards finding a common understanding about what productive cooperation and collaboration might look like.</li> <li>It was said that the term “cybersecurity” can mean very different things to different stakeholders depending upon the context in which it’s being used. (national security; public security; enterprise security; incidence response; personal security; protection against large scale data breaches and cyber crime/online crime; uncertainties about how our data is being used; surveillance and other online threats, etc.)</li> <li>There was broad agreement that the roles and responsibilities of stakeholders are evolving in making the Internet a secure and safe place for people to socialize and conduct business. It is clear that security is no longer just the purview of governments and that it is increasingly a multistakeholder imperative.</li> <li>Evolving understandings of cybersecurity make efforts to ensure the Internet is a secure and safe place an important focus of policy that requires input from multiple stakeholders. Starting from a dominant technical perspective of cybersecurity and focusing on protecting information infrastructure, debates around cybersecurity have rapidly broadened, bringing in many issues from cybercrime to secure access policies to data ethics and human rights under its banner.</li> <li>There was general consensus within the BPF around the notion that cybersecurity initiatives should be built on democratic, multistakeholder processes, ensuring the meaningful and accountable participation of all stakeholders, including governments, the private sector, civil society, the technical community, the academic community and users.</li> <li>It’s imperative to promote more robust, effective and timely information-sharing, cooperation and coordination among cybersecurity stakeholders at the national, regional and international levels. Cooperation and collaboration is key in cybersecurity, not only to avoid duplicate work and analysis, but also in respect to less mature entities, being able to profit from the experience and expertise of others and as such develop faster thereafter.</li> <li>Within the CSIRT community, automating information exchange where possible, and ensuring CSIRT’s ability to process information at an increasing pace is extremely important. CSIRT’s can often be resource constrained in terms of qualified analysts, and allowing them to focus on harder problems that require expert review is critical. However, it is important to clarify that prior to any automated exchange taking place, it is crucial for stakeholders to set expectations around how the data will be used. Sharing indicators may not be helpful if they are not used correctly, or are used for different purposes than intended. While there are typically many technical means of addressing a security incident, it is most important that goals are aligned and expectations are clearly set.</li> <li>For CSIRTs to effectively work with each other, or other peers within the community, trust is a crucial requirement. Trust is typically not established through legal agreements, but through a history of working with each other. Developing trust is easiest when the objectives of both organizations align. When both organizations have as goal to remediate the incident and restore operations, they both see value in the information exchange.</li> <li>There is a need for more civil society involvement in cybersecurity debates in all countries, and in particular in developing countries. Furthermore and in parallel with increased participation, more opportunities for education and awareness raising among civil society groups on issues of cybersecurity should be supported. For cybersecurity cooperation and collaboration to be enhanced globally – and particularly in global south countries – the first step is to create a level playing field in terms of knowledge, skills and capacity for engagement.</li> </ul> </blockquote> <p>During the main wrap-up session, Maarten Van Horenbeeck provided a briefing on the Best Practices Forum. A video of the complete wrap-up session is available in <a href="https://www.youtube.com/watch?v=HT5-F-adLZo&t=862s">English</a>, <a href="https://www.youtube.com/watch?v=zhX9SkU1Dpg">Arabic</a>, <a href="https://www.youtube.com/watch?v=l-nq1J4KRaI">Spanish</a>, and <a href="https://www.youtube.com/watch?v=TylmyFkktqY&t=2s">French</a>.</p> <h2 id="Panel-session-participation">Panel session participation</h2> <h3 id="7th-session-of-the-Internet-Governance-Forum-Baku-Azerbaijan-November-2012">7th session of the Internet Governance Forum – Baku, Azerbaijan, November 2012</h3> <p>FIRST was represented in the following panels:</p> <ul> <li> <p><strong>Cross border cooperation in incidents involving (Internet) Critical Infrastructure</strong></p> <div style="text-align:center;background:#eee;"><iframe style="display:inline-block" width="560" height="315" src="https://www.youtube.com/embed/rYSC2VjVQIo" frameborder="0" allowfullscreen></iframe></div> <p>Maarten Van Horenbeeck participates in discussion on how cross border incidents can be resolved, and whether a new “law of the seas” that applies to cyberspace, would be beneficial, or not. More information on the workshop, and a transcript, can be found <a href="http://wsms1.intgovforum.org/content/no87-cross-border-cooperation-incidents-involving-internet-critical-infrastructure">here</a>.</p> </li> </ul> <h3 id="9th-session-of-the-Internet-Governance-Forum-Istanbul-Turkey-September-2014">9th session of the Internet Governance Forum – Istanbul, Turkey, September 2014</h3> <p>FIRST was represented in the following panels:</p> <ul> <li> <p><strong>Multi-stakeholder approaches to cybersecurity awareness</strong></p> <div style="text-align:center;background:#eee;"><iframe style="display:inline-block" width="560" height="315" src="https://www.youtube.com/embed/Ek3MsKsGqCU" frameborder="0" allowfullscreen></iframe></div> <p>Board member Adli Wahid represents FIRST in a discussion on cybersecurity awareness. A transcript is available <a href="http://www.intgovforum.org/cms/174-igf-2014/transcripts/2084-finished-2014-09-03-ws43-multi-stakeholder-approaches-to-cybersecurity-awareness-room-9">here</a>. </p> </li> <li> <p><strong>Building Technical Communities in developing countries</strong></p> <div style="text-align:center;background:#eee;"><iframe style="display:inline-block" width="560" height="315" src="https://www.youtube.com/embed/8JhAwgQ44zY" frameborder="0" allowfullscreen></iframe></div> <p>Board member Maarten Van Horenbeeck represents how FIRST came to be, and grew into the organization it is today, in a discussion on building technical communities that work in developing countries.</p> </li> <li> <p><strong>National and International Information Sharing Model in Cybersecurity & CERTs</strong></p> <div style="text-align:center;background:#eee;"><iframe style="display:inline-block" width="560" height="315" src="https://www.youtube.com/embed/twr0OQ-echs" frameborder="0" allowfullscreen></iframe></div> <p>Maarten Van Horenbeeck discusses some of the key elements that make information sharing programs successful. </p> </li> </ul> <h3 id="11th-session-of-the-Internet-Governance-Forum-Guadalajara-Mexico-December-2016">11th session of the Internet Governance Forum – Guadalajara, Mexico, December 2016</h3> <p>FIRST was represented in the following panels:</p> <ul> <li> <p><strong>Let’s break down silos in cybersecurity and cybercrime!</strong></p> <div style="text-align:center;background:#eee;"><iframe style="display:inline-block" width="560" height="315" src="https://www.youtube.com/embed/9h_zOprdwMs" frameborder="0" allowfullscreen></iframe></div> <p>Christine Hoepers and Maarten Van Horenbeeck represent FIRST, how it overcomes information sharing challenges, and where it still sees issues today.</p> </li> </ul> <hr /> <p>FIRST would like to thank the following individual FIRST participants for having been significant contributors to our ongoing engagement with the IGF and other internet governance forums: Yurie Ito, Christine Hoepers, Serge Droz, Adli Wahid, Andrew Cormack, Belisario Contreras, Don Stikvoort and Jordana Siegel. We would also like to thank UN consultant Wout de Natris for his support of the CSIRT BPF project.</p></div></div><div id="navbar" data-studio="CU52CV1W8g"><div id="c6" data-studio="Yu8FjCC11g"><ul class="navbar"><li><a href="/global">Initiatives</a><ul><li><a href="/global/sigs">Special Interest Groups (SIGs)</a><ul><li><a href="/global/sigs/framework">SIGs Framework</a></li><li><a href="/global/sigs/academicsec" class="borderb">Academic Security SIG</a></li><li><a href="/global/sigs/ai-security">AI Security SIG</a></li><li><a href="/global/sigs/automation">Automation SIG</a></li><li><a href="/global/sigs/bigdata">Big Data SIG</a></li><li><a href="/cvss">Common Vulnerability Scoring System (CVSS-SIG)</a><ul><li><a href="/cvss/calculator/4.0">Calculator</a></li><li><a href="/cvss/v4.0/specification-document">Specification Document</a></li><li><a href="/cvss/v4.0/user-guide">User Guide</a></li><li><a href="/cvss/v4.0/examples">Examples</a></li><li><a href="/cvss/v4.0/faq">Frequently Asked Questions</a></li><li><a href="/cvss/v4-0">CVSS v4.0 Documentation & Resources</a><ul><li><a href="/cvss/calculator/4.0">CVSS v4.0 Calculator</a></li><li><a href="/cvss/v4.0/specification-document">CVSS v4.0 Specification Document</a></li><li><a href="/cvss/v4.0/user-guide">CVSS v4.0 User Guide</a></li><li><a href="/cvss/v4.0/examples">CVSS v4.0 Examples</a></li><li><a href="/cvss/v4.0/faq">CVSS v4.0 FAQ</a></li></ul></li><li><a href="/cvss/v3-1">CVSS v3.1 Archive</a><ul><li><a href="/cvss/calculator/3.1">CVSS v3.1 Calculator</a></li><li><a href="/cvss/v3.1/specification-document">CVSS v3.1 Specification Document</a></li><li><a href="/cvss/v3.1/user-guide">CVSS v3.1 User Guide</a></li><li><a href="/cvss/v3.1/examples">CVSS v3.1 Examples</a></li><li><a href="/cvss/v3.1/use-design">CVSS v3.1 Calculator Use & Design</a></li></ul></li><li><a href="/cvss/v3-0">CVSS v3.0 Archive</a><ul><li><a href="/cvss/calculator/3.0">CVSS v3.0 Calculator</a></li><li><a href="/cvss/v3.0/specification-document">CVSS v3.0 Specification Document</a></li><li><a href="/cvss/v3.0/user-guide">CVSS v3.0 User Guide</a></li><li><a href="/cvss/v3.0/examples">CVSS v3.0 Examples</a></li><li><a href="/cvss/v3.0/use-design">CVSS v3.0 Calculator Use & Design</a></li></ul></li><li><a href="/cvss/v2">CVSS v2 Archive</a><ul><li><a href="/cvss/v2/guide">CVSS v2 Complete Documentation</a></li><li><a href="/cvss/v2/history">CVSS v2 History</a></li><li><a href="/cvss/v2/team">CVSS-SIG team</a></li><li><a href="/cvss/v2/meetings">SIG Meetings</a></li><li><a href="/cvss/v2/faq">Frequently Asked Questions</a></li><li><a href="/cvss/v2/adopters">CVSS Adopters</a></li><li><a href="/cvss/v2/links">CVSS Links</a></li></ul></li><li><a href="/cvss/v1">CVSS v1 Archive</a><ul><li><a href="/cvss/v1/intro">Introduction to CVSS</a></li><li><a href="/cvss/v1/faq">Frequently Asked Questions</a></li><li><a href="/cvss/v1/guide">Complete CVSS v1 Guide</a></li></ul></li><li><a href="/cvss/data-representations">JSON & XML Data Representations</a></li><li><a href="/cvss/training">CVSS On-Line Training Course</a></li><li><a href="/cvss/identity">Identity & logo usage</a></li></ul></li><li><a href="/global/sigs/csirt">CSIRT Framework Development SIG</a></li><li><a href="/global/sigs/cyberinsurance">Cyber Insurance SIG</a><ul><li><a href="/global/sigs/cyberinsurance/events">Cyber Insurance SIG Webinars</a></li></ul></li><li><a href="/global/sigs/cti">Cyber Threat Intelligence SIG</a><ul><li><a href="/global/sigs/cti/curriculum/">Curriculum</a><ul><li><a href="/global/sigs/cti/curriculum/introduction">Introduction</a></li><li><a href="/global/sigs/cti/curriculum/cti-introduction">Introduction to CTI as a General topic</a></li><li><a href="/global/sigs/cti/curriculum/methods-methodology">Methods and Methodology</a></li><li><a href="/global/sigs/cti/curriculum/pir">Priority Intelligence Requirement (PIR)</a></li><li><a href="/global/sigs/cti/curriculum/source-evaluation">Source Evaluation and Information Reliability</a></li><li><a href="/global/sigs/cti/curriculum/machine-human">Machine and Human Analysis Techniques (and Intelligence Cycle)</a></li><li><a href="/global/sigs/cti/curriculum/threat-modelling">Threat Modelling</a></li><li><a href="/global/sigs/cti/curriculum/training">Training</a></li><li><a href="/global/sigs/cti/curriculum/standards">Standards</a></li><li><a href="/global/sigs/cti/curriculum/glossary">Glossary</a></li><li><a href="/global/sigs/cti/curriculum/cti-reporting/">Communicating Uncertainties in CTI Reporting</a></li></ul></li><li><a href="/global/sigs/cti/events/">Webinars and Online Training</a></li><li><a href="/global/sigs/cti/cti-program">Building a CTI program and team</a><ul><li><a href="/global/sigs/cti/cti-program/program-stages">Program maturity stages</a><ul><li><a href="/global/sigs/cti/cti-program/stage1">CTI Maturity model - Stage 1</a></li><li><a href="/global/sigs/cti/cti-program/stage2">CTI Maturity model - Stage 2</a></li><li><a href="/global/sigs/cti/cti-program/stage3">CTI Maturity model - Stage 3</a></li></ul></li><li><a href="/global/sigs/cti/cti-program/starter-kit">Program Starter Kit</a></li><li><a href="/global/sigs/cti/cti-program/resources">Resources and supporting materials</a></li></ul></li></ul></li><li><a href="/global/sigs/digital-safety">Digital Safety SIG</a></li><li><a href="/global/sigs/dns">DNS Abuse SIG</a><ul><li><a href="/global/sigs/dns/policies">Code of Conduct & Other Policies</a></li><li><a href="/global/sigs/dns/dns-abuse-examples">Examples of DNS Abuse</a></li></ul></li><li><a href="/global/sigs/ethics">Ethics SIG</a><ul><li><a href="/global/sigs/ethics/ethics-first">Ethics for Incident Response Teams</a></li></ul></li><li><a href="/epss/">Exploit Prediction Scoring System (EPSS)</a><ul><li><a href="/epss/model">The EPSS Model</a></li><li><a href="/epss/data_stats">Data and Statistics</a></li><li><a href="/epss/user-guide">User Guide</a></li><li><a href="/epss/research">EPSS Research and Presentations</a></li><li><a href="/epss/faq">Frequently Asked Questions</a></li><li><a href="/epss/who_is_using">Who is using EPSS?</a></li><li><a href="/epss/epss_tools">Open-source EPSS Tools</a></li><li><a href="/epss/api">API</a></li><li><a href="/epss/papers">Related Exploit Research</a></li><li><a>Blog</a><ul><li><a href="/epss/articles/prob_percentile_bins">Understanding EPSS Probabilities and Percentiles</a></li><li><a href="/epss/articles/log4shell">Log4Shell Use Case</a></li><li><a href="/epss/articles/estimating_old_cvss">Estimating CVSS v3 Scores for 100,000 Older Vulnerabilities</a></li></ul></li><li><a href="/epss/partners">Data Partners</a></li></ul></li><li><a href="/global/sigs/msr/">FIRST Multi-Stakeholder Ransomware SIG</a></li><li><a href="/global/sigs/hfs/">Human Factors in Security SIG</a></li><li><a href="/global/sigs/ics">Industrial Control Systems SIG (ICS-SIG)</a></li><li><a href="/global/sigs/iep">Information Exchange Policy SIG (IEP-SIG)</a></li><li><a href="/global/sigs/information-sharing">Information Sharing SIG</a><ul><li><a href="/global/sigs/information-sharing/misp">Malware Information Sharing Platform</a></li></ul></li><li><a href="/global/sigs/le">Law Enforcement SIG</a></li><li><a href="/global/sigs/malware">Malware Analysis SIG</a><ul><li><a href="/global/sigs/malware/ma-framework">Malware Analysis Framework</a></li><li><a href="/global/sigs/malware/ma-framework/malwaretools">Malware Analysis Tools</a></li></ul></li><li><a href="/global/sigs/metrics">Metrics SIG</a><ul><li><a href="/global/sigs/metrics/events">Metrics SIG Webinars</a></li></ul></li><li><a href="/global/sigs/netsec/">NETSEC SIG</a></li><li><a href="/global/sigs/passive-dns">Passive DNS Exchange</a></li><li><a href="/global/sigs/policy">Policy SIG</a></li><li><a href="/global/sigs/psirt">PSIRT SIG</a></li><li><a href="/global/sigs/red-team">Red Team SIG</a></li><li><a href="/global/sigs/cpg">Retail and Consumer Packaged Goods (CPG) SIG</a></li><li><a href="/global/sigs/ctf">Security Lounge SIG</a></li><li><a href="/global/sigs/tic/">Threat Intel Coalition SIG</a><ul><li><a href="/global/sigs/tic/membership-rules">Membership Requirements and Veto Rules</a></li></ul></li><li><a href="/global/sigs/tlp">Traffic Light Protocol (TLP-SIG)</a></li><li><a href="/global/sigs/transport">Transportation and Mobility SIG</a></li><li><a href="/global/sigs/vulnerability-coordination">Vulnerability Coordination</a><ul><li><a href="/global/sigs/vulnerability-coordination/multiparty">Multi-Party Vulnerability Coordination and Disclosure</a></li><li><a href="/global/sigs/vulnerability-coordination/multiparty/guidelines">Guidelines and Practices for Multi-Party Vulnerability Coordination and Disclosure</a></li></ul></li><li><a href="/global/sigs/vrdx">Vulnerability Reporting and Data eXchange SIG (VRDX-SIG)</a><ul><li><a href="/global/sigs/vrdx/vdb-catalog">Vulnerability Database Catalog</a></li></ul></li><li><a href="/global/sigs/wof">Women of FIRST</a></li></ul></li><li><a href="/global/governance">Internet Governance</a></li><li><a href="/global/irt-database">IR Database</a></li><li><a href="/global/fellowship">Fellowship Program</a><ul><li><a href="https://portal.first.org/fellowship">Application Form</a></li></ul></li><li><a href="/global/mentorship">Mentorship Program</a></li><li><a href="/hof">IR Hall of Fame</a><ul><li><a href="/hof/inductees">Hall of Fame Inductees</a></li></ul></li><li><a href="/global/victim-notification">Victim Notification</a></li><li><a href="/volunteers/">Volunteers at FIRST</a><ul><li><a href="/volunteers/list">FIRST Volunteers</a></li><li><a href="/volunteers/participation">Volunteer Contribution Record</a></li></ul></li><li><a href="#new">Previous Activities</a><ul><li><a href="/global/practices">Best Practices Contest</a></li></ul></li></ul></li></ul></div><div id="c7" data-studio="Yu8FjCC11g" class="h2labels h3labels subbox"><div id="toc" class="floating"></div></div></div><div id="sidebar" data-studio="CU52CV1W8g"></div><footer><div id="footer" data-studio="CU52CV1W8g"><div id="c4" data-studio="Yu8FjCC11g"><div class="content"> <div class="support"> <div class="kbsearch bottom"> <p><a href="https://support.first.org"><img src="/_/img/icon-portal_support.svg" alt="FIRST Support" title="FIRST Support" /></a> <input class="kb-search" type="search" placeholder="Do you need help?"></p> </div> </div> <div id="socialnetworks"><a href="/about/sdg" title="FIRST Supported Sustainable Development Goals (SDG)" class="icon-sdg"></a><a rel="me" href="https://infosec.exchange/@firstdotorg" target="_blank" title="@FIRSTdotOrg@infosec.exchange" class="icon-mastodon"></a><a href="https://twitter.com/FIRSTdotOrg" target="_blank" title="Twitter @FIRSTdotOrg" class="icon-tw"></a><a href="https://www.linkedin.com/company/firstdotorg" target="_blank" title="FIRST.Org at LinkedIn" class="icon-linkedin"></a><a href="https://www.facebook.com/FIRSTdotorg" target="_blank" title="FIRST.Org at Facebook" class="icon-fb"></a><a href="https://github.com/FIRSTdotorg" target="_blank" title="FIRST.Org at Github" class="icon-github"></a><a href="https://www.youtube.com/c/FIRSTdotorg" target="_blank" title="FIRST.Org at Youtube" class="icon-youtube"></a><a href="/podcasts" title="FIRST.Org Podcasts" class="icon-podcast"></a></div> <p><a href="/copyright">Copyright</a> © 2015—2024 by Forum of Incident Response and Security Teams, Inc. All Rights Reserved.</p> </div> <p><span class="tlp"></span></p></div></div></footer><script nonce="285Xol2btrhJht3bDBQXyg" async="async" src="/_/web.js?20241125212614"></script><script nonce="285Xol2btrhJht3bDBQXyg" async="async" src="/_/web.js?20241125212614"></script><script nonce="285Xol2btrhJht3bDBQXyg" async="async" src="/_/s.js?20241125-212616"></script></body></html>